CVE-2026-28920 | ByteOS Network

Vulnerability Details :

CVE-2026-28920

Assigner-apple

Assigner Org ID-286789f9-fbc2-4510-9f9a-43facdede74c

Published At-11 May, 2026 | 20:08

Updated At-13 May, 2026 | 13:32

An information leakage was addressed with additional validation. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Visiting a maliciously crafted website may leak sensitive data.

EPSS History

Score

Latest Score

-

N/A

Percentile

Latest Percentile

-

N/A

▼Common Vulnerabilities and Exposures (CVE)

Assigner:apple

Assigner Org ID:286789f9-fbc2-4510-9f9a-43facdede74c

Published At:11 May, 2026 | 20:08

Updated At:13 May, 2026 | 13:32

▼CVE Numbering Authority (CNA)

An information leakage was addressed with additional validation. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Visiting a maliciously crafted website may leak sensitive data.

Affected Products

Vendor

Product

Versions

Affected

From 0 before 18.7.9 (custom)
From 0 before 26.5 (custom)

Vendor

Product

Versions

Affected

From 0 before 14.8.7 (custom)
From 0 before 15.7.7 (custom)
From 0 before 26.5 (custom)

Vendor

Product

Versions

Affected

From 0 before 26.5 (custom)

Vendor

Product

Versions

Affected

From 0 before 26.5 (custom)

Vendor

Product

Versions

Affected

From 0 before 26.5 (custom)

Problem Types

Type	CWE ID	Description
N/A	N/A	Visiting a maliciously crafted website may leak sensitive data

Type: N/A

CWE ID: N/A

Description: Visiting a maliciously crafted website may leak sensitive data

References

Hyperlink	Resource
https://support.apple.com/en-us/127110	N/A
https://support.apple.com/en-us/127111	N/A
https://support.apple.com/en-us/127115	N/A
https://support.apple.com/en-us/127116	N/A
https://support.apple.com/en-us/127117	N/A
https://support.apple.com/en-us/127118	N/A
https://support.apple.com/en-us/127119	N/A
https://support.apple.com/en-us/127120	N/A

Hyperlink: https://support.apple.com/en-us/127110

Resource: N/A

Hyperlink: https://support.apple.com/en-us/127111

Resource: N/A

Hyperlink: https://support.apple.com/en-us/127115

Resource: N/A

Hyperlink: https://support.apple.com/en-us/127116

Resource: N/A

Hyperlink: https://support.apple.com/en-us/127117

Resource: N/A

Hyperlink: https://support.apple.com/en-us/127118

Resource: N/A

Hyperlink: https://support.apple.com/en-us/127119

Resource: N/A

Hyperlink: https://support.apple.com/en-us/127120

Resource: N/A

▼Authorized Data Publishers (ADP)

CISA ADP Vulnrichment

Problem Types

Type	CWE ID	Description
CWE	CWE-200	CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

Type: CWE

CWE ID: CWE-200

Description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

Metrics

Version	Base score	Base severity	Vector
3.1	6.5	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Version: 3.1

Base score: 6.5

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Metrics Other Info

▼National Vulnerability Database (NVD)

Source:product-security@apple.com

Published At:11 May, 2026 | 21:18

Updated At:12 May, 2026 | 14:13

An information leakage was addressed with additional validation. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Visiting a maliciously crafted website may leak sensitive data.

References

Hyperlink	Source	Resource
https://support.apple.com/en-us/127110	product-security@apple.com	N/A
https://support.apple.com/en-us/127111	product-security@apple.com	N/A
https://support.apple.com/en-us/127115	product-security@apple.com	N/A
https://support.apple.com/en-us/127116	product-security@apple.com	N/A
https://support.apple.com/en-us/127117	product-security@apple.com	N/A
https://support.apple.com/en-us/127118	product-security@apple.com	N/A
https://support.apple.com/en-us/127119	product-security@apple.com	N/A
https://support.apple.com/en-us/127120	product-security@apple.com	N/A

Hyperlink: https://support.apple.com/en-us/127110

Source: product-security@apple.com

Resource: N/A

Hyperlink: https://support.apple.com/en-us/127111

Source: product-security@apple.com

Resource: N/A

Hyperlink: https://support.apple.com/en-us/127115

Source: product-security@apple.com

Resource: N/A

Hyperlink: https://support.apple.com/en-us/127116

Source: product-security@apple.com

Resource: N/A

Hyperlink: https://support.apple.com/en-us/127117

Source: product-security@apple.com

Resource: N/A

Hyperlink: https://support.apple.com/en-us/127118

Source: product-security@apple.com

Resource: N/A

Hyperlink: https://support.apple.com/en-us/127119

Source: product-security@apple.com

Resource: N/A

Hyperlink: https://support.apple.com/en-us/127120

Source: product-security@apple.com

Resource: N/A

Similar CVEs

355Records found

Matching Score-10

Assigner-Apple Inc.

Matching Score-10

Assigner-Apple Inc.

CVSS Score-6.5||MEDIUM

EPSS-0.19% / 40.07%

||

7 Day CHG~0.00%

Published-27 Feb, 2023 | 00:00

Updated-11 Mar, 2025 | 17:15

The issue was addressed with improved UI handling. This issue is fixed in Safari 15.6, iOS 15.6 and iPadOS 15.6. Visiting a maliciously crafted website may leak sensitive data.

Vendor-Apple Inc.

Product-iphone_os ipados safari Safari iOS and iPadOS

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

Matching Score-10

Assigner-Apple Inc.

Matching Score-10

Assigner-Apple Inc.

CVSS Score-6.5||MEDIUM

EPSS-0.48% / 65.03%

||

7 Day CHG~0.00%

Published-23 Jan, 2024 | 00:25

Updated-02 Apr, 2026 | 19:16

An access issue was addressed with improved access restrictions. This issue is fixed in Safari 17.3, iOS 16.7.5 and iPadOS 16.7.5, iOS 17.3 and iPadOS 17.3, macOS Sonoma 14.3, tvOS 17.3, watchOS 10.3. A maliciously crafted webpage may be able to fingerprint the user.

Vendor-Apple Inc.

Product-tvos watchos safari macos iphone_os ipados Safari macOS tvOS iOS and iPadOS watchOS

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

Matching Score-10

Assigner-Apple Inc.

Matching Score-10

Assigner-Apple Inc.

CVSS Score-6.5||MEDIUM

EPSS-1.07% / 77.88%

||

7 Day CHG~0.00%

Published-08 Dec, 2020 | 19:20

Updated-04 Aug, 2024 | 10:43

An information disclosure issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.0, iOS 14.0 and iPadOS 14.0, iTunes for Windows 12.10.9, iCloud for Windows 11.5, tvOS 14.0. A remote attacker may be able to leak memory.

Vendor-Apple Inc.

Product-itunes watchos ipados tvos macos icloud tvOS macOS watchOS iOS and iPadOS

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

Matching Score-10

Assigner-Apple Inc.

Matching Score-10

Assigner-Apple Inc.

CVSS Score-6.5||MEDIUM

EPSS-0.21% / 42.92%

||

7 Day CHG~0.00%

Published-10 Jan, 2024 | 22:03

Updated-17 Jun, 2025 | 17:15

This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sonoma 14, Safari 17, iOS 17 and iPadOS 17. A remote attacker may be able to view leaked DNS queries with Private Relay turned on.

Vendor-Apple Inc.

Product-ipados iphone_os safari macos macOS iOS and iPadOS Safari

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

Matching Score-10

Assigner-Apple Inc.

Matching Score-10

Assigner-Apple Inc.

CVSS Score-6.5||MEDIUM

EPSS-0.12% / 30.24%

||

7 Day CHG~0.00%

Published-10 Mar, 2025 | 19:11

Updated-02 Apr, 2026 | 19:18

A cookie management issue was addressed with improved state management. This issue is fixed in Safari 18, iOS 18 and iPadOS 18, macOS Sequoia 15, tvOS 18, visionOS 2, watchOS 11. A malicious website may exfiltrate data cross-origin.

Vendor-Apple Inc.

Product-tvos watchos safari macos iphone_os ipados Safari visionOS macOS tvOS iOS and iPadOS watchOS

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

Matching Score-10

Assigner-Apple Inc.

Matching Score-10

Assigner-Apple Inc.

CVSS Score-6.5||MEDIUM

EPSS-0.65% / 70.97%

||

7 Day CHG~0.00%

Published-15 Dec, 2022 | 00:00

Updated-21 Apr, 2025 | 15:15

The issue was addressed with improved memory handling. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Processing maliciously crafted web content may result in the disclosure of process memory.

Vendor-Apple Inc.

Product-ipados tvos safari watchos macos iphone_os watchOS tvOS

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

Matching Score-10

Assigner-Apple Inc.

Matching Score-10

Assigner-Apple Inc.

CVSS Score-6.5||MEDIUM

EPSS-0.02% / 4.13%

||

7 Day CHG~0.00%

Published-11 May, 2026 | 20:07

Updated-12 May, 2026 | 20:16

This issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. An app may be able to access private information.

Vendor-Apple Inc.

Product-macOS

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CWE ID-CWE-284

Improper Access Control

Matching Score-10

Assigner-Apple Inc.

Matching Score-10

Assigner-Apple Inc.

CVSS Score-6.5||MEDIUM

EPSS-0.05% / 16.72%

||

7 Day CHG~0.00%

Published-15 Sep, 2025 | 22:34

Updated-02 Apr, 2026 | 19:20

The issue was addressed with improved handling of caches. This issue is fixed in Safari 26, iOS 18.7 and iPadOS 18.7, iOS 26 and iPadOS 26, macOS Tahoe 26, tvOS 26, visionOS 26, watchOS 26. A website may be able to access sensor information without user consent.

Vendor-Apple Inc.

Product-tvos visionos watchos safari macos iphone_os ipados Safari visionOS macOS tvOS iOS and iPadOS watchOS

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

Matching Score-10

Assigner-Apple Inc.

Matching Score-10

Assigner-Apple Inc.

CVSS Score-6.5||MEDIUM

EPSS-0.41% / 61.23%

||

7 Day CHG~0.00%

Published-01 Nov, 2022 | 00:00

Updated-21 Apr, 2025 | 20:15

A logic issue was addressed with improved state management. This issue is fixed in iOS 15.7.1 and iPadOS 15.7.1, iOS 16.1 and iPadOS 16, watchOS 9.1. Visiting a maliciously crafted website may leak sensitive data.

Vendor-Apple Inc.

Product-ipados watchos iphone_os iOS and iPadOS watchOS

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-6.5||MEDIUM

EPSS-0.29% / 52.53%

||

7 Day CHG~0.00%

Published-20 Sep, 2022 | 20:19

Updated-28 May, 2025 | 16:15

This issue was addressed by enabling hardened runtime. This issue is fixed in macOS Monterey 12.5. An app may be able to access user-sensitive data.

Vendor-Apple Inc.

Product-macos macOS

CWE ID-CWE-284

Improper Access Control

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-6.5||MEDIUM

EPSS-0.19% / 41.03%

||

7 Day CHG~0.00%

Published-11 Dec, 2024 | 22:59

Updated-02 Apr, 2026 | 19:18

An authorization issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ventura 13.7.2. An encrypted volume may be accessed by a different user without prompting for the password.

Vendor-Apple Inc.

Product-macos macOS

CWE ID-CWE-862

Missing Authorization

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-6.5||MEDIUM

EPSS-0.31% / 54.02%

||

7 Day CHG~0.00%

Published-08 Sep, 2021 | 14:46

Updated-03 Aug, 2024 | 16:25

An API issue in Accessibility TCC permissions was addressed with improved state management. This issue is fixed in macOS Big Sur 11.3, Security Update 2021-002 Catalina, Security Update 2021-003 Mojave. A malicious application may be able to unexpectedly leak a user's credentials from secure text fields.

Vendor-Apple Inc.

Product-macos mac_os_x macOS

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-6.5||MEDIUM

EPSS-0.22% / 43.91%

||

7 Day CHG~0.00%

Published-18 Mar, 2022 | 17:59

Updated-03 Aug, 2024 | 03:14

A cross-origin issue in the IndexDB API was addressed with improved input validation. This issue is fixed in iOS 15.3 and iPadOS 15.3, watchOS 8.4, tvOS 15.3, Safari 15.3, macOS Monterey 12.2. A website may be able to track sensitive user information.

Vendor-Apple Inc.

Product-iphone_os watchos ipados tvos safari macos tvOS macOS watchOS iOS and iPadOS

CWE ID-CWE-346

Origin Validation Error

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-6.5||MEDIUM

EPSS-0.22% / 44.75%

||

7 Day CHG~0.00%

Published-26 May, 2022 | 17:40

Updated-03 Aug, 2024 | 03:21

A cookie management issue was addressed with improved state management. This issue is fixed in Security Update 2022-003 Catalina, macOS Big Sur 11.6.5. Processing maliciously crafted web content may disclose sensitive user information.

Vendor-Fedora Project Apple Inc.

Product-fedora macos mac_os_x macOS

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-6.5||MEDIUM

EPSS-0.43% / 62.66%

||

7 Day CHG~0.00%

Published-08 Mar, 2024 | 01:36

Updated-02 Apr, 2026 | 19:17

The issue was addressed with improved UI handling. This issue is fixed in Safari 17.4, iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4, tvOS 17.4, visionOS 1.1, watchOS 10.4. A malicious website may exfiltrate audio data cross-origin.

Vendor-wpewebkit webkitgtk Apple Inc.Fedora Project

Product-tvos visionos watchos wpe_webkit webkitgtk ipad_os safari macos iphone_os fedora Safari visionOS macOS tvOS iOS and iPadOS watchOS

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-6.5||MEDIUM

EPSS-0.26% / 49.31%

||

7 Day CHG~0.00%

Published-28 Oct, 2024 | 21:08

Updated-02 Apr, 2026 | 19:18

An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 17.7.1 and iPadOS 17.7.1, iOS 18.1 and iPadOS 18.1, macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1, tvOS 18.1, visionOS 2.1, watchOS 11.1. Parsing a file may lead to disclosure of user information.

Vendor-Apple Inc.

Product-tvos visionos watchos macos iphone_os ipados visionOS macOS tvOS iOS and iPadOS watchOS

CWE ID-CWE-125

Out-of-bounds Read

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-6.5||MEDIUM

EPSS-0.55% / 68.03%

||

7 Day CHG+0.05%

Published-16 Sep, 2024 | 23:23

Updated-02 Apr, 2026 | 19:18

A cross-origin issue existed with "iframe" elements. This was addressed with improved tracking of security origins. This issue is fixed in Safari 18, iOS 18 and iPadOS 18, macOS Sequoia 15, tvOS 18, visionOS 2, watchOS 11. A malicious website may exfiltrate data cross-origin.

Vendor-Apple Inc.

Product-tvos visionos watchos safari macos iphone_os ipados Safari visionOS macOS tvOS iOS and iPadOS watchOS

CWE ID-CWE-346

Origin Validation Error

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-6.5||MEDIUM

EPSS-0.14% / 33.32%

||

7 Day CHG~0.00%

Published-28 Oct, 2024 | 21:08

Updated-02 Apr, 2026 | 19:18

The issue was addressed with improved checks. This issue is fixed in iOS 17.7.1 and iPadOS 17.7.1, iOS 18.1 and iPadOS 18.1, macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1, tvOS 18.1, visionOS 2.1, watchOS 11.1. Processing a maliciously crafted font may result in the disclosure of process memory.

Vendor-Apple Inc.

Product-tvos visionos watchos macos iphone_os ipados visionOS macOS tvOS iOS and iPadOS watchOS

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-6.5||MEDIUM

EPSS-0.23% / 45.15%

||

7 Day CHG~0.00%

Published-28 Oct, 2024 | 21:07

Updated-02 Apr, 2026 | 19:18

An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1. Parsing a file may lead to disclosure of user information.

Vendor-Apple Inc.

Product-macos macOS

CWE ID-CWE-125

Out-of-bounds Read

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-6.5||MEDIUM

EPSS-0.77% / 73.63%

||

7 Day CHG~0.00%

Published-08 Sep, 2021 | 14:54

Updated-03 Aug, 2024 | 16:25

A memory initialization issue was addressed with improved memory handling. This issue is fixed in macOS Big Sur 11.3, iOS 14.5 and iPadOS 14.5, watchOS 7.4, tvOS 14.5. Processing maliciously crafted web content may result in the disclosure of process memory.

Vendor-Apple Inc.

Product-iphone_os watchos tvos ipados macos tvOS macOS watchOS iOS and iPadOS

CWE ID-CWE-665

Improper Initialization

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-6.5||MEDIUM

EPSS-0.60% / 69.76%

||

7 Day CHG~0.00%

Published-08 Sep, 2021 | 14:44

Updated-03 Aug, 2024 | 16:25

A memory initialization issue was addressed with improved memory handling. This issue is fixed in iTunes 12.11.3 for Windows, Security Update 2021-002 Catalina, Security Update 2021-003 Mojave, iCloud for Windows 12.3, macOS Big Sur 11.3, watchOS 7.4, tvOS 14.5, iOS 14.5 and iPadOS 14.5. Processing maliciously crafted web content may disclose sensitive user information.

Vendor-Apple Inc.

Product-itunes iphone_os ipados tvos watchos mac_os_x macos icloud iTunes for Windows watchOS iCloud for Windows macOS tvOS iOS and iPadOS

CWE ID-CWE-665

Improper Initialization

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-6.5||MEDIUM

EPSS-0.60% / 69.76%

||

7 Day CHG~0.00%

Published-08 Sep, 2021 | 14:55

Updated-03 Aug, 2024 | 16:25

A logic issue was addressed with improved state management. This issue is fixed in iTunes 12.11.3 for Windows, Security Update 2021-002 Catalina, Security Update 2021-003 Mojave, iCloud for Windows 12.3, macOS Big Sur 11.3, watchOS 7.4, tvOS 14.5, iOS 14.5 and iPadOS 14.5. Processing a maliciously crafted font may result in the disclosure of process memory.

Vendor-Apple Inc.

Product-itunes iphone_os ipados tvos watchos mac_os_x macos icloud iTunes for Windows watchOS iCloud for Windows macOS tvOS iOS and iPadOS

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-6.5||MEDIUM

EPSS-0.07% / 21.45%

||

7 Day CHG~0.00%

Published-23 Jun, 2023 | 00:00

Updated-23 Oct, 2025 | 18:48

Known KEV||Action Due Date - 2023-06-12||Apply updates per vendor instructions.

An out-of-bounds read was addressed with improved input validation. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, iOS 15.7.6 and iPadOS 15.7.6, Safari 16.5, iOS 16.5 and iPadOS 16.5. Processing web content may disclose sensitive information. Apple is aware of a report that this issue may have been actively exploited.

Vendor-webkitgtk Apple Inc.

Product-tvos watchos ipados webkitgtk\+macos safari iphone_os Safari iOS and iPadOS tvOS watchOS macOS Multiple Products

CWE ID-CWE-125

Out-of-bounds Read

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-6.5||MEDIUM

EPSS-0.52% / 67.00%

||

7 Day CHG~0.00%

Published-08 Sep, 2021 | 14:45

Updated-03 Aug, 2024 | 16:25

A memory initialization issue was addressed with improved memory handling. This issue is fixed in Security Update 2021-002 Catalina, Security Update 2021-003 Mojave, iOS 14.5 and iPadOS 14.5, watchOS 7.4, tvOS 14.5, macOS Big Sur 11.3. A malicious application may be able to disclose kernel memory.

Vendor-Apple Inc.

Product-iphone_os watchos ipados tvos mac_os_x macos tvOS macOS watchOS iOS and iPadOS

CWE ID-CWE-665

Improper Initialization

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-6.5||MEDIUM

EPSS-0.26% / 49.08%

||

7 Day CHG~0.00%

Published-18 Dec, 2019 | 17:33

Updated-04 Aug, 2024 | 21:24

A permissions issue existed in the handling of motion and orientation data. This issue was addressed with improved restrictions. This issue is fixed in iOS 12.2. A website may be able to access sensor information without user consent.

Vendor-Apple Inc.

Product-iphone_os iOS

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-6.5||MEDIUM

EPSS-0.24% / 46.47%

||

7 Day CHG~0.00%

Published-06 Sep, 2023 | 01:36

Updated-13 Feb, 2025 | 16:50

Error handling was changed to not reveal sensitive information. This issue is fixed in macOS Ventura 13.3. A website may be able to track sensitive user information.

Vendor-Apple Inc.

Product-macos macOS

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-6.5||MEDIUM

EPSS-0.28% / 51.33%

||

7 Day CHG~0.00%

Published-09 Jun, 2020 | 15:59

Updated-04 Aug, 2024 | 07:44

This issue was addressed with improved checks. This issue is fixed in macOS Catalina 10.15.5. Importing a maliciously crafted calendar invitation may exfiltrate user information.

Vendor-Apple Inc.

Product-mac_os_x macOS

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-6.5||MEDIUM

EPSS-0.19% / 40.81%

||

7 Day CHG~0.00%

Published-10 Jan, 2024 | 22:03

Updated-20 Jun, 2025 | 16:15

An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Ventura 13.3, tvOS 16.4, iOS 16.4 and iPadOS 16.4, watchOS 9.4. Processing an image may result in disclosure of process memory.

Vendor-Apple Inc.

Product-iphone_os macos tvos ipados watchos iOS and iPadOS tvOS macOS watchOS

CWE ID-CWE-125

Out-of-bounds Read

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-6.5||MEDIUM

EPSS-0.19% / 40.81%

||

7 Day CHG~0.00%

Published-10 Jan, 2024 | 22:03

Updated-16 Jun, 2025 | 19:15

An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Ventura 13.3, tvOS 16.4, iOS 16.4 and iPadOS 16.4, watchOS 9.4. Processing an image may result in disclosure of process memory.

Vendor-Apple Inc.

Product-iphone_os macos watchos ipados tvos watchOS iOS and iPadOS tvOS macOS

CWE ID-CWE-125

Out-of-bounds Read

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-6.5||MEDIUM

EPSS-0.05% / 15.67%

||

7 Day CHG~0.00%

Published-30 Nov, 2023 | 22:18

Updated-23 Oct, 2025 | 18:49

Known KEV||Action Due Date - 2023-12-25||Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.

An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 17.1.2 and iPadOS 17.1.2, macOS Sonoma 14.1.2, Safari 17.1.2. Processing web content may disclose sensitive information. Apple is aware of a report that this issue may have been exploited against versions of iOS before iOS 16.7.1.

Vendor-webkitgtk Debian GNU/Linux Apple Inc.Fedora Project

Product-debian_linux ipados fedora webkitgtk\+macos safari iphone_os Safari macOS iOS and iPadOS iphone_os ipados safari macos Multiple Products

CWE ID-CWE-125

Out-of-bounds Read

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-6.5||MEDIUM

EPSS-0.13% / 31.27%

||

7 Day CHG-0.01%

Published-26 Sep, 2023 | 20:14

Updated-04 Nov, 2025 | 20:16

The issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13.6, tvOS 17, iOS 16.7 and iPadOS 16.7, macOS Monterey 12.7, watchOS 10, iOS 17 and iPadOS 17, macOS Sonoma 14. Processing web content may disclose sensitive information.

Vendor-Apple Inc.

Product-tvos watchos ipados macos iphone_os watchOS iOS and iPadOS tvOS macOS

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-6.5||MEDIUM

EPSS-0.29% / 52.00%

||

7 Day CHG~0.00%

Published-25 Oct, 2023 | 18:31

Updated-13 Feb, 2025 | 17:08

The issue was addressed with improved memory handling. This issue is fixed in iOS 17.1 and iPadOS 17.1, macOS Monterey 12.7.1, iOS 16.7.2 and iPadOS 16.7.2, macOS Ventura 13.6.1, macOS Sonoma 14.1. Processing an image may result in disclosure of process memory.

Vendor-Apple Inc.

Product-iphone_os macos ipados iOS and iPadOS macOS

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-6.5||MEDIUM

EPSS-0.40% / 61.04%

||

7 Day CHG~0.00%

Published-26 Sep, 2023 | 20:14

Updated-04 Nov, 2025 | 20:16

The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. Processing web content may disclose sensitive information.

Vendor-Apple Inc.

Product-macos macOS

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-6.5||MEDIUM

EPSS-0.35% / 57.46%

||

7 Day CHG~0.00%

Published-26 Jul, 2023 | 23:42

Updated-13 Feb, 2025 | 17:01

The issue was addressed with improved checks. This issue is fixed in iOS 15.7.8 and iPadOS 15.7.8, iOS 16.6 and iPadOS 16.6, tvOS 16.6, macOS Ventura 13.5, Safari 16.6, watchOS 9.6. Processing web content may disclose sensitive information.

Vendor-Apple Inc.

Product-iphone_os watchos ipados tvos safari macos iOS and iPadOS tvOS macOS Safari watchOS

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-6.5||MEDIUM

EPSS-0.54% / 67.83%

||

7 Day CHG+0.18%

Published-28 Jul, 2023 | 04:30

Updated-13 Feb, 2025 | 17:02

A logic issue was addressed with improved state management. This issue is fixed in Safari 16.6, watchOS 9.6, iOS 15.7.8 and iPadOS 15.7.8, tvOS 16.6, iOS 16.6 and iPadOS 16.6, macOS Ventura 13.5. A website may be able to track sensitive user information.

Vendor-Apple Inc.

Product-iphone_os watchos ipados tvos safari macos iOS and iPadOS tvOS macOS Safari watchOS

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-6.5||MEDIUM

EPSS-0.74% / 73.16%

||

7 Day CHG~0.00%

Published-15 Dec, 2022 | 00:00

Updated-21 Apr, 2025 | 14:15

A logic issue was addressed with improved checks. This issue is fixed in Safari 16.2, tvOS 16.2, iCloud for Windows 14.1, macOS Ventura 13.1, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Processing maliciously crafted web content may disclose sensitive user information.

Vendor-Apple Inc.

Product-ipados tvos safari icloud watchos macos iphone_os iCloud for Windows watchOS tvOS

CWE ID-CWE-693

Protection Mechanism Failure

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-6.5||MEDIUM

EPSS-0.04% / 11.51%

||

7 Day CHG~0.00%

Published-25 Mar, 2026 | 00:32

Updated-07 Apr, 2026 | 21:50

A file access issue was addressed with improved input validation. This issue is fixed in macOS Tahoe 26.4. An attacker may gain access to protected parts of the file system.

Vendor-Apple Inc.

Product-macos macOS

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-6.5||MEDIUM

EPSS-0.03% / 8.53%

||

7 Day CHG~0.00%

Published-25 Mar, 2026 | 00:32

Updated-10 May, 2026 | 14:16

A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.4 and iPadOS 26.4, tvOS 26.4, visionOS 26.4, watchOS 26.4. An app may be able to fingerprint the user.

Vendor-Apple Inc.

Product-ipados iphone_os visionos tvos watchos visionOS watchOS iOS and iPadOS tvOS

CWE ID-CWE-284

Improper Access Control

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-6.5||MEDIUM

EPSS-0.04% / 10.81%

||

7 Day CHG~0.00%

Published-30 Apr, 2026 | 22:00

Updated-04 May, 2026 | 18:22

Users who connect to malicious registries with hostnames matching the bypass patterns will have their registry credentials exposed in plaintext. This issue is fixed in container version 0.12.3.

Vendor-Apple Inc.

Product-container macOS

CWE ID-CWE-522

Insufficiently Protected Credentials

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-6.5||MEDIUM

EPSS-0.14% / 33.45%

||

7 Day CHG~0.00%

Published-27 Feb, 2020 | 20:45

Updated-04 Aug, 2024 | 07:44

The issue was addressed with improved UI handling. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, Safari 13.0.5. A local user may unknowingly send a password unencrypted over the network.

Vendor-Apple Inc.

Product-iphone_os safari ipados Safari iOS

CWE ID-CWE-319

Cleartext Transmission of Sensitive Information

CWE ID-CWE-522

Insufficiently Protected Credentials

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-6.5||MEDIUM

EPSS-0.13% / 31.58%

||

7 Day CHG~0.00%

Published-23 Jun, 2023 | 00:00

Updated-05 Dec, 2024 | 15:56

An out-of-bounds read was addressed with improved input validation. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, Safari 16.5, iOS 16.5 and iPadOS 16.5. Processing web content may disclose sensitive information.

Vendor-Apple Inc.

Product-iphone_os watchos ipados tvos safari macos watchOS Safari macOS tvOS iOS and iPadOS

CWE ID-CWE-125

Out-of-bounds Read

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-6.5||MEDIUM

EPSS-0.17% / 38.09%

||

7 Day CHG~0.00%

Published-23 Jun, 2023 | 00:00

Updated-20 Mar, 2025 | 17:00

A buffer overflow issue was addressed with improved memory handling. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, Safari 16.5, iOS 16.5 and iPadOS 16.5. Processing web content may disclose sensitive information.

Vendor-Apple Inc.

Product-watchos iphone_os macos tvos safari ipados watchOS Safari macOS tvOS iOS and iPadOS

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-6.5||MEDIUM

EPSS-0.14% / 34.29%

||

7 Day CHG-0.04%

Published-08 May, 2023 | 00:00

Updated-29 Jan, 2025 | 15:15

The issue was addressed by removing origin information. This issue is fixed in macOS Ventura 13.3, Safari 16.4, iOS 16.4 and iPadOS 16.4, iOS 15.7.4 and iPadOS 15.7.4, tvOS 16.4, watchOS 9.4. A website may be able to track sensitive user information.

Vendor-Debian GNU/Linux Apple Inc.

Product-ipados tvos iphone_os safari watchos macos debian_linux watchOS macOS iOS and iPadOS Safari tvOS

CWE ID-CWE-863

Incorrect Authorization

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-6.5||MEDIUM

EPSS-0.73% / 72.75%

||

7 Day CHG~0.00%

Published-18 Dec, 2019 | 17:33

Updated-04 Aug, 2024 | 21:24

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, Safari 12.1.1, iTunes for Windows 12.9.5, iCloud for Windows 7.12. Processing maliciously crafted web content may lead to arbitrary code execution.

Vendor-Apple Inc.

Product-itunes iphone_os tvos safari mac_os_x icloud iTunes for Windows Safari iCloud for Windows macOS iOS tvOS

CWE ID-CWE-125

Out-of-bounds Read

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-6.5||MEDIUM

EPSS-0.16% / 36.40%

||

7 Day CHG~0.00%

Published-27 Oct, 2020 | 19:47

Updated-04 Aug, 2024 | 21:31

A cross-origin issue existed with "iframe" elements. This was addressed with improved tracking of security origins. This issue is fixed in macOS Catalina 10.15.1, Security Update 2019-001, and Security Update 2019-006. A malicious HTML document may be able to render iframes with sensitive user information.

Vendor-Apple Inc.

Product-mac_os_x macOS

CWE ID-CWE-346

Origin Validation Error

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-6.5||MEDIUM

EPSS-0.68% / 71.77%

||

7 Day CHG~0.00%

Published-18 Dec, 2019 | 17:33

Updated-04 Aug, 2024 | 21:24

An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, watchOS 5.2.1, Safari 12.1.1, iTunes for Windows 12.9.5, iCloud for Windows 7.12. Processing maliciously crafted web content may result in the disclosure of process memory.

Vendor-Apple Inc.

Product-itunes iphone_os watchos tvos safari mac_os_x icloud iTunes for Windows watchOS Safari iCloud for Windows macOS iOS tvOS

CWE ID-CWE-125

Out-of-bounds Read

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-6.5||MEDIUM

EPSS-0.48% / 65.10%

||

7 Day CHG~0.00%

Published-27 Oct, 2020 | 19:37

Updated-04 Aug, 2024 | 21:24

A logic issue was addressed with improved state management. This issue is fixed in iOS 12.1.3, iCloud for Windows 7.10, iTunes 12.9.3 for Windows, Safari 12.0.3, tvOS 12.1.2. Processing maliciously crafted web content may disclose sensitive user information.

Vendor-Apple Inc.

Product-itunes iphone_os tvos safari icloud iTunes for Windows iCloud for Windows Safari iOS tvOS

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-6.5||MEDIUM

EPSS-0.48% / 65.09%

||

7 Day CHG~0.00%

Published-18 Dec, 2019 | 17:33

Updated-04 Aug, 2024 | 21:17

A cross-origin issue existed with the fetch API. This was addressed with improved input validation. This issue is fixed in iOS 12.2, tvOS 12.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may disclose sensitive user information.

Vendor-Apple Inc.

Product-itunes iphone_os tvos safari icloud iTunes for Windows iCloud for Windows Safari iOS tvOS

CWE ID-CWE-20

Improper Input Validation

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-6.5||MEDIUM

EPSS-0.36% / 58.06%

||

7 Day CHG~0.00%

Published-18 Dec, 2019 | 17:33

Updated-04 Aug, 2024 | 21:17

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 12.2, macOS Mojave 10.14.4, tvOS 12.2, watchOS 5.2. Processing a maliciously crafted font may result in the disclosure of process memory.

Vendor-Apple Inc.

Product-mac_os_x iphone_os watchos tvos tvOS macOS watchOS iOS

CWE ID-CWE-125

Out-of-bounds Read

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-6.5||MEDIUM

EPSS-0.73% / 72.75%

||

7 Day CHG~0.00%

Published-18 Dec, 2019 | 17:33

Updated-04 Aug, 2024 | 21:24

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, Safari 12.1.1, iTunes for Windows 12.9.5, iCloud for Windows 7.12. Processing maliciously crafted web content may lead to arbitrary code execution.

Vendor-Apple Inc.

Product-itunes iphone_os watchos tvos safari mac_os_x icloud iTunes for Windows Safari iCloud for Windows macOS iOS tvOS

CWE ID-CWE-787

Out-of-bounds Write

CWE ID-CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')