Where
AND
AND
-Infinity
0

Trending

Last week
Last month
Last year

Apple tvOSNull Pointer Dereference, Input Validation, Buffer Overflow, Use After Free, Integer Overflow

Risk 35
Severity
5.9
Null Pointer Dereference, Input Validation, Buffer Overflow, Use After Free, Integer Overflow
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

802.1X. An authentication issue was addressed with improved state management.

1 / 26
Source: Apple
First published (updated )
CVE-2026-28886

Apple macOS TahoeBuffer Overflow, Race Condition, Input Validation, Integer Overflow, Infoleak, Use After Free

Risk 31
Severity
5.5
Buffer Overflow, Race Condition, Input Validation, Integer Overflow, Infoleak, Use After Free
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Accessibility. This issue was addressed through improved state management.

1 / 76
Source: Apple
First published (updated )
CVE-2026-64744

Apple WatchOSUse After Free, Buffer Overflow, Input Validation, Integer Overflow, Race Condition

Risk 37
Severity
6.5
Use After Free, Buffer Overflow, Input Validation, Integer Overflow, Race Condition
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Accessibility. This issue was addressed through improved state management.

1 / 81
Source: Apple
First published (updated )
CVE-2026-64735

Apple WatchOSUse After Free, Buffer Overflow, Race Condition, Input Validation, Infoleak

Risk 31
Severity
5.5
Use After Free, Buffer Overflow, Race Condition, Input Validation, Infoleak
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Accessibility. This issue was addressed through improved state management.

1 / 30
Source: Apple
First published (updated )
CVE-2026-64734

Apple WatchOSUse After Free, Buffer Overflow, Input Validation, Integer Overflow, Race Condition, Double Free

Risk 31
Severity
5.5
Use After Free, Buffer Overflow, Input Validation, Integer Overflow, Race Condition, Double Free
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Accessibility. This issue was addressed through improved state management.

1 / 105
Source: Apple
First published (updated )
CVE-2026-64724

Apple macOS TahoeBuffer Overflow, Race Condition, Use After Free, Input Validation, Integer Overflow

Risk 31
Severity
5.5
Buffer Overflow, Race Condition, Use After Free, Input Validation, Integer Overflow
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

A logic issue was addressed with improved checks. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to access sensitive user data.

1 / 89
Source: MITRE
First published (updated )
CVE-2026-64723

Apple WatchOSUse After Free, Buffer Overflow, Input Validation, Integer Overflow, Race Condition, Infoleak

Risk 31
Severity
5.5
Use After Free, Buffer Overflow, Input Validation, Integer Overflow, Race Condition, Infoleak
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Accessibility. This issue was addressed through improved state management.

1 / 88
Source: Apple
First published (updated )
CVE-2026-64709

Apple WatchOSUse After Free, Buffer Overflow, Input Validation, Integer Overflow, Race Condition

Risk 31
Severity
5.5
Use After Free, Buffer Overflow, Input Validation, Integer Overflow, Race Condition
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Accessibility. This issue was addressed through improved state management.

1 / 92
Source: Apple
First published (updated )
CVE-2026-64721

Apple visionOSBuffer Overflow, Race Condition, Use After Free, Input Validation

Risk 31
Severity
5.5
Buffer Overflow, Race Condition, Use After Free, Input Validation
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

A permissions issue was addressed with improved validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, visionOS 26.6. An app may be able to delete files for which it does not have permission.

1 / 24
Source: MITRE
First published (updated )
CVE-2026-64707

Apple WatchOSUse After Free, Buffer Overflow, Input Validation, Integer Overflow, Race Condition

Risk 31
Severity
5.5
Use After Free, Buffer Overflow, Input Validation, Integer Overflow, Race Condition
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

A type confusion issue was addressed with improved checks. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing a maliciously crafted image may lead to a denial-of-service.

1 / 70
Source: MITRE
First published (updated )
CVE-2026-64693

Apple WatchOSBuffer Overflow, Input Validation, Infoleak

Risk 31
Severity
5.5
Buffer Overflow, Input Validation, Infoleak
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Accessibility. This issue was addressed through improved state management.

1 / 10
Source: Apple
First published (updated )
CVE-2026-43801

Apple WatchOSUse After Free, Buffer Overflow, Race Condition, Input Validation, Integer Overflow, Infoleak

Risk 31
Severity
5.5
Use After Free, Buffer Overflow, Race Condition, Input Validation, Integer Overflow, Infoleak
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Accessibility. This issue was addressed through improved state management.

1 / 57
Source: Apple
First published (updated )
CVE-2026-43796

Apple WatchOSUse After Free, Buffer Overflow, Race Condition, Input Validation

Risk 31
Severity
5.5
Use After Free, Buffer Overflow, Race Condition, Input Validation
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Accessibility. This issue was addressed through improved state management.

1 / 35
Source: Apple
First published (updated )
CVE-2026-43744

Apple macOS TahoeBuffer Overflow, Race Condition, Use After Free, Input Validation, Integer Overflow, Infoleak

Risk 31
Severity
5.5
Buffer Overflow, Race Condition, Use After Free, Input Validation, Integer Overflow, Infoleak
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Accessibility. This issue was addressed through improved state management.

1 / 90
Source: Apple
First published (updated )
CVE-2026-43754

Apple macOS SequoiaBuffer Overflow, Race Condition, Input Validation

Risk 31
Severity
5.5
Buffer Overflow, Race Condition, Input Validation
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Accessibility. This issue was addressed through improved state management.

1 / 34
Source: Apple
First published (updated )
CVE-2026-43738

Apple WatchOSUse After Free, Buffer Overflow, Race Condition, Input Validation, Integer Overflow

Risk 31
Severity
5.5
Use After Free, Buffer Overflow, Race Condition, Input Validation, Integer Overflow
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Accessibility. This issue was addressed through improved state management.

1 / 54
Source: Apple
First published (updated )
CVE-2026-43714

Apple macOS TahoeBuffer Overflow, Input Validation, Race Condition, Use After Free, Integer Overflow, Null Pointer Dereference

Risk 31
Severity
5.5
Buffer Overflow, Input Validation, Race Condition, Use After Free, Integer Overflow, Null Pointer Dereference
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

A race condition was addressed with additional validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. An app may be able to access sensitive user data.

1 / 112
Source: MITRE
First published (updated )
CVE-2026-28996

Apple iOSUse After Free, Input Validation, Null Pointer Dereference, Race Condition, Buffer Overflow, Integer Overflow

Risk 31
Severity
5.5
Use After Free, Input Validation, Null Pointer Dereference, Race Condition, Buffer Overflow, Integer Overflow
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

802.1X. An authentication issue was addressed with improved state management.

1 / 44
Source: Apple
First published (updated )
CVE-2026-28868

Apple tvOSUse After Free, Input Validation, Buffer Overflow, Integer Overflow

Risk 37
Severity
6.5
Use After Free, Input Validation, Buffer Overflow, Integer Overflow
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

802.1X. An authentication issue was addressed with improved state management.

1 / 23
Source: Apple
First published (updated )
CVE-2026-20690

Apple tvOSUse After Free, Input Validation, Null Pointer Dereference, Buffer Overflow, Integer Overflow, Infoleak

Risk 40
Severity
6.5
Use After Free, Input Validation, Null Pointer Dereference, Buffer Overflow, Integer Overflow, Infoleak
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

802.1X. An authentication issue was addressed with improved state management.

1 / 30
Source: Apple
First published (updated )
CVE-2026-28878

Apple tvOSUse After Free

Risk 37
Severity
6.5
Use After Free
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

802.1X. An authentication issue was addressed with improved state management.

1 / 14
Source: Apple
First published (updated )
CVE-2026-28879

Apple iOSUse After Free, Input Validation, Null Pointer Dereference, Buffer Overflow, Race Condition, Integer Overflow

Risk 40
Severity
6.5
Use After Free, Input Validation, Null Pointer Dereference, Buffer Overflow, Race Condition, Integer Overflow
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

802.1X. An authentication issue was addressed with improved state management.

1 / 39
Source: Apple
First published (updated )
CVE-2026-28880

Apple iOSUse After Free

Risk 36
Severity
6.2
Use After Free
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

802.1X. An authentication issue was addressed with improved state management.

1 / 9
Source: Apple
First published (updated )
CVE-2026-20637

Apple iPadOSUse After Free, Input Validation, Null Pointer Dereference, Integer Overflow, Race Condition, Buffer Overflow

Risk 37
Severity
6.5
Use After Free, Input Validation, Null Pointer Dereference, Integer Overflow, Race Condition, Buffer Overflow
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

802.1X. An authentication issue was addressed with improved state management.

1 / 88
Source: Apple
First published (updated )
CVE-2026-20657

Apple iOSUse After Free, Input Validation, Buffer Overflow

Risk 36
Severity
6.2
Use After Free, Input Validation, Buffer Overflow
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

802.1X. An authentication issue was addressed with improved state management.

1 / 21
Source: Apple
First published (updated )
CVE-2026-28866

Apple macOS SonomaQUIC certificate check bypass with wolfSSL

Risk 34
Severity
6.3
EPSS
0.04%
Input Validation, Buffer Overflow
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Accounts. The issue was addressed with improved checks.

1 / 13
Source: Apple
First published (updated )
CVE-2024-2379

Apple macOS SonomaTLS certificate check bypass with mbedTLS

Risk 42
Severity
6.5
Input Validation, Buffer Overflow
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Accounts. The issue was addressed with improved checks.

1 / 14
Source: Apple
First published (updated )
CVE-2024-2466

Apple macOS SonomaOpenSSH Terrapin attack (CVE-2023-48795)

Risk 37
Severity
6
Race Condition, Buffer Overflow, Input Validation
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P/RL:O/RC:C

Summary

Terrapin is a prefix truncation attack targeting the SSH protocol. More precisely, Terrapin breaks the integrity of SSH's secure channel. By carefully adjusting the sequence numbers during the handshake, an attacker can remove an arbitrary amount of messages sent by the client or server at the beginning of the secure channel without the client or server noticing it.

Mitigations

To mitigate this protocol vulnerability, OpenSSH suggested a so-called "strict kex" which alters the SSH handshake to ensure a Man-in-the-Middle attacker cannot introduce unauthenticated messages as well as convey sequence number manipulation across handshakes.

Warning: To take effect, both the client and server must support this countermeasure.

As a stop-gap measure, peers may also (temporarily) disable the affected algorithms and use unaffected alternatives like AES-GCM instead until patches are available.

Details

The SSH specifications of ChaCha20-Poly1305 (chacha20-poly1305@openssh.com) and Encrypt-then-MAC (-etm@openssh.com MACs) are vulnerable against an arbitrary prefix truncation attack (a.k.a. Terrapin attack). This allows for an extension negotiation downgrade by stripping the SSHMSGEXTINFO sent after the first message after SSHMSGNEWKEYS, downgrading security, and disabling attack countermeasures in some versions of OpenSSH. When targeting Encrypt-then-MAC, this attack requires the use of a CBC cipher to be practically exploitable due to the internal workings of the cipher mode. Additionally, this novel attack technique can be used to exploit previously unexploitable implementation flaws in a Man-in-the-Middle scenario.

The attack works by an attacker injecting an arbitrary number of SSHMSGIGNORE messages during the initial key exchange and consequently removing the same number of messages just after the initial key exchange has concluded. This is possible due to missing authentication of the excess SSHMSGIGNORE messages and the fact that the implicit sequence numbers used within the SSH protocol are only checked after the initial key exchange.

In the case of ChaCha20-Poly1305, the attack is guaranteed to work on every connection as this cipher does not maintain an internal state other than the message's sequence number. In the case of Encrypt-Then-MAC, practical exploitation requires the use of a CBC cipher; while theoretical integrity is broken for all ciphers when using this mode, message processing will fail at the application layer for CTR and stream ciphers.

For more details see https://terrapin-attack.com.

Impact

This attack targets the specification of ChaCha20-Poly1305 (chacha20-poly1305@openssh.com) and Encrypt-then-MAC (-etm@openssh.com), which are widely adopted by well-known SSH implementations and can be considered de-facto standard. These algorithms can be practically exploited; however, in the case of Encrypt-Then-MAC, we additionally require the use of a CBC cipher. As a consequence, this attack works against all well-behaving SSH implementations supporting either of those algorithms and can be used to downgrade (but not fully strip) connection security in case SSH extension negotiation (RFC8308) is supported. The attack may also enable attackers to exploit certain implementation flaws in a man-in-the-middle (MitM) scenario.

1 / 44
Source: GitHub
First published (updated )
CVE-2023-48795

Apple macOS TahoeUse After Free, Race Condition, Infoleak

Risk 31
Severity
5.5
Use After Free, Race Condition, Infoleak
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1. An app may be able to access sensitive user data.

1 / 29
Source: MITRE
First published (updated )
CVE-2025-43479

Apple macOS TahoeBuffer Overflow, Race Condition, Use After Free, Input Validation, Integer Overflow

Risk 29
Severity
5
Buffer Overflow, Race Condition, Use After Free, Input Validation, Integer Overflow
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H

Accounts Framework. This issue was addressed with improved data protection.

1 / 58
Source: Apple
First published (updated )
CVE-2026-43767

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203