Vulnerabilities reported to Apple and assigned a CVE or acknowledged.
| CVE | Component | CVSS | Impact | Platforms |
|---|---|---|---|---|
| CVE-2026-28882 | libxpc | 4.0 | An app may be able to enumerate a user's installed apps and running processes | iOS, iPadOS, macOS, watchOS, tvOS, visionOS |
| CVE-2026-43796 | Game Center | 5.5 | An app may be able to access sensitive user data | iOS, iPadOS, macOS, watchOS, tvOS, visionOS |
| CVE-2026-43792 | Safari | 6.5 | An app may be able to access sensitive user data | macOS, Safari |
| — | Spotlight | — | Acknowledged for assistance (xattr manipulation outside app sandbox on arbitrary files) | macOS |
| CVE-2026-43664 | Accessibility | 5.5 | An app may be able to access sensitive user data | iOS, iPadOS, macOS, watchOS, tvOS |
| CVE-2026-86905 | Authentication Services | 5.5 | An app may be able to delete credentials stored in Keychain | iOS, iPadOS, macOS, visionOS |
| CVE-2026-86878 | Camera | 5.5 | An app may be able to access sensitive user data | iOS, iPadOS |
| CVE-2026-84606 | iCloud | 7.5 | An app may be able to identify a user across reinstalls | iOS, iPadOS, macOS, visionOS |
| CVE-2026-84623 | Power Management | 7.5 | An app may be able to fingerprint the device | iOS, iPadOS |
| CVE-2026-84625 | Sandbox Profiles | 9.1 | An app may be able to fingerprint the user | iOS, iPadOS, macOS, watchOS, visionOS |
| CVE-2026-65345 | Storage | 5.5 | An app may be able to access user-sensitive data | iOS, iPadOS, macOS |
| CVE-2026-86948 | App Store | 8.8 | An app may be able to break out of its sandbox | Xcode |
| CVE-2026-86949 | Xcode | 8.8 | A malicious app may be able to break out of its sandbox | Xcode |
| CVE-2026-86925 | Quick Look | 5.5 | An app may be able to access sensitive user data (all cached thumbnails from device) | iOS, iPadOS, macOS, visionOS |
| CVE-2026-113915 | MediaAnalysis | — | An app may be able to access sensitive user data (any media files including hidden photos) | iOS, iPadOS, macOS, tvOS, watchOS, visionOS |
| CVE-2026-112616 | Screen Time | 5.5 | An app may be able to access sensitive user data (read and delete browser history) | iOS, iPadOS, macOS, visionOS |
| CVE-2026-86989 | MobileGestalt | — | An app may be able to fingerprint the user | iOS, iPadOS |
| — | Sandbox Profiles | — | Acknowledged for assistance (iCloud account identifier leak) | iOS, iPadOS |
| — | Photos Storage | — | Acknowledged for assistance | iOS, iPadOS |
| CVE-2026-43783 | DesktopServices | 7.8 | A malicious app may be able to gain root privileges | macOS |