macOS Tahoe

CVEs (530)

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2026-20632	Apple Inc. macOS	Med	0.34	5.3	0.00	Mar 25, 2026	A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Tahoe 26.4. An app may be able to access sensitive user data.
CVE-2026-20676	Apple Inc. macOS	Med	0.34	5.3	0.00	Feb 11, 2026	This issue was addressed through improved state management. This issue is fixed in Safari 26.3, iOS 26.3 and iPadOS 26.3, macOS Tahoe 26.3, visionOS 26.3. A website may be able to track users through Safari web extensions.
CVE-2026-20673	Apple Inc. macOS	Med	0.34	5.3	0.00	Feb 11, 2026	A logic issue was addressed with improved checks. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.3. Turning off "Load remote content in messages” may not apply to all mail previews.
CVE-2025-43497	Apple Inc. macOS	Med	0.34	5.2	0.00	Dec 12, 2025	An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Tahoe 26.1. An app may be able to break out of its sandbox.
CVE-2025-43393	Apple Inc. macOS	Med	0.34	5.2	0.00	Dec 12, 2025	A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Tahoe 26.1. An app may be able to break out of its sandbox.
CVE-2025-43481	Apple Inc. macOS	Med	0.34	5.2	0.00	Nov 4, 2025	This issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7.2, macOS Tahoe 26.1. An app may be able to break out of its sandbox.
CVE-2025-43444	Apple Inc. tvOS	Med	0.34	5.3	0.01	Nov 4, 2025	A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. An app may be able to fingerprint the user.
CVE-2025-43332	Apple Inc. macOS	Med	0.34	5.2	0.00	Sep 15, 2025	A file quarantine bypass was addressed with additional checks. This issue is fixed in macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26. An app may be able to break out of its sandbox.
CVE-2025-43308	Apple Inc. macOS	Med	0.34	5.3	0.00	Sep 15, 2025	This issue was addressed with additional entitlement checks. This issue is fixed in macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26. An app may be able to access sensitive user data.
CVE-2026-65339	Apple Inc. tvOS	Med	0.33	5.0	0.00	Aug 17, 2026	A logic issue was addressed with improved checks. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, macOS Sequoia 15.8, macOS Tahoe 26.6.2, tvOS 27, visionOS 27, watchOS 27. An app may be able to leak sensitive user information.
CVE-2026-28888	Apple Inc. macOS	Med	0.33	5.1	0.00	Mar 25, 2026	A race condition was addressed with improved state handling. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. An app may be able to gain root privileges.
CVE-2026-28834	Apple Inc. macOS	Med	0.33	5.1	0.00	Mar 25, 2026	A race condition was addressed with improved state handling. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. An app may be able to cause unexpected system termination.
CVE-2025-43311	Apple Inc. macOS	Med	0.33	5.1	0.00	Sep 15, 2025	This issue was addressed with additional entitlement checks. This issue is fixed in macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26. An app may be able to access protected user data.
CVE-2025-43262	Apple Inc. macOS	Med	0.33	5.1	0.00	Sep 15, 2025	A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26. USB Restricted Mode may not be applied to accessories connected during boot.
CVE-2026-84562	Apple Inc. macOS Tahoe	Med	0.31	4.7	0.00	Sep 14, 2026	A race condition was addressed with additional validation. This issue is fixed in macOS Tahoe 26.6. An app may be able to access protected user data.
CVE-2026-65358	Apple Inc. tvOS	Med	0.31	4.7	0.00	Sep 14, 2026	A race condition was addressed with improved state handling. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to cause unexpected system termination.
CVE-2026-43743	Apple Inc. macOS	Med	0.31	4.7	0.00	Jun 29, 2026	A race condition was addressed with improved state handling. This issue is fixed in iOS 26.5.2 and iPadOS 26.5.2, iOS 26.7 and iPadOS 26.7, macOS Tahoe 26.5.2, macOS Tahoe 26.7, tvOS 26.6, watchOS 26.6. An app may be able to cause unexpected system termination.
CVE-2026-43659	Apple Inc. macOS	Med	0.31	4.7	0.00	May 11, 2026	A race condition was addressed with additional validation. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, visionOS 26.5. An app may be able to access sensitive user data.
CVE-2026-28830	Apple Inc. macOS	Med	0.31	4.7	0.00	May 11, 2026	A race condition was addressed with additional validation. This issue is fixed in macOS Tahoe 26.4. An app may be able to access sensitive user data.
CVE-2025-43541	Apple Inc. macOS	Med	0.31	4.3	0.34	Dec 17, 2025	A type confusion issue was addressed with improved state handling. This issue is fixed in Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, visionOS 26.2. Processing maliciously crafted web content may lead to an unexpected Safari crash.

CVE-2026-20632MedMar 25, 2026
Apple Inc.
macOS
risk 0.34cvss 5.3epss 0.00
A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Tahoe 26.4. An app may be able to access sensitive user data.
CVE-2026-20676MedFeb 11, 2026
Apple Inc.
macOS
risk 0.34cvss 5.3epss 0.00
This issue was addressed through improved state management. This issue is fixed in Safari 26.3, iOS 26.3 and iPadOS 26.3, macOS Tahoe 26.3, visionOS 26.3. A website may be able to track users through Safari web extensions.
CVE-2026-20673MedFeb 11, 2026
Apple Inc.
macOS
risk 0.34cvss 5.3epss 0.00
A logic issue was addressed with improved checks. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.3. Turning off "Load remote content in messages” may not apply to all mail previews.
CVE-2025-43497MedDec 12, 2025
Apple Inc.
macOS
risk 0.34cvss 5.2epss 0.00
An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Tahoe 26.1. An app may be able to break out of its sandbox.
CVE-2025-43393MedDec 12, 2025
Apple Inc.
macOS
risk 0.34cvss 5.2epss 0.00
A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Tahoe 26.1. An app may be able to break out of its sandbox.
CVE-2025-43481MedNov 4, 2025
Apple Inc.
macOS
risk 0.34cvss 5.2epss 0.00
This issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7.2, macOS Tahoe 26.1. An app may be able to break out of its sandbox.
CVE-2025-43444MedNov 4, 2025
Apple Inc.
tvOS
risk 0.34cvss 5.3epss 0.01
A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. An app may be able to fingerprint the user.
CVE-2025-43332MedSep 15, 2025
Apple Inc.
macOS
risk 0.34cvss 5.2epss 0.00
A file quarantine bypass was addressed with additional checks. This issue is fixed in macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26. An app may be able to break out of its sandbox.
CVE-2025-43308MedSep 15, 2025
Apple Inc.
macOS
risk 0.34cvss 5.3epss 0.00
This issue was addressed with additional entitlement checks. This issue is fixed in macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26. An app may be able to access sensitive user data.
CVE-2026-65339MedAug 17, 2026
Apple Inc.
tvOS
risk 0.33cvss 5.0epss 0.00
A logic issue was addressed with improved checks. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, macOS Sequoia 15.8, macOS Tahoe 26.6.2, tvOS 27, visionOS 27, watchOS 27. An app may be able to leak sensitive user information.
CVE-2026-28888MedMar 25, 2026
Apple Inc.
macOS
risk 0.33cvss 5.1epss 0.00
A race condition was addressed with improved state handling. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. An app may be able to gain root privileges.
CVE-2026-28834MedMar 25, 2026
Apple Inc.
macOS
risk 0.33cvss 5.1epss 0.00
A race condition was addressed with improved state handling. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. An app may be able to cause unexpected system termination.
CVE-2025-43311MedSep 15, 2025
Apple Inc.
macOS
risk 0.33cvss 5.1epss 0.00
This issue was addressed with additional entitlement checks. This issue is fixed in macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26. An app may be able to access protected user data.
CVE-2025-43262MedSep 15, 2025
Apple Inc.
macOS
risk 0.33cvss 5.1epss 0.00
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26. USB Restricted Mode may not be applied to accessories connected during boot.
CVE-2026-84562MedSep 14, 2026
Apple Inc.
macOS Tahoe
risk 0.31cvss 4.7epss 0.00
A race condition was addressed with additional validation. This issue is fixed in macOS Tahoe 26.6. An app may be able to access protected user data.
CVE-2026-65358MedSep 14, 2026
Apple Inc.
tvOS
risk 0.31cvss 4.7epss 0.00
A race condition was addressed with improved state handling. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to cause unexpected system termination.
CVE-2026-43743MedJun 29, 2026
Apple Inc.
macOS
risk 0.31cvss 4.7epss 0.00
A race condition was addressed with improved state handling. This issue is fixed in iOS 26.5.2 and iPadOS 26.5.2, iOS 26.7 and iPadOS 26.7, macOS Tahoe 26.5.2, macOS Tahoe 26.7, tvOS 26.6, watchOS 26.6. An app may be able to cause unexpected system termination.
CVE-2026-43659MedMay 11, 2026
Apple Inc.
macOS
risk 0.31cvss 4.7epss 0.00
A race condition was addressed with additional validation. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, visionOS 26.5. An app may be able to access sensitive user data.
CVE-2026-28830MedMay 11, 2026
Apple Inc.
macOS
risk 0.31cvss 4.7epss 0.00
A race condition was addressed with additional validation. This issue is fixed in macOS Tahoe 26.4. An app may be able to access sensitive user data.
CVE-2025-43541MedDec 17, 2025
Apple Inc.
macOS
risk 0.31cvss 4.3epss 0.34
A type confusion issue was addressed with improved state handling. This issue is fixed in Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, visionOS 26.2. Processing maliciously crafted web content may lead to an unexpected Safari crash.

Page 19 of 27