BugRater
Early access — the directory is still filling out, and every rating here is a reported experience.

Security releases

Apple

macOS Tahoe 26.6

128067 Jul 27, 2026 Source: Vendor

Imported by the Apple release catcher from https://support.apple.com/en-us/128067. 153 CVE entries, 26 additional recognitions. Available for: macOS Tahoe. Draft — review before publishing.

Source of record The credited names below are quoted verbatim from the vendor's own advisory: https://support.apple.com/en-us/128067
Are you credited here? Sign in and claim your line — it is yours immediately, no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.

Credited

376 lines
All 376 CVEs 298 Additional recognition 78 Unclaimed only
Showing 1–50 of 375 matching · page 1 of 8 · clear filters
CVE-2026-43819 BR2026-0000-000863 Accounts unclaimed
An app may be able to access sensitive user data
Credited as Omar Cerrito
CVE-2026-43749 BR2026-0000-000864 Accounts unclaimed
An app may be able to gain root privileges
Credited as Adam Franke
CVE-2026-43749 BR2026-0000-000865 Accounts unclaimed
An app may be able to gain root privileges
Credited as Ashish Kunwar
CVE-2026-43749 BR2026-0000-000866 Accounts unclaimed
An app may be able to gain root privileges
Credited as Trung Nguyen (@everping) of CyStack
CVE-2026-64733 BR2026-0000-000867 Accounts Framework unclaimed
An app may be able to fingerprint the user
Credited as Rosyna Keller of Totally Not Malicious Software (paradisefacade.com)
CVE-2026-64767 BR2026-0000-000868 afpfs unclaimed
A remote attacker may be able to cause unexpected system termination or corrupt kernel memory
Credited as Dave G.
CVE-2026-23918 BR2026-0000-000869 apache unclaimed
A remote attacker may be able to cause a denial-of-service
Credited as Юлия Мерцалова
CVE-2026-64695 BR2026-0000-000870 APFS unclaimed
A remote user may be able to cause unexpected system termination or corrupt kernel memory
Credited as Peter Malone
CVE-2026-43801 BR2026-0000-000871 App Store unclaimed
An app may be able to access sensitive user data
Credited as Rahul Raj
CVE-2026-43781 BR2026-0000-000872 Apple Account unclaimed
An app may be able to access sensitive user data
Credited as Pinak Oza
CVE-2026-64737 BR2026-0000-000873 Apple Account unclaimed
A malicious app may be able to break out of its sandbox
Credited as Robert Mindo
CVE-2026-43748 BR2026-0000-000874 Apple Neural Engine unclaimed
An app may be able to cause unexpected system termination
Credited as tamdao
CVE-2026-43748 BR2026-0000-000875 Apple Neural Engine unclaimed
An app may be able to cause unexpected system termination
Credited as Franco Belman at Blackwing Intelligence
CVE-2026-28928 BR2026-0000-000876 Apple Neural Engine unclaimed
An app may be able to cause unexpected system termination
Credited as Dun
CVE-2026-43776 BR2026-0000-000877 AppleDouble unclaimed
Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution
Credited as Irvin Wang
CVE-2026-43776 BR2026-0000-000878 AppleDouble unclaimed
Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution
Credited as Peter Malone
CVE-2026-43776 BR2026-0000-000879 AppleDouble unclaimed
Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution
Credited as Nicolas Rabrenovic
CVE-2026-43681 BR2026-0000-000880 AppleRAID unclaimed
A local user may be able to read kernel memory
Credited as impost0r (ret2plt)
CVE-2026-43681 BR2026-0000-000881 AppleRAID unclaimed
A local user may be able to read kernel memory
Credited as David Ige - Beryllium Security
CVE-2026-43672 BR2026-0000-000882 Assets unclaimed
A malicious application may be able to bypass Privacy preferences
Credited as 이재영
CVE-2026-43763 BR2026-0000-000883 ATS unclaimed
An app may be able to read files outside of its sandbox
Credited as Pavan Nallamothu
CVE-2026-43763 BR2026-0000-000884 ATS unclaimed
An app may be able to read files outside of its sandbox
Credited as Jared Reyes
CVE-2026-64702 BR2026-0000-000885 Audio unclaimed
An app may be able to break out of its sandbox
Credited as John Lussier
CVE-2026-64725 BR2026-0000-000886 Audio unclaimed
An app may be able to cause a denial-of-service
Credited as Seonung Park
CVE-2026-64725 BR2026-0000-000887 Audio unclaimed
An app may be able to cause a denial-of-service
Credited as ALTV!ST (altvi.st/)
CVE-2026-43730 BR2026-0000-000888 AuthKit unclaimed
An app may be able to fingerprint the user
Credited as David Strnadel
CVE-2026-64747 BR2026-0000-000889 AVEVideoEncoder unclaimed
An app may be able to execute arbitrary code with kernel privileges
Credited as Franco Belman at Blackwing Intelligence
CVE-2026-64762 BR2026-0000-000890 AVEVideoEncoder unclaimed
An app may be able to cause unexpected system termination
Credited as Dun
CVE-2026-64762 BR2026-0000-000891 AVEVideoEncoder unclaimed
An app may be able to cause unexpected system termination
Credited as Franco Belman at Blackwing Intelligence
CVE-2026-64707 BR2026-0000-000892 BackgroundAssets unclaimed
An app may be able to delete files for which it does not have permission
Credited as YingQi Shi (@Mas0nShi) of DBAppSecurity's WeBin lab
CVE-2026-64698 BR2026-0000-000893 cd9660 unclaimed
An app may be able to cause unexpected system termination or read kernel memory
Credited as Richard Zana
CVE-2026-64698 BR2026-0000-000894 cd9660 unclaimed
An app may be able to cause unexpected system termination or read kernel memory
Credited as Nathaniel Oh (@calysteon)
CVE-2026-64698 BR2026-0000-000895 cd9660 unclaimed
An app may be able to cause unexpected system termination or read kernel memory
Credited as Peter Malone
CVE-2026-43813 BR2026-0000-000896 CloudAttestation unclaimed
A maliciously crafted app may be able to bypass code signing enforcement
Credited as Anton Pakhunov
CVE-2026-64746 BR2026-0000-000897 Contacts unclaimed
An app may be able to add contacts without user authorization
Credited as Rodolphe BRUNETTI (@eisw0lf) of Lupus Nova
CVE-2026-64746 BR2026-0000-000898 Contacts unclaimed
An app may be able to add contacts without user authorization
Credited as Daniel Febrero
CVE-2026-64734 BR2026-0000-000899 Contacts unclaimed
Processing a maliciously crafted contact may leak sensitive data
Credited as Daniel Williams
CVE-2026-43797 BR2026-0000-000900 Contacts unclaimed
An app may be able to access information about a user's contacts
Credited as Arni Hardarson (Neonix Security)
CVE-2026-43756 BR2026-0000-000901 Control Center unclaimed
An app may be able to access user-sensitive data
Credited as 이재영
CVE-2026-43693 BR2026-0000-000902 Core Services unclaimed
An app may be able to gain root privileges
Credited as Gergely Kalman (@gergely_kalman)
CVE-2026-43673 BR2026-0000-000903 CoreAudio unclaimed
Processing a maliciously crafted audio file may corrupt process memory
Credited as Anonymous working with TrendAI Zero Day Initiative
CVE-2026-43744 BR2026-0000-000904 CoreAudio unclaimed
Processing an audio stream in a maliciously crafted media file may terminate the process
Credited as Mathis Mansière
CVE-2026-43803 BR2026-0000-000905 CoreAudio unclaimed
A remote attacker may be able to cause unexpected system termination
Credited as Rahul Raj
CVE-2026-43775 BR2026-0000-000906 CoreMedia unclaimed
An app may be able to access sensitive user data
Credited as Csaba Fitzl (@theevilbit) of Iru
CVE-2026-43759 BR2026-0000-000907 CoreMedia unclaimed
An app may be able to access sensitive user data
Credited as 이재영
CVE-2026-43759 BR2026-0000-000908 CoreMedia unclaimed
An app may be able to access sensitive user data
Credited as Rajdip Dey Sarkar
CVE-2026-43759 BR2026-0000-000909 CoreMedia unclaimed
An app may be able to access sensitive user data
Credited as Arni Hardarson (Neonix Security)
CVE-2026-43711 BR2026-0000-000910 CoreMedia unclaimed
Processing a maliciously crafted video file may lead to unexpected app termination
Credited as James Duffy (@0x4A616D657344)
CVE-2026-64710 BR2026-0000-000911 Crash Reporter unclaimed
An app may be able to leak sensitive user information
Credited as Matthew Schneider
CVE-2026-39875 BR2026-0000-000912 CUPS unclaimed
A malicious app may be able to gain root privileges
Credited as Dallas Dubs