Apple

iOS 26.6 and iPadOS 26.6

128066 Jul 27, 2026 Source: Vendor

Imported by the Apple release catcher from https://support.apple.com/en-us/128066. 86 CVE entries, 12 additional recognitions. Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later. Draft — review before publishing.

Source of record The credited names below are quoted verbatim from the vendor's own advisory: https://support.apple.com/en-us/128066

Are you credited here? Sign in and claim your line — it is yours immediately, no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.

Credited

217 lines

Showing 151–200 of 217 · page 4 of 5

CVE-2026-64730 BR2026-0000-000796 WebKit unclaimed

Visiting a website that frames malicious content may lead to UI spoofing

Credited as Kagami Rosylight of Mozilla

CVE-2026-64783 BR2026-0000-000797 WebKit unclaimed

Processing maliciously crafted web content may lead to an unexpected Safari crash

Credited as 杉山壮太

CVE-2026-64783 BR2026-0000-000798 WebKit unclaimed

Processing maliciously crafted web content may lead to an unexpected Safari crash

Credited as lattice

CVE-2026-64783 BR2026-0000-000799 WebKit unclaimed

Processing maliciously crafted web content may lead to an unexpected Safari crash

Credited as Behzad Najjarpour Jabbari (@_G4ru_)

CVE-2026-64783 BR2026-0000-000800 WebKit unclaimed

Processing maliciously crafted web content may lead to an unexpected Safari crash

Credited as Junyeong Lee

CVE-2026-64783 BR2026-0000-000801 WebKit unclaimed

Processing maliciously crafted web content may lead to an unexpected Safari crash

Credited as Mooth.ai

CVE-2026-64783 BR2026-0000-000802 WebKit unclaimed

Processing maliciously crafted web content may lead to an unexpected Safari crash

Credited as OGINOME Tomohito

CVE-2026-64783 BR2026-0000-000803 WebKit unclaimed

Processing maliciously crafted web content may lead to an unexpected Safari crash

Credited as Using GLM From Z.AI

CVE-2026-64783 BR2026-0000-000804 WebKit unclaimed

Processing maliciously crafted web content may lead to an unexpected Safari crash

Credited as Gia Bui (@yabeow) from Calif.io

CVE-2026-64757 BR2026-0000-000805 WebKit unclaimed

Processing maliciously crafted web content may lead to an unexpected Safari crash

Credited as Milad Nasr

CVE-2026-64757 BR2026-0000-000806 WebKit unclaimed

Processing maliciously crafted web content may lead to an unexpected Safari crash

Credited as Nicholas Carlini with Claude

CVE-2026-64757 BR2026-0000-000807 WebKit unclaimed

Processing maliciously crafted web content may lead to an unexpected Safari crash

Credited as Anthropic

CVE-2026-43804 BR2026-0000-000808 WebKit unclaimed

Visiting a website may lead to an app denial-of-service

Credited as Heiko Kiesel of SEEMOO

CVE-2026-43804 BR2026-0000-000809 WebKit unclaimed

Visiting a website may lead to an app denial-of-service

Credited as TU Darmstadt

CVE-2026-43821 BR2026-0000-000810 WebKit unclaimed

An app may be able to read files outside of its sandbox

Credited as Brian Carpenter

CVE-2026-64718 BR2026-0000-000811 WebKit Canvas unclaimed

Processing maliciously crafted web content may lead to an unexpected Safari crash

Credited as OGINOME Tomohito

CVE-2026-64719 BR2026-0000-000812 WebRTC unclaimed

Processing maliciously crafted web content may lead to an unexpected Safari crash

Credited as Shaheen Fazim

CVE-2026-64726 BR2026-0000-000813 Wi-Fi unclaimed

An attacker in physical proximity may be able to corrupt process memory

Credited as Mathis Mansière

CVE-2026-64726 BR2026-0000-000814 Wi-Fi unclaimed

An attacker in physical proximity may be able to corrupt process memory

Credited as Peter Malone

CVE-2026-64755 BR2026-0000-000815 WorkoutKit unclaimed

An app may be able to access sensitive user data

Credited as Stuart Wallace

Additional recognition BR2026-0000-000816 CoreMedia unclaimed

Credited as yaohway

Additional recognition BR2026-0000-000817 Foundation unclaimed

Credited as Nick Cook

Additional recognition BR2026-0000-000818 Foundation unclaimed

Credited as Sentry Flag

Additional recognition BR2026-0000-000819 Heimdal unclaimed

Credited as Surya Narayan Kushwaha

Additional recognition BR2026-0000-000820 IOStorageFamily unclaimed

Credited as Aswin Kumar Gokula Kannan

Additional recognition BR2026-0000-000821 IOStorageFamily unclaimed

Credited as Yatin Taneja

Additional recognition BR2026-0000-000822 Kernel unclaimed

Credited as Billy Jheng Bing Jhong

Additional recognition BR2026-0000-000823 Kernel unclaimed

Credited as Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.

Additional recognition BR2026-0000-000824 Kernel unclaimed

Credited as Chris Betz

Additional recognition BR2026-0000-000825 Kernel unclaimed

Credited as Hiroki Imai (LAC Co., Ltd.)

Additional recognition BR2026-0000-000826 Kernel unclaimed

Credited as James Duffy ( @0x4A616D657344 )

Additional recognition BR2026-0000-000827 Kernel unclaimed

Credited as Tristan Rousseau

Additional recognition BR2026-0000-000828 Kernel unclaimed

Credited as Vladislav Shevchenko (Positive Technologies)

Additional recognition BR2026-0000-000829 Kernel unclaimed

Credited as YingMuo (@YingMuo) of DEVCORE Research Team

Additional recognition BR2026-0000-000830 Printing UIKit unclaimed

Credited as Jacolon Walker ( @call_eax )

Additional recognition BR2026-0000-000831 Safari Downloads unclaimed

Credited as Alfaz Hossain

Additional recognition BR2026-0000-000832 Security unclaimed

Credited as John Lussier

Additional recognition BR2026-0000-000833 Security unclaimed

Credited as Oleh Konko of 1seal (1seal.org)

Additional recognition BR2026-0000-000834 Security unclaimed

Credited as alick

Additional recognition BR2026-0000-000835 Status Bar unclaimed

Credited as Grzegorz Skiba

Additional recognition BR2026-0000-000836 WebKit unclaimed

Credited as Jaya Surya Kommireddy

Additional recognition BR2026-0000-000837 WebKit unclaimed

Credited as Lukas Knittel (@kunte_ctf) of Ruhr-University Bochum

Additional recognition BR2026-0000-000838 WebKit unclaimed

Credited as Nikos Fanourakis of Technical University of Crete

Additional recognition BR2026-0000-000839 WebKit unclaimed

Credited as Sotiris Ioannidis of Technical University of Crete

Additional recognition BR2026-0000-000840 WebKit unclaimed

Credited as Panagiotis Ilia of Cyprus University of Technology

Additional recognition BR2026-0000-000841 WebKit unclaimed

Credited as and Kostas Drakonakis of Technical University of Crete

Additional recognition BR2026-0000-000842 WebKit unclaimed

Credited as Tony Gorez (@tonygo_) for Reverse Society

Additional recognition BR2026-0000-000843 WebKit unclaimed

Credited as Vitaly Simonovich

Additional recognition BR2026-0000-000844 WebKit unclaimed

Credited as Youngjoon Kim of Team-Atlanta

Additional recognition BR2026-0000-000845 WebKit unclaimed

Credited as sslab at Georgia Tech