Apple
macOS Tahoe 26.5
127115 May 11, 2026 Source: Vendor
Imported by the Apple release catcher (re-scrape) from https://support.apple.com/en-us/127115. 87 CVE entries, 30 additional recognitions. Draft. Review before publishing.
Source of record
The credited names below are quoted verbatim from the vendor's own advisory:
https://support.apple.com/en-us/127115
Are you credited here?
Sign in and claim your line: it is yours immediately, no review queue.
The name the vendor printed stays next to your handle for anyone to check against the advisory above,
and any member who thinks a claim is wrong can refute it.
Credited
189 lines
Showing 1–50 of 189 · page 1 of 4
CVE-2026-28991
BR2026-0000-009289
Accelerate
unclaimed
An app may be able to cause a denial-of-service
Credited as Seiji Sakurai (@HeapSmasher)
CVE-2026-28988
BR2026-0000-009290
Accounts
unclaimed
An app may be able to bypass certain Privacy preferences
Credited as Asaf Cohen
CVE-2026-43667
BR2026-0000-009291
AirDrop
unclaimed
An attacker in a privileged network position may be able to cause a denial-of-service
Credited as Arash Ale Ebrahim from SCy-Phy research group of CISPA Helmholtz Center for Information Security
CVE-2026-28959
BR2026-0000-009292
APFS
unclaimed
An app may be able to cause unexpected system termination
Credited as Dave G.
CVE-2026-28995
BR2026-0000-009293
App Intents
unclaimed
A malicious app may be able to break out of its sandbox
Credited as Vamshi Paili
CVE-2026-28995
BR2026-0000-009294
App Intents
unclaimed
A malicious app may be able to break out of its sandbox
Credited as Tony Gorez (@tonygo_) for Reverse Society
CVE-2026-28956
BR2026-0000-009295
AppleJPEG
unclaimed
Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory
Credited as impost0r (ret2plt)
CVE-2026-28956
BR2026-0000-009296
AppleJPEG
unclaimed
Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory
Credited as Nicholas Soh
CVE-2026-39869
BR2026-0000-009297
Audio
unclaimed
Processing an audio stream in a maliciously crafted media file may terminate the process
Credited as David Ige of Beryllium Security
CVE-2026-28849
BR2026-0000-009298
BOM
unclaimed
A maliciously crafted ZIP archive may bypass Gatekeeper checks
Credited as Andreas Jaegersberger
CVE-2026-28849
BR2026-0000-009299
BOM
unclaimed
A maliciously crafted ZIP archive may bypass Gatekeeper checks
Credited as Ro Achterberg of Nosebeard Labs
CVE-2026-28922
BR2026-0000-009300
CoreMedia
unclaimed
An app may be able to access private information
Credited as Arni Hardarson
CVE-2026-28936
BR2026-0000-009301
CoreServices
unclaimed
Processing a maliciously crafted file may lead to unexpected app termination
Credited as Andreas Jaegersberger
CVE-2026-28936
BR2026-0000-009302
CoreServices
unclaimed
Processing a maliciously crafted file may lead to unexpected app termination
Credited as Ro Achterberg of Nosebeard Labs
CVE-2026-28918
BR2026-0000-009303
CoreSymbolication
unclaimed
Parsing a maliciously crafted file may lead to an unexpected app termination
Credited as Niels Hofmans
CVE-2026-28918
BR2026-0000-009304
CoreSymbolication
unclaimed
Parsing a maliciously crafted file may lead to an unexpected app termination
Credited as Anonymous working with TrendAI Zero Day Initiative
CVE-2026-28915
BR2026-0000-009305
CUPS
unclaimed
An app may be able to gain root privileges
Credited as Andreas Jaegersberger
CVE-2026-28915
BR2026-0000-009306
CUPS
unclaimed
An app may be able to gain root privileges
Credited as Ro Achterberg of Nosebeard Labs
CVE-2026-43659
BR2026-0000-009307
FileProvider
unclaimed
An app may be able to access sensitive user data
Credited as Alex Radocea
CVE-2026-28923
BR2026-0000-009308
GPU Drivers
unclaimed
A malicious app may be able to break out of its sandbox
Credited as Kun Peeks (@SwayZGl1tZyyy)
CVE-2026-28925
BR2026-0000-009309
HFS
unclaimed
An app may be able to cause unexpected system termination or write kernel memory
Credited as Aswin Kumar Gokula Kannan
CVE-2026-28925
BR2026-0000-009310
HFS
unclaimed
An app may be able to cause unexpected system termination or write kernel memory
Credited as Dave G.
CVE-2026-43661
BR2026-0000-009311
ImageIO
unclaimed
Processing a maliciously crafted image may corrupt process memory
Credited as Gandalf4a of PKU-ICODE
CVE-2026-43661
BR2026-0000-009312
ImageIO
unclaimed
Processing a maliciously crafted image may corrupt process memory
Credited as Anton Pakhunov
CVE-2026-43661
BR2026-0000-009313
ImageIO
unclaimed
Processing a maliciously crafted image may corrupt process memory
Credited as and an anonymous researcher
CVE-2026-28977
BR2026-0000-009314
ImageIO
unclaimed
Processing a maliciously crafted file may lead to unexpected app termination
Credited as Suresh Sundaram
CVE-2026-28990
BR2026-0000-009315
ImageIO
unclaimed
Processing a maliciously crafted image may corrupt process memory
Credited as Jiri Ha
CVE-2026-28990
BR2026-0000-009316
ImageIO
unclaimed
Processing a maliciously crafted image may corrupt process memory
Credited as Arni Hardarson
CVE-2026-28978
BR2026-0000-009317
Installer
unclaimed
A malicious app may be able to break out of its sandbox
Credited as wdszzml
CVE-2026-28978
BR2026-0000-009318
Installer
unclaimed
A malicious app may be able to break out of its sandbox
Credited as Atuin Automated Vulnerability Discovery Engine
CVE-2026-28992
BR2026-0000-009319
IOHIDFamily
unclaimed
An attacker may be able to cause unexpected app termination
Credited as Johnny Franks (@0xjohnny)
CVE-2026-28943
BR2026-0000-009320
IOHIDFamily
unclaimed
An app may be able to determine kernel memory layout
Credited as Google Threat Analysis Group
CVE-2026-28969
BR2026-0000-009321
IOKit
unclaimed
An app may be able to cause unexpected system termination
Credited as Mihalis Haatainen
CVE-2026-28969
BR2026-0000-009322
IOKit
unclaimed
An app may be able to cause unexpected system termination
Credited as Ari Hawking
CVE-2026-28969
BR2026-0000-009323
IOKit
unclaimed
An app may be able to cause unexpected system termination
Credited as Ashish Kunwar
CVE-2026-39877
BR2026-0000-009324
IOSkywalkFamily
unclaimed
An app may be able to disclose kernel memory
Credited as Richard Zana
CVE-2026-39877
BR2026-0000-009325
IOSkywalkFamily
unclaimed
An app may be able to disclose kernel memory
Credited as Dhiyanesh Selvaraj (@redroot97)
CVE-2026-43655
BR2026-0000-009326
IOSurfaceAccelerator
unclaimed
An app may be able to cause unexpected system termination or read kernel memory
Credited as Somair Ansar
CVE-2026-43654
BR2026-0000-009327
Kernel
unclaimed
An app may be able to disclose kernel memory
Credited as Vaagn Vardanian
CVE-2026-43654
BR2026-0000-009328
Kernel
unclaimed
An app may be able to disclose kernel memory
Credited as Nathaniel Oh (@calysteon)
CVE-2026-28908
BR2026-0000-009329
Kernel
unclaimed
An app may be able to modify protected parts of the file system
Credited as beist
CVE-2026-28954
BR2026-0000-009330
Kernel
unclaimed
A maliciously crafted disk image may bypass Gatekeeper checks
Credited as Yiğit Can YILMAZ (@yilmazcanyigit)
CVE-2026-28897
BR2026-0000-009331
Kernel
unclaimed
A local user may be able to cause unexpected system termination or read kernel memory
Credited as popku1337
CVE-2026-28897
BR2026-0000-009332
Kernel
unclaimed
A local user may be able to cause unexpected system termination or read kernel memory
Credited as Billy Jheng Bing Jhong
CVE-2026-28897
BR2026-0000-009333
Kernel
unclaimed
A local user may be able to cause unexpected system termination or read kernel memory
Credited as Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.
CVE-2026-28897
BR2026-0000-009334
Kernel
unclaimed
A local user may be able to cause unexpected system termination or read kernel memory
Credited as Robert Tran
CVE-2026-28897
BR2026-0000-009335
Kernel
unclaimed
A local user may be able to cause unexpected system termination or read kernel memory
Credited as Aswin kumar Gokulakannan
CVE-2026-28952
BR2026-0000-009336
Kernel
unclaimed
An app may be able to cause unexpected system termination
Credited as Calif.io in collaboration with Claude and Anthropic Research
CVE-2026-28951
BR2026-0000-009337
Kernel
unclaimed
An app may be able to gain root privileges
Credited as Csaba Fitzl (@theevilbit) of Iru
CVE-2026-28972
BR2026-0000-009338
Kernel
unclaimed
An app may be able to cause unexpected system termination or write kernel memory
Credited as Billy Jheng Bing Jhong