BugRater
Early access: the directory is still filling out, and every rating here is a reported experience.

Security releases

Apple

macOS Tahoe 26.5

127115 May 11, 2026 Source: Vendor

Imported by the Apple release catcher (re-scrape) from https://support.apple.com/en-us/127115. 87 CVE entries, 30 additional recognitions. Draft. Review before publishing.

Source of record The credited names below are quoted verbatim from the vendor's own advisory: https://support.apple.com/en-us/127115
Are you credited here? Sign in and claim your line: it is yours immediately, no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.

Credited

189 lines
All 189 CVEs 136 Additional recognition 53 Unclaimed only
Showing 101–150 of 188 matching · page 3 of 4 · clear filters
CVE-2026-28847 BR2026-0000-009389 WebKit unclaimed
Processing maliciously crafted web content may lead to an unexpected process crash
Credited as Idan Masas
CVE-2026-28847 BR2026-0000-009390 WebKit unclaimed
Processing maliciously crafted web content may lead to an unexpected process crash
Credited as DARKNAVY (@DarkNavyOrg)
CVE-2026-28847 BR2026-0000-009391 WebKit unclaimed
Processing maliciously crafted web content may lead to an unexpected process crash
Credited as Anonymous working with TrendAI Zero Day Initiative
CVE-2026-28847 BR2026-0000-009392 WebKit unclaimed
Processing maliciously crafted web content may lead to an unexpected process crash
Credited as Daniel Rhea
CVE-2026-28904 BR2026-0000-009393 WebKit unclaimed
Processing maliciously crafted web content may lead to an unexpected process crash
Credited as Luka Rački
CVE-2026-28955 BR2026-0000-009394 WebKit unclaimed
Processing maliciously crafted web content may lead to an unexpected process crash
Credited as wac
CVE-2026-28955 BR2026-0000-009395 WebKit unclaimed
Processing maliciously crafted web content may lead to an unexpected process crash
Credited as Kookhwan Lee working with TrendAI Zero Day Initiative
CVE-2026-28903 BR2026-0000-009396 WebKit unclaimed
Processing maliciously crafted web content may lead to an unexpected process crash
Credited as Mateusz Krzywicki (iVerify.io)
CVE-2026-28953 BR2026-0000-009397 WebKit unclaimed
Processing maliciously crafted web content may lead to an unexpected process crash
Credited as Maher Azzouzi
CVE-2026-28902 BR2026-0000-009398 WebKit unclaimed
Processing maliciously crafted web content may lead to an unexpected process crash
Credited as Tristan Madani (@TristanInSec) from Talence Security
CVE-2026-28902 BR2026-0000-009399 WebKit unclaimed
Processing maliciously crafted web content may lead to an unexpected process crash
Credited as Nathaniel Oh (@calysteon)
CVE-2026-28901 BR2026-0000-009400 WebKit unclaimed
Processing maliciously crafted web content may lead to an unexpected process crash
Credited as Aisle offensive security research team (Joshua Rogers, Luigino Camastra, Igor Morgenstern, and Guido Vranken)
CVE-2026-28901 BR2026-0000-009401 WebKit unclaimed
Processing maliciously crafted web content may lead to an unexpected process crash
Credited as Maher Azzouzi
CVE-2026-28901 BR2026-0000-009402 WebKit unclaimed
Processing maliciously crafted web content may lead to an unexpected process crash
Credited as Ngan Nguyen of Calif.io
CVE-2026-28883 BR2026-0000-009403 WebKit unclaimed
Processing maliciously crafted web content may lead to an unexpected process crash
Credited as kwak kiyong / kakaogames
CVE-2026-28958 BR2026-0000-009404 WebKit unclaimed
An app may be able to access sensitive user data
Credited as Cantina
CVE-2026-28917 BR2026-0000-009405 WebKit unclaimed
Processing maliciously crafted web content may lead to an unexpected process crash
Credited as Vitaly Simonovich
CVE-2026-28947 BR2026-0000-009406 WebKit unclaimed
Processing maliciously crafted web content may lead to an unexpected Safari crash
Credited as dr3dd
CVE-2026-28946 BR2026-0000-009407 WebKit unclaimed
Processing maliciously crafted web content may lead to an unexpected Safari crash
Credited as Gia Bui (@yabeow) from Calif.io
CVE-2026-28946 BR2026-0000-009408 WebKit unclaimed
Processing maliciously crafted web content may lead to an unexpected Safari crash
Credited as dr3dd
CVE-2026-28946 BR2026-0000-009409 WebKit unclaimed
Processing maliciously crafted web content may lead to an unexpected Safari crash
Credited as w0wbox
CVE-2026-28942 BR2026-0000-009410 WebKit unclaimed
Processing maliciously crafted web content may lead to an unexpected Safari crash
Credited as Milad Nasr
CVE-2026-28942 BR2026-0000-009411 WebKit unclaimed
Processing maliciously crafted web content may lead to an unexpected Safari crash
Credited as Nicholas Carlini with Claude
CVE-2026-28942 BR2026-0000-009412 WebKit unclaimed
Processing maliciously crafted web content may lead to an unexpected Safari crash
Credited as Anthropic
CVE-2026-28971 BR2026-0000-009413 WebKit unclaimed
A malicious iframe may use another website’s download settings
Credited as Khiem Tran
CVE-2026-43670 BR2026-0000-009414 WebKit unclaimed
Processing maliciously crafted web content may bypass Content Security Policy
Credited as lebr0nli of National Yang Ming Chiao Tung University
CVE-2026-43670 BR2026-0000-009415 WebKit unclaimed
Processing maliciously crafted web content may bypass Content Security Policy
Credited as Security
CVE-2026-43670 BR2026-0000-009416 WebKit unclaimed
Processing maliciously crafted web content may bypass Content Security Policy
Credited as Systems Lab
CVE-2026-28944 BR2026-0000-009417 WebRTC unclaimed
Processing maliciously crafted web content may lead to an unexpected process crash
Credited as Kenneth Hsu of Palo Alto Networks
CVE-2026-28944 BR2026-0000-009418 WebRTC unclaimed
Processing maliciously crafted web content may lead to an unexpected process crash
Credited as Jérôme DJOUDER
CVE-2026-28944 BR2026-0000-009419 WebRTC unclaimed
Processing maliciously crafted web content may lead to an unexpected process crash
Credited as dr3dd
CVE-2026-28819 BR2026-0000-009420 Wi-Fi unclaimed
An app may be able to execute arbitrary code with kernel privileges
Credited as Wang Yu
CVE-2026-28994 BR2026-0000-009421 Wi-Fi unclaimed
An attacker in a privileged network position may be able to perform denial-of-service attack using crafted Wi-Fi packets
Credited as Alex Radocea
CVE-2026-28914 BR2026-0000-009422 zip unclaimed
A maliciously crafted ZIP archive may bypass Gatekeeper checks
Credited as Andreas Jaegersberger
CVE-2026-28914 BR2026-0000-009423 zip unclaimed
A maliciously crafted ZIP archive may bypass Gatekeeper checks
Credited as Ro Achterberg of Nosebeard Labs (nosebeard.co)
CVE-2026-28920 BR2026-0000-009424 zlib unclaimed
Visiting a maliciously crafted website may leak sensitive data
Credited as Brendon Tiszka of Google Project Zero
Additional recognition BR2026-0000-009425 App Intents unclaimed
Credited as Mikael Kinnman
Additional recognition BR2026-0000-009426 App Store unclaimed
Credited as Asaf Cohen
Additional recognition BR2026-0000-009427 App Store unclaimed
Credited as Johan Wahyudi
Additional recognition BR2026-0000-009428 Apple Account unclaimed
Credited as Iván Savransky
Additional recognition BR2026-0000-009429 Apple Account unclaimed
Credited as Kun Peeks (@SwayZGl1tZyyy)
Additional recognition BR2026-0000-009430 Apple Account unclaimed
Credited as YingQi Shi (@Mas0nShi) of DBAppSecurity's WeBin lab
Additional recognition BR2026-0000-009431 Audio unclaimed
Credited as Brian Carpenter
Additional recognition BR2026-0000-009432 bzip2 unclaimed
Credited as Andreas Jaegersberger
Additional recognition BR2026-0000-009433 bzip2 unclaimed
Credited as Ro Achterberg of Nosebeard Labs
Additional recognition BR2026-0000-009434 bzip2 unclaimed
Credited as Feng Xue
Additional recognition BR2026-0000-009435 bzip2 unclaimed
Credited as XGPT of ThreatBook
Additional recognition BR2026-0000-009436 Calendar unclaimed
Credited as hari shanmugam
Additional recognition BR2026-0000-009437 CoreAnimation unclaimed
Credited as Jordan Pittman
Additional recognition BR2026-0000-009438 CoreUI unclaimed
Credited as Mustafa Calap