BugRater
Early access: the directory is still filling out, and every rating here is a reported experience.

Security releases

Apple

macOS Tahoe 26.7

149042 Sep 14, 2026 Source: Vendor

Imported by the Apple release catcher from https://support.apple.com/en-us/149042. 154 CVE entries, 12 additional recognitions. Available for: macOS Tahoe. Draft. Review before publishing.

Source of record The credited names below are quoted verbatim from the vendor's own advisory: https://support.apple.com/en-us/149042
Are you credited here? Sign in and claim your line: it is yours immediately, no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.

Credited

315 lines
All 315 CVEs 299 Additional recognition 16 Unclaimed only
Showing 1–50 of 315 · page 1 of 7
CVE-2026-86882 BR2026-0000-013369 Accelerate Framework unclaimed
Processing a maliciously crafted image may lead to unexpected process termination
Credited as Peter Malone
CVE-2026-43664 BR2026-0000-013370 Accessibility unclaimed
An app may be able to access sensitive user data
Credited as Stuart Wallace
CVE-2026-43664 BR2026-0000-013371 Accessibility unclaimed
An app may be able to access sensitive user data
Credited as Rosyna Keller of Totally Not Malicious Software
CVE-2026-43664 BR2026-0000-013372 Accessibility unclaimed
An app may be able to access sensitive user data
Credited as Jian Lee (@speedyfriend433)
CVE-2026-43664 BR2026-0000-013373 Accessibility unclaimed
An app may be able to access sensitive user data
Credited as Ilya Andr (andrd3v)
CVE-2026-43664 BR2026-0000-013374 Accessibility unclaimed
An app may be able to access sensitive user data
Credited as Gongyu Ma (@Mezone0)
CVE-2026-43664 BR2026-0000-013375 Accessibility unclaimed
An app may be able to access sensitive user data
Credited as David Strnadel
CVE-2026-43664 BR2026-0000-013376 Accessibility unclaimed
An app may be able to access sensitive user data
Credited as Daniel Febrero
CVE-2026-43664 BR2026-0000-013377 Accessibility unclaimed
An app may be able to access sensitive user data
Credited as CJ Vana
CVE-2026-43664 BR2026-0000-013378 Accessibility unclaimed
An app may be able to access sensitive user data
Credited as Asaf Cohen
CVE-2026-84523 BR2026-0000-013379 APFS unclaimed
An app may be able to cause unexpected system termination or write kernel memory
Credited as Cem Onat Karagun
CVE-2026-86888 BR2026-0000-013380 App Store unclaimed
A local app may be able to read a persistent account identifier
Credited as Zhongcheng Li (CK01)
CVE-2026-20683 BR2026-0000-013381 Apple Account unclaimed
An app may be able to use the Sign In With Apple authentication flow to access the user's Apple Account
Credited as Lehan Dilusha Jayasingha (Sri Lanka)
CVE-2026-20683 BR2026-0000-013382 Apple Account unclaimed
An app may be able to use the Sign In With Apple authentication flow to access the user's Apple Account
Credited as Jasminder Pal Singh
CVE-2026-20683 BR2026-0000-013383 Apple Account unclaimed
An app may be able to use the Sign In With Apple authentication flow to access the user's Apple Account
Credited as Dem0ns (@天府简易信工作室)
CVE-2026-20683 BR2026-0000-013384 Apple Account unclaimed
An app may be able to use the Sign In With Apple authentication flow to access the user's Apple Account
Credited as Abdelhak Kherroubi
CVE-2026-65408 BR2026-0000-013385 Apple Neural Engine unclaimed
An app may be able to cause unexpected system termination
Credited as tamdao
CVE-2026-65407 BR2026-0000-013386 AppleAVD unclaimed
An app may be able to cause unexpected system termination
Credited as Franco Belman at Blackwing Intelligence
CVE-2026-84519 BR2026-0000-013387 AppleDouble unclaimed
Mounting a disk image with maliciously crafted files may lead to unexpected system termination
Credited as Richard Zana
CVE-2026-65381 BR2026-0000-013388 AppleMobileFileIntegrity unclaimed
A malicious app may be able to break out of its sandbox
Credited as Mickey Jin (@patch1t)
CVE-2026-43763 BR2026-0000-013389 ATS unclaimed
An app may be able to read files outside of its sandbox
Credited as Pavan Nallamothu
CVE-2026-43763 BR2026-0000-013390 ATS unclaimed
An app may be able to read files outside of its sandbox
Credited as Jared Reyes
CVE-2026-84525 BR2026-0000-013391 ATS unclaimed
An app may be able to access user-sensitive data
Credited as D4rthL
CVE-2026-65342 BR2026-0000-013392 ATS unclaimed
An app may be able to access sensitive user data
Credited as Mohamad Dawoud / Abodi Dawoud
CVE-2026-65342 BR2026-0000-013393 ATS unclaimed
An app may be able to access sensitive user data
Credited as Ahmed Alwardani
CVE-2026-84583 BR2026-0000-013394 AuthKit unclaimed
A local app may be able to read a persistent account identifier
Credited as Zhongcheng Li from IES Red Team
CVE-2026-84568 BR2026-0000-013395 autofs unclaimed
An attacker with control of a network directory server may be able to execute arbitrary code with root privileges
Credited as Mr.Gedik (@h4ck2s3c) of Turkish Technology
CVE-2026-84570 BR2026-0000-013396 autofs unclaimed
An app may be able to bypass Gatekeeper checks
Credited as Mr.Gedik (@h4ck2s3c)
CVE-2026-84535 BR2026-0000-013397 Automator unclaimed
An app may be able to break out of its sandbox
Credited as Sindre Sorhus
CVE-2026-84535 BR2026-0000-013398 Automator unclaimed
An app may be able to break out of its sandbox
Credited as Oren Yomtov
CVE-2026-84535 BR2026-0000-013399 Automator unclaimed
An app may be able to break out of its sandbox
Credited as Morris Richman (@morrisinlife)
CVE-2026-84535 BR2026-0000-013400 Automator unclaimed
An app may be able to break out of its sandbox
Credited as Kun Peeks (@SwayZGl1tZyyy)
CVE-2026-65410 BR2026-0000-013401 AVEVideoEncoder unclaimed
An app may be able to cause unexpected system termination
Credited as Calif.io in collaboration with Claude and Anthropic Research
CVE-2026-84616 BR2026-0000-013402 AVEVideoEncoder unclaimed
An app may be able to cause unexpected system termination
Credited as Peter Malone
CVE-2026-84607 BR2026-0000-013403 AVEVideoEncoder unclaimed
A sandboxed app may be able to execute arbitrary code with kernel privileges
Credited as Ruslan Dautov
CVE-2026-65406 BR2026-0000-013404 BackgroundAssets unclaimed
An app may be able to access sensitive user data
Credited as Ye Zhang (@VAR10CK) of Baidu Security
CVE-2026-84567 BR2026-0000-013405 cd9660 unclaimed
An app may be able to cause unexpected system termination
Credited as Sanny Mitra
CVE-2026-84567 BR2026-0000-013406 cd9660 unclaimed
An app may be able to cause unexpected system termination
Credited as Sihyun Roh (Compsec, SNU)
CVE-2026-84567 BR2026-0000-013407 cd9660 unclaimed
An app may be able to cause unexpected system termination
Credited as ngockhanh from Cystack
CVE-2026-84567 BR2026-0000-013408 cd9660 unclaimed
An app may be able to cause unexpected system termination
Credited as 정우 하 (@0xfa11babe)
CVE-2026-84567 BR2026-0000-013409 cd9660 unclaimed
An app may be able to cause unexpected system termination
Credited as Suresh Sundaram
CVE-2026-84567 BR2026-0000-013410 cd9660 unclaimed
An app may be able to cause unexpected system termination
Credited as Surej Sekhar
CVE-2026-84567 BR2026-0000-013411 cd9660 unclaimed
An app may be able to cause unexpected system termination
Credited as Kun Peeks (@SwayZGl1tZyyy)
CVE-2026-84567 BR2026-0000-013412 cd9660 unclaimed
An app may be able to cause unexpected system termination
Credited as Hari Shanmugam (The Hxr1)
CVE-2026-84567 BR2026-0000-013413 cd9660 unclaimed
An app may be able to cause unexpected system termination
Credited as Ataberk Yavuzer
CVE-2026-65399 BR2026-0000-013414 copyfile unclaimed
An archive may be able to bypass Gatekeeper
Credited as Rishabh Jain (rjcyber) of cyberplanet
CVE-2026-65399 BR2026-0000-013415 copyfile unclaimed
An archive may be able to bypass Gatekeeper
Credited as Pasquale Scola
CVE-2026-86891 BR2026-0000-013416 Core Bluetooth unclaimed
An app may be able to access Bluetooth device information
Credited as Dawuge of Shuffle Team
CVE-2026-43683 BR2026-0000-013417 CoreDrag unclaimed
An app may be able to cause unexpected process termination or disclose process memory
Credited as Nathaniel Oh (@calysteon)
CVE-2026-43789 BR2026-0000-013418 CoreMedia unclaimed
An app may be able to access user-sensitive data
Credited as 이재영