BugRater
Early access: the directory is still filling out, and every rating here is a reported experience.

Security releases

Apple

Safari 26.5

127121 May 13, 2026 Source: Vendor

Imported by the Apple release catcher from https://support.apple.com/en-us/127121. 21 CVE entries, 4 additional recognitions. Available for: macOS Sonoma and macOS Sequoia. Draft. Review before publishing.

Source of record The credited names below are quoted verbatim from the vendor's own advisory: https://support.apple.com/en-us/127121
Are you credited here? Sign in and claim your line: it is yours immediately, no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.

Credited

47 lines
All 47 CVEs 40 Additional recognition 7 Unclaimed only
Showing 1–47 of 47
CVE-2026-43660 BR2026-0000-006914 WebKit unclaimed
Processing maliciously crafted web content may prevent Content Security Policy from being enforced
Credited as Cantina
CVE-2026-28907 BR2026-0000-006915 WebKit unclaimed
Processing maliciously crafted web content may prevent Content Security Policy from being enforced
Credited as Cantina
CVE-2026-28962 BR2026-0000-006916 WebKit unclaimed
Processing maliciously crafted web content may disclose sensitive user information
Credited as Luke Francis
CVE-2026-28962 BR2026-0000-006917 WebKit unclaimed
Processing maliciously crafted web content may disclose sensitive user information
Credited as Vaagn Vardanian
CVE-2026-28962 BR2026-0000-006918 WebKit unclaimed
Processing maliciously crafted web content may disclose sensitive user information
Credited as kwak kiyong / kakaogames
CVE-2026-28962 BR2026-0000-006919 WebKit unclaimed
Processing maliciously crafted web content may disclose sensitive user information
Credited as Vitaly Simonovich
CVE-2026-28962 BR2026-0000-006920 WebKit unclaimed
Processing maliciously crafted web content may disclose sensitive user information
Credited as Adel Bouachraoui
CVE-2026-28962 BR2026-0000-006921 WebKit unclaimed
Processing maliciously crafted web content may disclose sensitive user information
Credited as greenbynox
CVE-2026-43658 BR2026-0000-006922 WebKit unclaimed
Processing maliciously crafted web content may lead to an unexpected Safari crash
Credited as Do Young Park
CVE-2026-28905 BR2026-0000-006923 WebKit unclaimed
Processing maliciously crafted web content may lead to an unexpected process crash
Credited as Yuhao Hu
CVE-2026-28905 BR2026-0000-006924 WebKit unclaimed
Processing maliciously crafted web content may lead to an unexpected process crash
Credited as Yuanming Lai
CVE-2026-28905 BR2026-0000-006925 WebKit unclaimed
Processing maliciously crafted web content may lead to an unexpected process crash
Credited as Chenggang Wu
CVE-2026-28905 BR2026-0000-006926 WebKit unclaimed
Processing maliciously crafted web content may lead to an unexpected process crash
Credited as and Zhe Wang
CVE-2026-28847 BR2026-0000-006927 WebKit unclaimed
Processing maliciously crafted web content may lead to an unexpected process crash
Credited as DARKNAVY (@DarkNavyOrg)
CVE-2026-28847 BR2026-0000-006928 WebKit unclaimed
Processing maliciously crafted web content may lead to an unexpected process crash
Credited as Anonymous working with TrendAI Zero Day Initiative
CVE-2026-28847 BR2026-0000-006929 WebKit unclaimed
Processing maliciously crafted web content may lead to an unexpected process crash
Credited as Daniel Rhea
CVE-2026-28904 BR2026-0000-006930 WebKit unclaimed
Processing maliciously crafted web content may lead to an unexpected process crash
Credited as Luka Rački
CVE-2026-28955 BR2026-0000-006931 WebKit unclaimed
Processing maliciously crafted web content may lead to an unexpected process crash
Credited as wac
CVE-2026-28955 BR2026-0000-006932 WebKit unclaimed
Processing maliciously crafted web content may lead to an unexpected process crash
Credited as Kookhwan Lee working with TrendAI Zero Day Initiative
CVE-2026-28903 BR2026-0000-006933 WebKit unclaimed
Processing maliciously crafted web content may lead to an unexpected process crash
Credited as Mateusz Krzywicki (iVerify.io)
CVE-2026-28953 BR2026-0000-006934 WebKit unclaimed
Processing maliciously crafted web content may lead to an unexpected process crash
Credited as Maher Azzouzi
CVE-2026-28902 BR2026-0000-006935 WebKit unclaimed
Processing maliciously crafted web content may lead to an unexpected process crash
Credited as Tristan Madani (@TristanInSec) from Talence Security
CVE-2026-28902 BR2026-0000-006936 WebKit unclaimed
Processing maliciously crafted web content may lead to an unexpected process crash
Credited as Nathaniel Oh (@calysteon)
CVE-2026-28901 BR2026-0000-006937 WebKit unclaimed
Processing maliciously crafted web content may lead to an unexpected process crash
Credited as Aisle offensive security research team (Joshua Rogers, Luigino Camastra, Igor Morgenstern, and Guido Vranken)
CVE-2026-28901 BR2026-0000-006938 WebKit unclaimed
Processing maliciously crafted web content may lead to an unexpected process crash
Credited as Maher Azzouzi
CVE-2026-28901 BR2026-0000-006939 WebKit unclaimed
Processing maliciously crafted web content may lead to an unexpected process crash
Credited as Ngan Nguyen of Calif.io
CVE-2026-28883 BR2026-0000-006940 WebKit unclaimed
Processing maliciously crafted web content may lead to an unexpected process crash
Credited as kwak kiyong / kakaogames
CVE-2026-28958 BR2026-0000-006941 WebKit unclaimed
An app may be able to access sensitive user data
Credited as Cantina
CVE-2026-28917 BR2026-0000-006942 WebKit unclaimed
Processing maliciously crafted web content may lead to an unexpected process crash
Credited as Vitaly Simonovich
CVE-2026-28947 BR2026-0000-006943 WebKit unclaimed
Processing maliciously crafted web content may lead to an unexpected Safari crash
Credited as dr3dd
CVE-2026-28946 BR2026-0000-006944 WebKit unclaimed
Processing maliciously crafted web content may lead to an unexpected Safari crash
Credited as Gia Bui (@yabeow) from Calif.io
CVE-2026-28946 BR2026-0000-006945 WebKit unclaimed
Processing maliciously crafted web content may lead to an unexpected Safari crash
Credited as dr3dd
CVE-2026-28946 BR2026-0000-006946 WebKit unclaimed
Processing maliciously crafted web content may lead to an unexpected Safari crash
Credited as w0wbox
CVE-2026-28942 BR2026-0000-006947 WebKit unclaimed
Processing maliciously crafted web content may lead to an unexpected Safari crash
Credited as Milad Nasr
CVE-2026-28942 BR2026-0000-006948 WebKit unclaimed
Processing maliciously crafted web content may lead to an unexpected Safari crash
Credited as Nicholas Carlini with Claude
CVE-2026-28942 BR2026-0000-006949 WebKit unclaimed
Processing maliciously crafted web content may lead to an unexpected Safari crash
Credited as Anthropic
CVE-2026-28971 BR2026-0000-006950 WebKit unclaimed
A malicious iframe may use another website’s download settings
Credited as Khiem Tran
CVE-2026-28944 BR2026-0000-006951 WebRTC unclaimed
Processing maliciously crafted web content may lead to an unexpected process crash
Credited as Kenneth Hsu of Palo Alto Networks
CVE-2026-28944 BR2026-0000-006952 WebRTC unclaimed
Processing maliciously crafted web content may lead to an unexpected process crash
Credited as Jérôme DJOUDER
CVE-2026-28944 BR2026-0000-006953 WebRTC unclaimed
Processing maliciously crafted web content may lead to an unexpected process crash
Credited as dr3dd
Additional recognition BR2026-0000-006954 Safari unclaimed
Credited as sean mutuku
Additional recognition BR2026-0000-006955 Safari Push Notifications unclaimed
Credited as Robert Mindo
Additional recognition BR2026-0000-006956 WebKit unclaimed
Credited as Muhammad Zaid Ghifari (Mr.ZheeV)
Additional recognition BR2026-0000-006957 WebKit unclaimed
Credited as Kalimantan Utara
Additional recognition BR2026-0000-006958 WebKit unclaimed
Credited as Qadhafy Muhammad Tera
Additional recognition BR2026-0000-006959 WebKit unclaimed
Credited as Vitaly Simonovich
Additional recognition BR2026-0000-006960 WebRTC unclaimed
Credited as Hyeonji Son (@jir4vv1t) of Demon Team