{
  "fix": "Tahoe 26.4",
  "url": "https://patchblox.com/security/fix/macos/tahoe-26.4",
  "summary": "Tahoe 26.4, released March 24, 2026, fixes 83 CVEs in Tahoe. None of them is reported as exploited. Patch Radar priority: Urgent.",
  "platform": "macos",
  "type": "os-version",
  "title": "Tahoe 26.4",
  "released": "2026-03-24T00:00:00Z",
  "priority": "Urgent",
  "priorityTier": 2,
  "priorityReason": "Closes CVE-2026-28827, rated Critical",
  "supported": true,
  "cveCount": 83,
  "exploitedCveCount": 0,
  "kevCveCount": 0,
  "ransomwareCveCount": 0,
  "maxEpss": 0.01526,
  "maxCvss": 9.3,
  "vendorAdvisory": "https://support.apple.com/en-us/126794",
  "appliesTo": [
    {
      "product": "Tahoe",
      "productUrl": "https://patchblox.com/security/product/macos/tahoe",
      "fixedVersion": "26.4",
      "supported": true
    }
  ],
  "cves": [
    {
      "cveId": "CVE-2026-28827",
      "url": "https://patchblox.com/security/cve/CVE-2026-28827",
      "title": "NetFSFramework: An app may be able to break out of its sandbox",
      "component": "NetFSFramework",
      "impact": "An app may be able to break out of its sandbox",
      "priority": "Urgent",
      "severity": "CRITICAL",
      "cvss": 9.3,
      "epss": 0.00289,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-20688",
      "url": "https://patchblox.com/security/cve/CVE-2026-20688",
      "title": "Printing: An app may be able to break out of its sandbox",
      "component": "Printing",
      "impact": "An app may be able to break out of its sandbox",
      "priority": "Urgent",
      "severity": "CRITICAL",
      "cvss": 9.3,
      "epss": 0.00285,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-58098",
      "url": "https://patchblox.com/security/cve/CVE-2025-58098",
      "title": "Apache HTTP Server: Server Side Includes adds query string to #exec cmd=...",
      "component": "apache",
      "impact": "Multiple issues in Apache",
      "priority": "High",
      "severity": "Important",
      "cvss": 8.3,
      "epss": 0.01526,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-59775",
      "url": "https://patchblox.com/security/cve/CVE-2025-59775",
      "title": "Apache HTTP Server: NTLM Leakage on Windows through UNC SSRF",
      "component": "apache",
      "impact": "Multiple issues in Apache",
      "priority": "High",
      "severity": "Important",
      "cvss": 7.5,
      "epss": 0.0088,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-65082",
      "url": "https://patchblox.com/security/cve/CVE-2025-65082",
      "title": "Apache HTTP Server: CGI environment variable override",
      "component": "apache",
      "impact": "Multiple issues in Apache",
      "priority": "High",
      "severity": "Moderate",
      "cvss": 7.5,
      "epss": 0.00865,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-28865",
      "url": "https://patchblox.com/security/cve/CVE-2026-28865",
      "title": "802.1X: An attacker in a privileged network position may be able to intercept network traffic",
      "component": "802.1X",
      "impact": "An attacker in a privileged network position may be able to intercept network traffic",
      "priority": "High",
      "severity": "HIGH",
      "cvss": 7.5,
      "epss": 0.00794,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-20664",
      "url": "https://patchblox.com/security/cve/CVE-2026-20664",
      "title": "WebKit: Processing maliciously crafted web content may lead to an unexpected process crash",
      "component": "WebKit",
      "impact": "Processing maliciously crafted web content may lead to an unexpected process crash",
      "priority": "High",
      "severity": "MEDIUM",
      "cvss": 8.8,
      "epss": 0.00748,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-66200",
      "url": "https://patchblox.com/security/cve/CVE-2025-66200",
      "title": "Apache HTTP Server: mod_userdir\u002Bsuexec bypass via AllowOverride FileInfo",
      "component": "apache",
      "impact": "Multiple issues in Apache",
      "priority": "High",
      "severity": "Moderate",
      "cvss": 7.5,
      "epss": 0.00697,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-28894",
      "url": "https://patchblox.com/security/cve/CVE-2026-28894",
      "title": "Calling Framework: A remote attacker may be able to cause a denial-of-service",
      "component": "Calling Framework",
      "impact": "A remote attacker may be able to cause a denial-of-service",
      "priority": "High",
      "severity": "HIGH",
      "cvss": 7.5,
      "epss": 0.00691,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-28859",
      "url": "https://patchblox.com/security/cve/CVE-2026-28859",
      "title": "WebKit: A malicious website may be able to process restricted web content outside the sandbox",
      "component": "WebKit",
      "impact": "A malicious website may be able to process restricted web content outside the sandbox",
      "priority": "High",
      "severity": "MEDIUM",
      "cvss": 8.8,
      "epss": 0.00661,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-20665",
      "url": "https://patchblox.com/security/cve/CVE-2026-20665",
      "title": "WebKit: Processing maliciously crafted web content may prevent Content Security Policy from being enforced",
      "component": "WebKit",
      "impact": "Processing maliciously crafted web content may prevent Content Security Policy from being enforced",
      "priority": "High",
      "severity": "MEDIUM",
      "cvss": 8.8,
      "epss": 0.00634,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-28876",
      "url": "https://patchblox.com/security/cve/CVE-2026-28876",
      "title": "DeviceLink: An app may be able to access sensitive user data",
      "component": "DeviceLink",
      "impact": "An app may be able to access sensitive user data",
      "priority": "High",
      "severity": "HIGH",
      "cvss": 7.5,
      "epss": 0.00487,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-55753",
      "url": "https://patchblox.com/security/cve/CVE-2025-55753",
      "title": "Apache HTTP Server: mod_md (ACME), unintended retry intervals",
      "component": "apache",
      "impact": "Multiple issues in Apache",
      "priority": "High",
      "severity": "Moderate",
      "cvss": 7.5,
      "epss": 0.00483,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-20701",
      "url": "https://patchblox.com/security/cve/CVE-2026-20701",
      "title": "NetAuth: An app may be able to connect to a network share without user consent",
      "component": "NetAuth",
      "impact": "An app may be able to connect to a network share without user consent",
      "priority": "High",
      "severity": "HIGH",
      "cvss": 7.5,
      "epss": 0.00436,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-28842",
      "url": "https://patchblox.com/security/cve/CVE-2026-28842",
      "title": "IOGraphics: A buffer overflow may result in memory corruption and unexpected app termination",
      "component": "IOGraphics",
      "impact": "A buffer overflow may result in memory corruption and unexpected app termination",
      "priority": "High",
      "severity": "HIGH",
      "cvss": 7.5,
      "epss": 0.00399,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-28860",
      "url": "https://patchblox.com/security/cve/CVE-2026-28860",
      "title": "Security: A local attacker may be able to modify the state of the Keychain",
      "component": "Security",
      "impact": "A local attacker may be able to modify the state of the Keychain",
      "priority": "High",
      "severity": "HIGH",
      "cvss": 7.5,
      "epss": 0.0038,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-28825",
      "url": "https://patchblox.com/security/cve/CVE-2026-28825",
      "title": "SMB: An app may be able to modify protected parts of the file system",
      "component": "SMB",
      "impact": "An app may be able to modify protected parts of the file system",
      "priority": "High",
      "severity": "HIGH",
      "cvss": 7.1,
      "epss": 0.00379,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-20643",
      "url": "https://patchblox.com/security/cve/CVE-2026-20643",
      "title": "WebKit: Processing maliciously crafted web content may bypass Same Origin Policy",
      "component": "WebKit",
      "impact": "Processing maliciously crafted web content may bypass Same Origin Policy",
      "priority": "High",
      "severity": "MEDIUM",
      "cvss": 8.8,
      "epss": 0.00368,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-28837",
      "url": "https://patchblox.com/security/cve/CVE-2026-28837",
      "title": "System Settings: An app may be able to access sensitive user data",
      "component": "System Settings",
      "impact": "An app may be able to access sensitive user data",
      "priority": "High",
      "severity": "HIGH",
      "cvss": 7.5,
      "epss": 0.00354,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-20687",
      "url": "https://patchblox.com/security/cve/CVE-2026-20687",
      "title": "Kernel: An app may be able to cause unexpected system termination or write kernel memory",
      "component": "Kernel",
      "impact": "An app may be able to cause unexpected system termination or write kernel memory",
      "priority": "High",
      "severity": "HIGH",
      "cvss": 7.1,
      "epss": 0.00348,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-20631",
      "url": "https://patchblox.com/security/cve/CVE-2026-20631",
      "title": "PackageKit: A user may be able to elevate privileges",
      "component": "PackageKit",
      "impact": "A user may be able to elevate privileges",
      "priority": "High",
      "severity": "HIGH",
      "cvss": 8.4,
      "epss": 0.00309,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-20691",
      "url": "https://patchblox.com/security/cve/CVE-2026-20691",
      "title": "WebKit Sandboxing: A maliciously crafted webpage may be able to fingerprint the user",
      "component": "WebKit Sandboxing",
      "impact": "A maliciously crafted webpage may be able to fingerprint the user",
      "priority": "High",
      "severity": "MEDIUM",
      "cvss": 8.8,
      "epss": 0.00287,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-28871",
      "url": "https://patchblox.com/security/cve/CVE-2026-28871",
      "title": "WebKit: Visiting a maliciously crafted website may lead to a cross-site scripting attack",
      "component": "WebKit",
      "impact": "Visiting a maliciously crafted website may lead to a cross-site scripting attack",
      "priority": "High",
      "severity": "MEDIUM",
      "cvss": 8.8,
      "epss": 0.00287,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-28821",
      "url": "https://patchblox.com/security/cve/CVE-2026-28821",
      "title": "CoreServices: An app may be able to gain elevated privileges",
      "component": "CoreServices",
      "impact": "An app may be able to gain elevated privileges",
      "priority": "High",
      "severity": "HIGH",
      "cvss": 8.4,
      "epss": 0.00218,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-28832",
      "url": "https://patchblox.com/security/cve/CVE-2026-28832",
      "title": "File System: An app may be able to disclose kernel memory",
      "component": "File System",
      "impact": "An app may be able to disclose kernel memory",
      "priority": "High",
      "severity": "HIGH",
      "cvss": 8.4,
      "epss": 0.00204,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-28896",
      "url": "https://patchblox.com/security/cve/CVE-2026-28896",
      "title": "ppp: An attacker may be able to cause unexpected system termination or read kernel memory",
      "component": "ppp",
      "impact": "An attacker may be able to cause unexpected system termination or read kernel memory",
      "priority": "High",
      "severity": "HIGH",
      "cvss": 7.7,
      "epss": 0.00185,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-28817",
      "url": "https://patchblox.com/security/cve/CVE-2026-28817",
      "title": "Printing: A sandboxed process may be able to circumvent sandbox restrictions",
      "component": "Printing",
      "impact": "A sandboxed process may be able to circumvent sandbox restrictions",
      "priority": "High",
      "severity": "HIGH",
      "cvss": 8.1,
      "epss": 0.00164,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-28891",
      "url": "https://patchblox.com/security/cve/CVE-2026-28891",
      "title": "NetAuth: An app may be able to break out of its sandbox",
      "component": "NetAuth",
      "impact": "An app may be able to break out of its sandbox",
      "priority": "High",
      "severity": "HIGH",
      "cvss": 8.1,
      "epss": 0.0015,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-28840",
      "url": "https://patchblox.com/security/cve/CVE-2026-28840",
      "title": "PackageKit: An app may be able to gain root privileges",
      "component": "PackageKit",
      "impact": "An app may be able to gain root privileges",
      "priority": "High",
      "severity": "HIGH",
      "cvss": 7.8,
      "epss": 0.00139,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-28926",
      "url": "https://patchblox.com/security/cve/CVE-2026-28926",
      "title": "Disk Images: An app may be able to elevate privileges",
      "component": "Disk Images",
      "impact": "An app may be able to elevate privileges",
      "priority": "High",
      "severity": "HIGH",
      "cvss": 7,
      "epss": 0.00122,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-28878",
      "url": "https://patchblox.com/security/cve/CVE-2026-28878",
      "title": "Crash Reporter: An app may be able to enumerate a user\u0027s installed apps",
      "component": "Crash Reporter",
      "impact": "An app may be able to enumerate a user\u0027s installed apps",
      "priority": "Routine",
      "severity": "MEDIUM",
      "cvss": 6.5,
      "epss": 0.00898,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-28862",
      "url": "https://patchblox.com/security/cve/CVE-2026-28862",
      "title": "Phone: An app may be able to access user-sensitive data",
      "component": "Phone",
      "impact": "An app may be able to access user-sensitive data",
      "priority": "Routine",
      "severity": "MEDIUM",
      "cvss": 5.3,
      "epss": 0.00819,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-28880",
      "url": "https://patchblox.com/security/cve/CVE-2026-28880",
      "title": "iCloud: An app may be able to enumerate a user\u0027s installed apps",
      "component": "iCloud",
      "impact": "An app may be able to enumerate a user\u0027s installed apps",
      "priority": "Routine",
      "severity": "MEDIUM",
      "cvss": 6.5,
      "epss": 0.00794,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-20690",
      "url": "https://patchblox.com/security/cve/CVE-2026-20690",
      "title": "CoreMedia: Processing an audio stream in a maliciously crafted media file may terminate the process",
      "component": "CoreMedia",
      "impact": "Processing an audio stream in a maliciously crafted media file may terminate the process",
      "priority": "Routine",
      "severity": "MEDIUM",
      "cvss": 6.5,
      "epss": 0.00752,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-14524",
      "url": "https://patchblox.com/security/cve/CVE-2025-14524",
      "title": "bearer token leak on cross-protocol redirect",
      "component": "curl",
      "impact": "An issue existed in curl which may result in unintentionally sending sensitive information via an incorrect connection",
      "priority": "Routine",
      "severity": "Moderate",
      "cvss": 5.3,
      "epss": 0.0068,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-28886",
      "url": "https://patchblox.com/security/cve/CVE-2026-28886",
      "title": "CoreUtils: A user in a privileged network position may be able to cause a denial-of-service",
      "component": "CoreUtils",
      "impact": "A user in a privileged network position may be able to cause a denial-of-service",
      "priority": "Routine",
      "severity": "MEDIUM",
      "cvss": 5.9,
      "epss": 0.00665,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-20657",
      "url": "https://patchblox.com/security/cve/CVE-2026-20657",
      "title": "Vision: Parsing a maliciously crafted file may lead to an unexpected app termination",
      "component": "Vision",
      "impact": "Parsing a maliciously crafted file may lead to an unexpected app termination",
      "priority": "Routine",
      "severity": "MEDIUM",
      "cvss": 6.5,
      "epss": 0.00562,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-28838",
      "url": "https://patchblox.com/security/cve/CVE-2026-28838",
      "title": "CoreServices: An app may be able to break out of its sandbox",
      "component": "CoreServices",
      "impact": "An app may be able to break out of its sandbox",
      "priority": "Routine",
      "severity": "MEDIUM",
      "cvss": 5.3,
      "epss": 0.0049,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-28835",
      "url": "https://patchblox.com/security/cve/CVE-2026-28835",
      "title": "SMB: Mounting a maliciously crafted SMB network share may lead to system termination",
      "component": "SMB",
      "impact": "Mounting a maliciously crafted SMB network share may lead to system termination",
      "priority": "Routine",
      "severity": "MEDIUM",
      "cvss": 6.5,
      "epss": 0.00468,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-28879",
      "url": "https://patchblox.com/security/cve/CVE-2026-28879",
      "title": "Audio: Processing maliciously crafted web content may lead to an unexpected process crash",
      "component": "Audio",
      "impact": "Processing maliciously crafted web content may lead to an unexpected process crash",
      "priority": "Routine",
      "severity": "MEDIUM",
      "cvss": 6.5,
      "epss": 0.00458,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-20692",
      "url": "https://patchblox.com/security/cve/CVE-2026-20692",
      "title": "Mail: \u0022Hide IP Address\u0022 and \u0022Block All Remote Content\u0022 may not apply to all mail content",
      "component": "Mail",
      "impact": "\u0022Hide IP Address\u0022 and \u0022Block All Remote Content\u0022 may not apply to all mail content",
      "priority": "Routine",
      "severity": "MEDIUM",
      "cvss": 5.3,
      "epss": 0.00441,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-20693",
      "url": "https://patchblox.com/security/cve/CVE-2026-20693",
      "title": "PackageKit: An attacker with root privileges may be able to delete protected system files",
      "component": "PackageKit",
      "impact": "An attacker with root privileges may be able to delete protected system files",
      "priority": "Routine",
      "severity": "MEDIUM",
      "cvss": 4.9,
      "epss": 0.00412,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-20697",
      "url": "https://patchblox.com/security/cve/CVE-2026-20697",
      "title": "Spotlight: An app may be able to access sensitive user data",
      "component": "Spotlight",
      "impact": "An app may be able to access sensitive user data",
      "priority": "Routine",
      "severity": "MEDIUM",
      "cvss": 5.3,
      "epss": 0.00411,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-28818",
      "url": "https://patchblox.com/security/cve/CVE-2026-28818",
      "title": "Spotlight: An app may be able to access sensitive user data",
      "component": "Spotlight",
      "impact": "An app may be able to access sensitive user data",
      "priority": "Routine",
      "severity": "MEDIUM",
      "cvss": 5.3,
      "epss": 0.00411,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-28839",
      "url": "https://patchblox.com/security/cve/CVE-2026-28839",
      "title": "NetAuth: An app may be able to access sensitive user data",
      "component": "NetAuth",
      "impact": "An app may be able to access sensitive user data",
      "priority": "Routine",
      "severity": "MEDIUM",
      "cvss": 5.3,
      "epss": 0.00411,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-28824",
      "url": "https://patchblox.com/security/cve/CVE-2026-28824",
      "title": "AppleMobileFileIntegrity: An app may be able to access sensitive user data",
      "component": "AppleMobileFileIntegrity",
      "impact": "An app may be able to access sensitive user data",
      "priority": "Routine",
      "severity": "MEDIUM",
      "cvss": 5.3,
      "epss": 0.00357,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-28828",
      "url": "https://patchblox.com/security/cve/CVE-2026-28828",
      "title": "TCC: An app may be able to access sensitive user data",
      "component": "TCC",
      "impact": "An app may be able to access sensitive user data",
      "priority": "Routine",
      "severity": "MEDIUM",
      "cvss": 5.3,
      "epss": 0.00357,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-20679",
      "url": "https://patchblox.com/security/cve/CVE-2026-20679",
      "title": "CoreUI: Processing a maliciously crafted file may lead to unexpected app termination",
      "component": "CoreUI",
      "impact": "Processing a maliciously crafted file may lead to unexpected app termination",
      "priority": "Routine",
      "severity": "MEDIUM",
      "cvss": 4.3,
      "epss": 0.00357,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-28844",
      "url": "https://patchblox.com/security/cve/CVE-2026-28844",
      "title": "SystemMigration: An attacker may gain access to protected parts of the file system",
      "component": "SystemMigration",
      "impact": "An attacker may gain access to protected parts of the file system",
      "priority": "Routine",
      "severity": "MEDIUM",
      "cvss": 6.5,
      "epss": 0.00349,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-20698",
      "url": "https://patchblox.com/security/cve/CVE-2026-20698",
      "title": "Kernel: An app may be able to cause unexpected system termination or corrupt kernel memory",
      "component": "Kernel",
      "impact": "An app may be able to cause unexpected system termination or corrupt kernel memory",
      "priority": "Routine",
      "severity": "MEDIUM",
      "cvss": 5.5,
      "epss": 0.00339,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-20695",
      "url": "https://patchblox.com/security/cve/CVE-2026-20695",
      "title": "Kernel: An app may be able to determine kernel memory layout",
      "component": "Kernel",
      "impact": "An app may be able to determine kernel memory layout",
      "priority": "Routine",
      "severity": "MEDIUM",
      "cvss": 6.2,
      "epss": 0.00332,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-28861",
      "url": "https://patchblox.com/security/cve/CVE-2026-28861",
      "title": "WebKit: A malicious website may be able to access script message handlers intended for other origins",
      "component": "WebKit",
      "impact": "A malicious website may be able to access script message handlers intended for other origins",
      "priority": "Routine",
      "severity": "MEDIUM",
      "cvss": 4.3,
      "epss": 0.00322,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-20632",
      "url": "https://patchblox.com/security/cve/CVE-2026-20632",
      "title": "Music: An app may be able to access sensitive user data",
      "component": "Music",
      "impact": "An app may be able to access sensitive user data",
      "priority": "Routine",
      "severity": "MEDIUM",
      "cvss": 5.3,
      "epss": 0.00311,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-28823",
      "url": "https://patchblox.com/security/cve/CVE-2026-28823",
      "title": "Admin Framework: An app with root privileges may be able to delete protected system files",
      "component": "Admin Framework",
      "impact": "An app with root privileges may be able to delete protected system files",
      "priority": "Routine",
      "severity": "MEDIUM",
      "cvss": 4.9,
      "epss": 0.00305,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-28866",
      "url": "https://patchblox.com/security/cve/CVE-2026-28866",
      "title": "Clipboard: An app may be able to access sensitive user data",
      "component": "Clipboard",
      "impact": "An app may be able to access sensitive user data",
      "priority": "Routine",
      "severity": "MEDIUM",
      "cvss": 6.2,
      "epss": 0.00241,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-28867",
      "url": "https://patchblox.com/security/cve/CVE-2026-28867",
      "title": "Kernel: An app may be able to leak sensitive kernel state",
      "component": "Kernel",
      "impact": "An app may be able to leak sensitive kernel state",
      "priority": "Routine",
      "severity": "MEDIUM",
      "cvss": 6.2,
      "epss": 0.00233,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-28816",
      "url": "https://patchblox.com/security/cve/CVE-2026-28816",
      "title": "Notes: An app may be able to delete files for which it does not have permission",
      "component": "Notes",
      "impact": "An app may be able to delete files for which it does not have permission",
      "priority": "Routine",
      "severity": "MEDIUM",
      "cvss": 4,
      "epss": 0.00228,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-28852",
      "url": "https://patchblox.com/security/cve/CVE-2026-28852",
      "title": "UIFoundation: An app may be able to cause a denial-of-service",
      "component": "UIFoundation",
      "impact": "An app may be able to cause a denial-of-service",
      "priority": "Routine",
      "severity": "MEDIUM",
      "cvss": 5.5,
      "epss": 0.00222,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-20633",
      "url": "https://patchblox.com/security/cve/CVE-2026-20633",
      "title": "Archive Utility: An app may be able to access user-sensitive data",
      "component": "Archive Utility",
      "impact": "An app may be able to access user-sensitive data",
      "priority": "Routine",
      "severity": "MEDIUM",
      "cvss": 5.5,
      "epss": 0.00218,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-28820",
      "url": "https://patchblox.com/security/cve/CVE-2026-28820",
      "title": "StorageKit: An app may be able to access sensitive user data",
      "component": "StorageKit",
      "impact": "An app may be able to access sensitive user data",
      "priority": "Routine",
      "severity": "MEDIUM",
      "cvss": 5.5,
      "epss": 0.00217,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-28822",
      "url": "https://patchblox.com/security/cve/CVE-2026-28822",
      "title": "Audio: An attacker may be able to cause unexpected app termination",
      "component": "Audio",
      "impact": "An attacker may be able to cause unexpected app termination",
      "priority": "Routine",
      "severity": "MEDIUM",
      "cvss": 6.2,
      "epss": 0.0021,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-64505",
      "url": "https://patchblox.com/security/cve/CVE-2025-64505",
      "title": "LIBPNG is vulnerable to a heap buffer overflow in \u0060png_do_quantize\u0060 via malformed palette index",
      "component": "ImageIO",
      "impact": "Processing a maliciously crafted file may lead to unexpected app termination",
      "priority": "Routine",
      "severity": "Moderate",
      "cvss": 6.1,
      "epss": 0.00205,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-20694",
      "url": "https://patchblox.com/security/cve/CVE-2026-20694",
      "title": "MigrationKit: An app may be able to access user-sensitive data",
      "component": "MigrationKit",
      "impact": "An app may be able to access user-sensitive data",
      "priority": "Routine",
      "severity": "MEDIUM",
      "cvss": 5.5,
      "epss": 0.00205,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-28882",
      "url": "https://patchblox.com/security/cve/CVE-2026-28882",
      "title": "libxpc: An app may be able to enumerate a user\u0027s installed apps",
      "component": "libxpc",
      "impact": "An app may be able to enumerate a user\u0027s installed apps",
      "priority": "Routine",
      "severity": "MEDIUM",
      "cvss": 4,
      "epss": 0.00199,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-28868",
      "url": "https://patchblox.com/security/cve/CVE-2026-28868",
      "title": "Kernel: An app may be able to disclose kernel memory",
      "component": "Kernel",
      "impact": "An app may be able to disclose kernel memory",
      "priority": "Routine",
      "severity": "MEDIUM",
      "cvss": 5.5,
      "epss": 0.00196,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-20607",
      "url": "https://patchblox.com/security/cve/CVE-2026-20607",
      "title": "libxpc: An app may be able to access protected user data",
      "component": "libxpc",
      "impact": "An app may be able to access protected user data",
      "priority": "Routine",
      "severity": "MEDIUM",
      "cvss": 4,
      "epss": 0.00194,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-28864",
      "url": "https://patchblox.com/security/cve/CVE-2026-28864",
      "title": "Security: A local attacker may gain access to user\u0027s Keychain items",
      "component": "Security",
      "impact": "A local attacker may gain access to user\u0027s Keychain items",
      "priority": "Routine",
      "severity": "LOW",
      "cvss": 3.3,
      "epss": 0.00183,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-28831",
      "url": "https://patchblox.com/security/cve/CVE-2026-28831",
      "title": "Printing: An app may be able to access sensitive user data",
      "component": "Printing",
      "impact": "An app may be able to access sensitive user data",
      "priority": "Routine",
      "severity": "MEDIUM",
      "cvss": 5.5,
      "epss": 0.0018,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-28881",
      "url": "https://patchblox.com/security/cve/CVE-2026-28881",
      "title": "iCloud: An app may be able to access sensitive user data",
      "component": "iCloud",
      "impact": "An app may be able to access sensitive user data",
      "priority": "Routine",
      "severity": "MEDIUM",
      "cvss": 5.3,
      "epss": 0.0018,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-28892",
      "url": "https://patchblox.com/security/cve/CVE-2026-28892",
      "title": "Diagnostics: An app may be able to modify protected parts of the file system",
      "component": "Diagnostics",
      "impact": "An app may be able to modify protected parts of the file system",
      "priority": "Routine",
      "severity": "MEDIUM",
      "cvss": 5.5,
      "epss": 0.00176,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-28826",
      "url": "https://patchblox.com/security/cve/CVE-2026-28826",
      "title": "NSColorPanel: A malicious app may be able to break out of its sandbox",
      "component": "NSColorPanel",
      "impact": "A malicious app may be able to break out of its sandbox",
      "priority": "Routine",
      "severity": "MEDIUM",
      "cvss": 4,
      "epss": 0.00175,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-28829",
      "url": "https://patchblox.com/security/cve/CVE-2026-28829",
      "title": "WebDAV: An app may be able to modify protected parts of the file system",
      "component": "WebDAV",
      "impact": "An app may be able to modify protected parts of the file system",
      "priority": "Routine",
      "severity": "MEDIUM",
      "cvss": 5.5,
      "epss": 0.00173,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-28877",
      "url": "https://patchblox.com/security/cve/CVE-2026-28877",
      "title": "Accounts: An app may be able to access sensitive user data",
      "component": "Accounts",
      "impact": "An app may be able to access sensitive user data",
      "priority": "Routine",
      "severity": "MEDIUM",
      "cvss": 5.5,
      "epss": 0.00173,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-28841",
      "url": "https://patchblox.com/security/cve/CVE-2026-28841",
      "title": "IOGraphics: A buffer overflow may result in memory corruption and unexpected app termination",
      "component": "IOGraphics",
      "impact": "A buffer overflow may result in memory corruption and unexpected app termination",
      "priority": "Routine",
      "severity": "MEDIUM",
      "cvss": 6.2,
      "epss": 0.00169,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-28870",
      "url": "https://patchblox.com/security/cve/CVE-2026-28870",
      "title": "GeoServices: An app may be able to access sensitive user data",
      "component": "GeoServices",
      "impact": "An app may be able to access sensitive user data",
      "priority": "Routine",
      "severity": "MEDIUM",
      "cvss": 5.5,
      "epss": 0.00166,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-28888",
      "url": "https://patchblox.com/security/cve/CVE-2026-28888",
      "title": "CUPS: An app may be able to gain root privileges",
      "component": "CUPS",
      "impact": "An app may be able to gain root privileges",
      "priority": "Routine",
      "severity": "MEDIUM",
      "cvss": 5.1,
      "epss": 0.00153,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-28834",
      "url": "https://patchblox.com/security/cve/CVE-2026-28834",
      "title": "GPU Drivers: An app may be able to cause unexpected system termination",
      "component": "GPU Drivers",
      "impact": "An app may be able to cause unexpected system termination",
      "priority": "Routine",
      "severity": "MEDIUM",
      "cvss": 5.1,
      "epss": 0.00152,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-20699",
      "url": "https://patchblox.com/security/cve/CVE-2026-20699",
      "title": "AppleMobileFileIntegrity: An app may be able to access user-sensitive data",
      "component": "AppleMobileFileIntegrity",
      "impact": "An app may be able to access user-sensitive data",
      "priority": "Routine",
      "severity": "MEDIUM",
      "cvss": 6.2,
      "epss": 0.00142,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-20684",
      "url": "https://patchblox.com/security/cve/CVE-2026-20684",
      "title": "AppleScript: An app may bypass Gatekeeper checks",
      "component": "AppleScript",
      "impact": "An app may bypass Gatekeeper checks",
      "priority": "Routine",
      "severity": "LOW",
      "cvss": 3.3,
      "epss": 0.00135,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-28845",
      "url": "https://patchblox.com/security/cve/CVE-2026-28845",
      "title": "LaunchServices: An app may be able to access protected user data",
      "component": "LaunchServices",
      "impact": "An app may be able to access protected user data",
      "priority": "Routine",
      "severity": "MEDIUM",
      "cvss": 5.5,
      "epss": 0.00129,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-28893",
      "url": "https://patchblox.com/security/cve/CVE-2026-28893",
      "title": "CUPS: A document may be written to a temporary file when using print preview",
      "component": "CUPS",
      "impact": "A document may be written to a temporary file when using print preview",
      "priority": "Routine",
      "severity": "LOW",
      "cvss": 3.3,
      "epss": 0.00124,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-28910",
      "url": "https://patchblox.com/security/cve/CVE-2026-28910",
      "title": "Archive Utility: A malicious app may be able to access arbitrary files",
      "component": "Archive Utility",
      "impact": "A malicious app may be able to access arbitrary files",
      "priority": "Routine",
      "severity": "LOW",
      "cvss": 3.3,
      "epss": 0.00119,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-28830",
      "url": "https://patchblox.com/security/cve/CVE-2026-28830",
      "title": "Security: An app may be able to access sensitive user data",
      "component": "Security",
      "impact": "An app may be able to access sensitive user data",
      "priority": "Routine",
      "severity": "MEDIUM",
      "cvss": 4.7,
      "epss": 0.00085,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    }
  ],
  "dataAsOf": "2026-11-10T07:50:38Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}