pwned.coffeeUpdated 4 min ago

The menu

Apple

Major outage

1 live incident affecting Apple, 1 critical, 1 not fully patched.

Today's specials

  1. criticalpartial fix Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path @capacitor/android (npm), @capacitor/ios (npm), github.com/ionic-team/capacitor-swift-pm (swift), com.capacitorjs:core (maven) ### Impact Capacitor's WebView navigation guard validated only the **host and scheme** of a target URL, not its **path**. Because the internal HTTP proxy path (`/_capacitor_http_interceptor_`) is served at the application's own origin, a frame navigation to it was always treated as in-app navigation and allowed. Loading that path as a document caused the… fixed in @capacitor/android 6.2.2 +15CVE-2026-1039225 sources

10 spills in 12 months for Apple

Each square is a day. Tap one to see what spilled. Heat = critical 4, high 3, medium 2, low 1, update half.

Past orders

  1. highpatchedexploited Apple Multiple Products Out-of-Bounds Write Vulnerability Apple iOS, macOS, and iPadOS contain an out-of-bounds write vulnerability in CoreGraphics that may lead to arbitrary code execution. Added to CISA KEV on 2026-09-29 (federal deadline 2026-10-13). CVE-2026-869504 sources
  2. highpatchedexploited Apple macOS Improper Authentication Vulnerability Apple macOS contains an improper authentication vulnerability that could allow an attacker on the network to authenticate to Screen Sharing without valid credentials. Added to CISA KEV on 2026-08-18 (federal deadline 2026-08-21). CVE-2026-654004 sources
  3. highpatchedexploited Ray-Project Ray Code Injection Vulnerability Ray-Project Ray contains a code injection vulnerability that could allow remote code execution. Developers using Ray as a development tool may be exposed to this vulnerability exploitable through Firefox and Safari. Added to CISA KEV on 2026-08-17 (federal deadline 2026-08-20). CVE-2025-625933 sources
  4. highpatchedexploited Cisco IOS Cross-Site Request Forgery Vulnerability Cisco IOS 12.4 contains multiple cross-site forgery vulnerabilities that allows remote attackers to execute arbitrary commands via (1) a certain "show privilege" command to the /level/15/exec/- URI, and (2) a certain "alias exec" command to the /level/15/exec/-/configure/http URI. Added to CISA KEV on 2026-07-13 (federal deadline 2026-07-16). CVE-2008-41282 sources
  5. highpatchedexploited Apple Multiple Products Improper Locking Vulnerability Apple watchOS, iOS, iPadOS, macOS, visionOS, and tvOS contain an improper locking vulnerability that could allow a malicious application to cause unexpected changes in memory shared between processes. Can be chained with CVE-2025-43520, CVE-2025-31277. Added to CISA KEV on 2026-03-20 (federal deadline 2026-04-03). CVE-2025-31277CVE-2025-43510+116 sources
  6. highpatchedexploited Apple Multiple products Use-After-Free Vulnerability Apple macOS, iOS, iPadOS, and Safari 16.6 contain a use-after-free vulnerability due to the processing of maliciously crafted web content that may lead to memory corruption. Can be chained with CVE-2021-30952. Added to CISA KEV on 2026-03-05 (federal deadline 2026-03-26). CVE-2021-30952CVE-2023-4300010 sources
  7. highpatchedexploited Apple iOS and iPadOS Use-After-Free Vulnerability Apple iOS and iPadOS contain a use-after-free vulnerability. An app may be able to execute arbitrary code with kernel privileges. Added to CISA KEV on 2026-03-05 (federal deadline 2026-03-26). CVE-2023-419743 sources
  8. highpatchedexploited Apple Multiple Buffer Overflow Vulnerability Apple Multiple Products Apple iOS, macOS, tvOS, watchOS, and visionOS contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow an attacker with memory write the capability to execute arbitrary code. Added to CISA KEV on 2026-02-12 (federal deadline 2026-03-05). CVE-2026-207006 sources
  9. highpatchedexploited Apple Multiple Products Use-After-Free WebKit Vulnerability Apple iOS, iPadOS, macOS, and other Apple products contain a use-after-free vulnerability in WebKit. Processing maliciously crafted web content may lead to memory corruption. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. Added to CISA KEV on 2025-12-15 (federal deadline 2026-01-05). CVE-2025-435296 sources

More in Devices & apps

Follow Apple

RSS: /feed.xml?stack=apple. JSON: /incidents.json?stack=apple. Or add it to your usual for delivery.