Apple
iOS 18.7.9 and iPadOS 18.7.9
127111 May 11, 2026 Source: Vendor
Imported by the Apple release catcher from https://support.apple.com/en-us/127111. 47 CVE entries, 5 additional recognitions. Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation. Draft. Review before publishing.
Source of record
The credited names below are quoted verbatim from the vendor's own advisory:
https://support.apple.com/en-us/127111
Are you credited here?
Sign in and claim your line: it is yours immediately, no review queue.
The name the vendor printed stays next to your handle for anyone to check against the advisory above,
and any member who thinks a claim is wrong can refute it.
Credited
76 lines
Showing 51–76 of 76 · page 2 of 2
CVE-2026-28957
BR2026-0000-007235
Status Bar
unclaimed
An app may be able to capture a user's screen
Credited as Adriatik Raci
CVE-2026-28907
BR2026-0000-007236
WebKit
unclaimed
Processing maliciously crafted web content may prevent Content Security Policy from being enforced
Credited as Cantina
CVE-2026-43660
BR2026-0000-007237
WebKit
unclaimed
Processing maliciously crafted web content may prevent Content Security Policy from being enforced
Credited as Cantina
CVE-2026-28847
BR2026-0000-007238
WebKit
unclaimed
Processing maliciously crafted web content may lead to an unexpected process crash
Credited as DARKNAVY (@DarkNavyOrg)
CVE-2026-28847
BR2026-0000-007239
WebKit
unclaimed
Processing maliciously crafted web content may lead to an unexpected process crash
Credited as Daniel Rhea
CVE-2026-28847
BR2026-0000-007240
WebKit
unclaimed
Processing maliciously crafted web content may lead to an unexpected process crash
Credited as Anonymous working with TrendAI Zero Day Initiative
CVE-2026-28904
BR2026-0000-007241
WebKit
unclaimed
Processing maliciously crafted web content may lead to an unexpected process crash
Credited as Luka Rački
CVE-2026-28903
BR2026-0000-007242
WebKit
unclaimed
Processing maliciously crafted web content may lead to an unexpected process crash
Credited as Mateusz Krzywicki (iVerify.io)
CVE-2026-28955
BR2026-0000-007243
WebKit
unclaimed
Processing maliciously crafted web content may lead to an unexpected process crash
Credited as wac
CVE-2026-28955
BR2026-0000-007244
WebKit
unclaimed
Processing maliciously crafted web content may lead to an unexpected process crash
Credited as Kookhwan Lee working with TrendAI Zero Day Initiative
CVE-2026-28953
BR2026-0000-007245
WebKit
unclaimed
Processing maliciously crafted web content may lead to an unexpected process crash
Credited as Maher Azzouzi
CVE-2026-28962
BR2026-0000-007246
WebKit
unclaimed
Processing maliciously crafted web content may disclose sensitive user information
Credited as Vitaly Simonovich
CVE-2026-28962
BR2026-0000-007247
WebKit
unclaimed
Processing maliciously crafted web content may disclose sensitive user information
Credited as Vaagn Vardanian
CVE-2026-28962
BR2026-0000-007248
WebKit
unclaimed
Processing maliciously crafted web content may disclose sensitive user information
Credited as Luke Francis
CVE-2026-28962
BR2026-0000-007249
WebKit
unclaimed
Processing maliciously crafted web content may disclose sensitive user information
Credited as kwak kiyong / kakaogames
CVE-2026-28962
BR2026-0000-007250
WebKit
unclaimed
Processing maliciously crafted web content may disclose sensitive user information
Credited as greenbynox
CVE-2026-28962
BR2026-0000-007251
WebKit
unclaimed
Processing maliciously crafted web content may disclose sensitive user information
Credited as Adel Bouachraoui
CVE-2026-28917
BR2026-0000-007252
WebKit
unclaimed
Processing maliciously crafted web content may lead to an unexpected process crash
Credited as Vitaly Simonovich
CVE-2026-28819
BR2026-0000-007253
Wi-Fi
unclaimed
An app may be able to execute arbitrary code with kernel privileges
Credited as Wang Yu
CVE-2026-28994
BR2026-0000-007254
Wi-Fi
unclaimed
An attacker in a privileged network position may be able to perform denial-of-service attack using crafted Wi-Fi packets
Credited as Alex Radocea
CVE-2026-28920
BR2026-0000-007255
zlib
unclaimed
Visiting a maliciously crafted website may leak sensitive data
Credited as Brendon Tiszka of Google Project Zero
Additional recognition
BR2026-0000-007256
Kernel
unclaimed
Credited as Ryan Hileman via Xint Code (xint.io)
Additional recognition
BR2026-0000-007257
Location
unclaimed
Credited as Kun Peeks (@SwayZGl1tZyyy)
Additional recognition
BR2026-0000-007258
Managed Configuration
unclaimed
Credited as kado
Additional recognition
BR2026-0000-007259
Messages
unclaimed
Credited as Bishal Kafle
Additional recognition
BR2026-0000-007260
Multi-Touch
unclaimed
Credited as Asaf Cohen