Apple
iOS 26.5 and iPadOS 26.5
127110 May 11, 2026 Source: Vendor
Imported by the Apple release catcher from https://support.apple.com/en-us/127110. 61 CVE entries, 23 additional recognitions. Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later. Draft. Review before publishing.
Source of record
The credited names below are quoted verbatim from the vendor's own advisory:
https://support.apple.com/en-us/127110
Are you credited here?
Sign in and claim your line: it is yours immediately, no review queue.
The name the vendor printed stays next to your handle for anyone to check against the advisory above,
and any member who thinks a claim is wrong can refute it.
Credited
127 lines
Showing 51–100 of 127 · page 2 of 3
CVE-2026-28846
BR2026-0000-007011
SceneKit
unclaimed
A remote attacker may be able to cause unexpected app termination
Credited as Peter Malone
CVE-2026-28963
BR2026-0000-007012
Screenshots
unclaimed
An attacker with physical access may be able to use Visual Intelligence to access sensitive user data during iPhone Mirroring
Credited as Jorge Welch
CVE-2026-28993
BR2026-0000-007013
Shortcuts
unclaimed
An app may be able to access user-sensitive data
Credited as Doron Assness
CVE-2026-28974
BR2026-0000-007014
Spotlight
unclaimed
An app may be able to cause a denial-of-service
Credited as Andy Koo (@andykoo) of Hexens
CVE-2026-28957
BR2026-0000-007015
Status Bar
unclaimed
An app may be able to capture a user's screen
Credited as Adriatik Raci
CVE-2026-28996
BR2026-0000-007016
Storage
unclaimed
An app may be able to access sensitive user data
Credited as Alex Radocea
CVE-2026-43660
BR2026-0000-007017
WebKit
unclaimed
Processing maliciously crafted web content may prevent Content Security Policy from being enforced
Credited as Cantina
CVE-2026-28907
BR2026-0000-007018
WebKit
unclaimed
Processing maliciously crafted web content may prevent Content Security Policy from being enforced
Credited as Cantina
CVE-2026-28962
BR2026-0000-007019
WebKit
unclaimed
Processing maliciously crafted web content may disclose sensitive user information
Credited as Luke Francis
CVE-2026-28962
BR2026-0000-007020
WebKit
unclaimed
Processing maliciously crafted web content may disclose sensitive user information
Credited as Vaagn Vardanian
CVE-2026-28962
BR2026-0000-007021
WebKit
unclaimed
Processing maliciously crafted web content may disclose sensitive user information
Credited as kwak kiyong / kakaogames
CVE-2026-28962
BR2026-0000-007022
WebKit
unclaimed
Processing maliciously crafted web content may disclose sensitive user information
Credited as Vitaly Simonovich
CVE-2026-28962
BR2026-0000-007023
WebKit
unclaimed
Processing maliciously crafted web content may disclose sensitive user information
Credited as Adel Bouachraoui
CVE-2026-28962
BR2026-0000-007024
WebKit
unclaimed
Processing maliciously crafted web content may disclose sensitive user information
Credited as greenbynox
CVE-2026-43658
BR2026-0000-007025
WebKit
unclaimed
Processing maliciously crafted web content may lead to an unexpected Safari crash
Credited as Do Young Park
CVE-2026-28905
BR2026-0000-007026
WebKit
unclaimed
Processing maliciously crafted web content may lead to an unexpected process crash
Credited as Yuhao Hu
CVE-2026-28905
BR2026-0000-007027
WebKit
unclaimed
Processing maliciously crafted web content may lead to an unexpected process crash
Credited as Yuanming Lai
CVE-2026-28905
BR2026-0000-007028
WebKit
unclaimed
Processing maliciously crafted web content may lead to an unexpected process crash
Credited as Chenggang Wu
CVE-2026-28905
BR2026-0000-007029
WebKit
unclaimed
Processing maliciously crafted web content may lead to an unexpected process crash
Credited as and Zhe Wang
CVE-2026-28847
BR2026-0000-007030
WebKit
unclaimed
Processing maliciously crafted web content may lead to an unexpected process crash
Credited as DARKNAVY (@DarkNavyOrg)
CVE-2026-28847
BR2026-0000-007031
WebKit
unclaimed
Processing maliciously crafted web content may lead to an unexpected process crash
Credited as Anonymous working with TrendAI Zero Day Initiative
CVE-2026-28847
BR2026-0000-007032
WebKit
unclaimed
Processing maliciously crafted web content may lead to an unexpected process crash
Credited as Daniel Rhea
CVE-2026-28904
BR2026-0000-007033
WebKit
unclaimed
Processing maliciously crafted web content may lead to an unexpected process crash
Credited as Luka Rački
CVE-2026-28955
BR2026-0000-007034
WebKit
unclaimed
Processing maliciously crafted web content may lead to an unexpected process crash
Credited as wac
CVE-2026-28955
BR2026-0000-007035
WebKit
unclaimed
Processing maliciously crafted web content may lead to an unexpected process crash
Credited as Kookhwan Lee working with TrendAI Zero Day Initiative
CVE-2026-28903
BR2026-0000-007036
WebKit
unclaimed
Processing maliciously crafted web content may lead to an unexpected process crash
Credited as Mateusz Krzywicki (iVerify.io)
CVE-2026-28953
BR2026-0000-007037
WebKit
unclaimed
Processing maliciously crafted web content may lead to an unexpected process crash
Credited as Maher Azzouzi
CVE-2026-28902
BR2026-0000-007038
WebKit
unclaimed
Processing maliciously crafted web content may lead to an unexpected process crash
Credited as Tristan Madani (@TristanInSec) from Talence Security
CVE-2026-28902
BR2026-0000-007039
WebKit
unclaimed
Processing maliciously crafted web content may lead to an unexpected process crash
Credited as Nathaniel Oh (@calysteon)
CVE-2026-28901
BR2026-0000-007040
WebKit
unclaimed
Processing maliciously crafted web content may lead to an unexpected process crash
Credited as Aisle offensive security research team (Joshua Rogers, Luigino Camastra, Igor Morgenstern, and Guido Vranken)
CVE-2026-28901
BR2026-0000-007041
WebKit
unclaimed
Processing maliciously crafted web content may lead to an unexpected process crash
Credited as Maher Azzouzi
CVE-2026-28901
BR2026-0000-007042
WebKit
unclaimed
Processing maliciously crafted web content may lead to an unexpected process crash
Credited as Ngan Nguyen of Calif.io
CVE-2026-28883
BR2026-0000-007043
WebKit
unclaimed
Processing maliciously crafted web content may lead to an unexpected process crash
Credited as kwak kiyong / kakaogames
CVE-2026-28958
BR2026-0000-007044
WebKit
unclaimed
An app may be able to access sensitive user data
Credited as Cantina
CVE-2026-28917
BR2026-0000-007045
WebKit
unclaimed
Processing maliciously crafted web content may lead to an unexpected process crash
Credited as Vitaly Simonovich
CVE-2026-28947
BR2026-0000-007046
WebKit
unclaimed
Processing maliciously crafted web content may lead to an unexpected Safari crash
Credited as dr3dd
CVE-2026-28942
BR2026-0000-007047
WebKit
unclaimed
Processing maliciously crafted web content may lead to an unexpected Safari crash
Credited as Milad Nasr
CVE-2026-28942
BR2026-0000-007048
WebKit
unclaimed
Processing maliciously crafted web content may lead to an unexpected Safari crash
Credited as Nicholas Carlini with Claude
CVE-2026-28942
BR2026-0000-007049
WebKit
unclaimed
Processing maliciously crafted web content may lead to an unexpected Safari crash
Credited as Anthropic
CVE-2026-28971
BR2026-0000-007050
WebKit
unclaimed
A malicious iframe may use another website’s download settings
Credited as Khiem Tran
CVE-2026-28944
BR2026-0000-007051
WebRTC
unclaimed
Processing maliciously crafted web content may lead to an unexpected process crash
Credited as Kenneth Hsu of Palo Alto Networks
CVE-2026-28944
BR2026-0000-007052
WebRTC
unclaimed
Processing maliciously crafted web content may lead to an unexpected process crash
Credited as Jérôme DJOUDER
CVE-2026-28944
BR2026-0000-007053
WebRTC
unclaimed
Processing maliciously crafted web content may lead to an unexpected process crash
Credited as dr3dd
CVE-2026-28994
BR2026-0000-007054
Wi-Fi
unclaimed
An attacker in a privileged network position may be able to perform denial-of-service attack using crafted Wi-Fi packets
Credited as Alex Radocea
CVE-2026-28965
BR2026-0000-007055
WidgetKit
unclaimed
A user may be able to view restricted content from the lock screen
Credited as Abhay Kailasia (@abhay_kailasia) from Safran Mumbai India
CVE-2026-28920
BR2026-0000-007056
zlib
unclaimed
Visiting a maliciously crafted website may leak sensitive data
Credited as Brendon Tiszka of Google Project Zero
Additional recognition
BR2026-0000-007057
App Intents
unclaimed
Credited as Mikael Kinnman
Additional recognition
BR2026-0000-007058
Apple Account
unclaimed
Credited as Iván Savransky
Additional recognition
BR2026-0000-007059
Apple Account
unclaimed
Credited as YingQi Shi (@Mas0nShi) of DBAppSecurity's WeBin lab
Additional recognition
BR2026-0000-007060
Audio
unclaimed
Credited as Brian Carpenter