Open-Source Security Intelligence

Know every vulnerability
before it knows you.

DevGuard continuously monitors your dependencies and alerts you when CVEs like this one affect your stack — with real-time threat intelligence built for developers.

Search

NCSC-2026-0102

Published Mar 25, 2026·Last modified Mar 25, 2026
Description
Feiten

Apple heeft meerdere kwetsbaarheden verholpen in macOS (Specifiek voor Sequoia 15.7.5, Sonoma 14.8.5, en Tahoe 26.4).

Interpretaties

De kwetsbaarheden omvatten verschillende problemen zoals onvoldoende validatie van invoer, onjuiste afhandeling van geheugen, en problemen met machtigingen die konden leiden tot ongeautoriseerde toegang tot gevoelige gebruikersdata. Aanvallers kunnen deze kwetsbaarheden misbruiken om toegang te krijgen tot beschermde systeembestanden, gegevens te wijzigen, of zelfs de stabiliteit van het systeem in gevaar te brengen. De kwetsbaarheden zijn opgelost door verbeterde validatie- en beveiligingsmechanismen in de betrokken macOS-versies.

Oplossingen

Apple heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.

Kans

medium

Schade

high

CWE-20

Improper Input Validation

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CWE-122

Heap-based Buffer Overflow

CWE-125

Out-of-bounds Read

CWE-150

Improper Neutralization of Escape, Meta, or Control Sequences

CWE-190

Integer Overflow or Wraparound

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CWE-201

Insertion of Sensitive Information Into Sent Data

CWE-265

Privilege Issues

CWE-275

Permission Issues

CWE-284

Improper Access Control

CWE-285

Improper Authorization

CWE-287

Improper Authentication

CWE-288

Authentication Bypass Using an Alternate Path or Channel

CWE-305

Authentication Bypass by Primary Weakness

CWE-346

Origin Validation Error

CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CWE-371

State Issues

CWE-377

Insecure Temporary File

CWE-404

Improper Resource Shutdown or Release

CWE-416

Use After Free

CWE-476

NULL Pointer Dereference

CWE-522

Insufficiently Protected Credentials

CWE-532

Insertion of Sensitive Information into Log File

CWE-601

URL Redirection to Untrusted Site ('Open Redirect')

CWE-918

Server-Side Request Forgery (SSRF)

CWE-942

Permissive Cross-domain Security Policy with Untrusted Domains

Scan your project

Continuously monitor your dependencies and get alerted when vulnerabilities like this one affect your stack.

Checkout DevGuard