CVE-2026-28854
High · 7.5CVSS
7.5
EPSS
0.2%
Published
Oct 20, 2026
CISA due date
—
The record
The issue was addressed with additional app bundle integrity checks. This issue is fixed in macOS Golden Gate 27. A maliciously modified app may not be prevented from launching.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-119186 Forge (also called node-forge) is a native implementation of Transport Layer Security in… CWE-354
- CVE-2026-118782 Forge (also called node-forge) is a native implementation of Transport Layer Security in… CWE-354
- CVE-2026-118776 Forge (also called node-forge) is a native implementation of Transport Layer Security in… CWE-354
- CVE-2026-90720 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024… CWE-354
- CVE-2026-116608 A security vulnerability has been detected in DAMO Academy VideoLLaMA2 up to 1.1. CWE-354
- CVE-2026-65625 The pure-Erlang AES-GCM fallback in jose_jwa_aes derives the number of verified… CWE-354
- CVE-2026-115906 zip is a zip library for Rust that supports reading and writing simple ZIP files. CWE-354
- CVE-2026-89320 `HmacShaCryptor.Hash` never hashed its input. CWE-354