CVE-2026-65397
Medium · 5.5CVSS
5.5
EPSS
0.2%
Published
Oct 26, 2026
CISA due date
—
The record
An authorization issue was addressed with improved state management. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. An app may be able to access sensitive user data.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-55147 LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application… CWE-862
- CVE-2026-55146 LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application… CWE-862
- CVE-2026-62967 ZTNET is a ZeroTier web UI for private controllers with multiuser and organization… CWE-862
- CVE-2026-62989 Shopper is a Headless e-commerce Admin Panel. CWE-862
- CVE-2026-78403 Stack-based buffer overflow and missing authorization vulnerability in Thales Sentinel… CWE-862
- CVE-2026-62301 MyTube is a self-hosted downloader and player for several video websites. CWE-862
- CVE-2026-119337 RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. CWE-862
- CVE-2026-116245 libpq looks a connection service up in the service file of the operating-system account… CWE-862