September 2026
CVE-2026-21385: Qualcomm graphics memory corruption
Qualcomm Graphics memory corruption affects devices with the specified component, not every Android phone. Match chipset and OEM firmware, obtain the manufacturer's update, and verify the patch level alongside actual component applicability.
CVE-2021-30952: Apple WebKit arbitrary code execution
Malicious web content can trigger a WebKit integer overflow and arbitrary code execution. Install supported Apple OS and Safari updates; the historical 2021 fix releases are minimums for this flaw, not current update targets.
CVE-2023-41974: iPhone and iPad kernel privilege escalation
An application can exploit this iPhone and iPad kernel use-after-free to execute code with kernel privileges. Install the newest supported OS update, checking the separate backport for devices unable to take a current major release.
CVE-2023-43000: Apple WebKit use-after-free memory corruption
Malicious web content can trigger WebKit use-after-free memory corruption. Update the supported Apple OS and Safari branch, and explicitly check legacy devices for the backported fix rather than mistaking historical fixed releases for affected ranges.
CVE-2026-1603: Ivanti Endpoint Manager (EPM) Authentication Bypass Vulnerability
An alternate authentication path in Ivanti Endpoint Manager can expose specific stored credentials without authentication. This is EPM, not EPMM; the fixed build remains unverified, and updating cannot invalidate credentials already disclosed.
CVE-2026-3909: Skia out-of-bounds write exploited through crafted web content
Crafted web content can trigger an out-of-bounds write in Skia. Update Chrome and check other Skia consumers through their own vendors; a fixed desktop browser does not certify Android, Flutter or embedded products as fixed.
CVE-2026-20963: SharePoint unauthenticated deserialization RCE
Microsoft's corrected SharePoint FAQ describes unauthenticated network code execution. Its March revision clarified prerequisites and scoring without changing the January update requirement; apply the applicable farm-wide fix and preserve evidence of possible earlier access.
CVE-2026-20131: Cisco FMC unauthenticated Java deserialization RCE as root
Unauthenticated Java deserialization in Cisco FMC's web management interface can execute code as root. Cisco's SCC SaaS fix does not update independently managed FMC; use the Software Checker and preserve evidence before remediation.
CVE-2025-31277: Apple WebKit memory corruption
Malicious web content can corrupt memory through this Apple WebKit flaw. Update the applicable operating system and Safari, checking Safari separately on the cited Mac branches; the reviewed description does not establish arbitrary code execution.
CVE-2025-43510: Apple shared-memory kernel corruption
Improper locking in the Apple kernel can let a malicious application alter memory shared between processes. Inventory each device's operating-system branch and install the matching update; this is not a separate application-package fix.