Security Notices
CVE-2023-43000: Apple WebKit use-after-free memory corruption
Malicious web content can trigger WebKit use-after-free memory corruption. Update the supported Apple OS and Safari branch, and explicitly check legacy devices for the backported fix rather than mistaking historical fixed releases for affected ranges.
CVE-2023-41974: iPhone and iPad kernel privilege escalation
An application can exploit this iPhone and iPad kernel use-after-free to execute code with kernel privileges. Install the newest supported OS update, checking the separate backport for devices unable to take a current major release.
CVE-2021-30952: Apple WebKit arbitrary code execution
Malicious web content can trigger a WebKit integer overflow and arbitrary code execution. Install supported Apple OS and Safari updates; the historical 2021 fix releases are minimums for this flaw, not current update targets.
CVE-2026-21385: Qualcomm graphics memory corruption
Qualcomm Graphics memory corruption affects devices with the specified component, not every Android phone. Match chipset and OEM firmware, obtain the manufacturer's update, and verify the patch level alongside actual component applicability.
CVE-2026-20127: Cisco Catalyst SD-WAN controller authentication bypass to fabric administration
Cisco's SD-WAN peering bypass can grant a high-privilege non-root account with NETCONF access to alter fabric configuration. Include Controller, Manager and Validator in evidence collection and updates; successful upgrading alone does not establish fabric recovery.
CVE-2022-20775: Cisco SD-WAN authenticated local path traversal to root
Cisco SD-WAN's CLI path-traversal flaw requires authenticated local access and can grant root privileges. Inventory affected control and edge components, excluding IOS XE SD-WAN; historical fix thresholds do not establish protection from newer fabric vulnerabilities.
CVE-2008-0015: Legacy Windows Video ActiveX Control RCE
A crafted page using the Windows Video ActiveX control can execute code with the logged-on user's rights in legacy Internet Explorer. Verify the control's kill-bit protection on affected hosts, while retiring unsupported Windows systems.
CVE-2026-20700: Apple dyld arbitrary code execution in a targeted exploit chain
Apple's dyld flaw can enable code execution when an attacker already has memory-write capability. Install the supported OS update; suspected targets of the reported exploit chain need investigation beyond checking that installation succeeded.
CVE-2024-43468: Configuration Manager unauthenticated SQL injection
Unauthenticated requests can trigger commands on Configuration Manager servers or their databases. Remediation requires the revised in-console package and applicable site procedures, not merely a Windows update or the original package carrying the same KB number.
CVE-2025-43520: Apple kernel memory write or system crash
A malicious application can exploit this Apple kernel buffer overflow to terminate the system or write kernel memory. Match the device's operating-system branch and install its supported security update.