Checks
A name on the page is not a finished check
One row per name. Leave the result cell empty until you have an action you could fail.
cisa.gov published this account (2026-09-29): CISA added CVE-2026-86950 to the KEV catalog based on evidence of active exploitation. Apple’s 2026-09-28 advisory describes a CoreGraphics OOB write that may yield ACE and may have been used in a highly targeted attack on iOS before iOS 27. Fixes: iOS/iPadOS 26.7.1; teammate-opened macOS Tahoe 26.7.1 and Sequoia 15.8.1.
This guide uses that public page as the example. This site did not run the test, close the deal, or measure the product.
Write only what the page says
The page's claim is: CISA added CVE-2026-86950 to the KEV catalog based on evidence of active exploitation. Apple’s 2026-09-28 advisory describes a CoreGraphics OOB write that may yield ACE and may have been used in a highly targeted attack on iOS before iOS 27. Fixes: iOS/iPadOS 26.7.1; teammate-opened macOS Tahoe 26.7.1 and Sequoia 15.8.1.
Put the URL under that sentence. If a later recap adds a number or a date, keep the original page as the record.
One row per name. Leave the result cell empty until you have an action you could fail.
Do the site's check on this one page. Fill a line only when the page supports it. Where the page is silent, write Not stated.
A finished note names the page, the date, and the limit of the claim. It does not borrow a result from a different story.
Stop at the untested line
Anything you did not open, install, or count stays untested. Leave that line visible.
Source page: CISA adds Apple CoreGraphics CVE-2026-86950 to KEV.