What security vulnerabilities does macOS Sierra fix?

Solution 1:

All security fixes in Sierra 10.12.0 compared to the latest El Capitan release 10.11.6 are available here:

About the security content of macOS Sierra 10.12.

As far as I know most or all of the vulnerabilities are still unfixed in El Capitan and Yosemite. Usually a Security Update for the prior two systems is released at the same time as the new system comes out - not this time.

To get an impression of the severity of the vulnerability you can look up the CVE-number in different databases like CVE Details, National Vulnerability Database or Common Vulnerabilities and Exposures.

IMHO the former are more informative for laypersons because they provide a vulnerability scoring (CVSS3/CVSS2) (like a traffic light food labeling system) and vulnerability types. The first one also lists already available MetaSploit modules.

Example: apache_mod_php.so CVE-2016-6290

Explaining each vulnerability in detail is far beyond the scope of an answer here.