Apple
Page 19 of 100 — Apple CVEs from a corpus of 15028, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-20601 | Low | 3.3 | 2026-02-11 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26.3. An app may be able to monitor keystrokes without user… |
CVE-2025-46310 | Medium | 6.0 | 2026-02-11 | This issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26. An attacker with… |
CVE-2025-46305 | Medium | 5.7 | 2026-02-11 | The issue was addressed with improved bounds checks. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.2 and iPadOS 26.2, macOS Sequoia 15.7.4, macOS… |
CVE-2025-46304 | Medium | 5.7 | 2026-02-11 | The issue was addressed with improved bounds checks. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.2 and iPadOS 26.2, macOS Sequoia 15.7.4, macOS… |
CVE-2025-46303 | Medium | 5.7 | 2026-02-11 | The issue was addressed with improved bounds checks. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.2 and iPadOS 26.2, macOS Sequoia 15.7.4, macOS… |
CVE-2025-46302 | Medium | 5.7 | 2026-02-11 | The issue was addressed with improved bounds checks. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.2 and iPadOS 26.2, macOS Sequoia 15.7.4, macOS… |
CVE-2025-46301 | Medium | 5.7 | 2026-02-11 | The issue was addressed with improved bounds checks. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.2 and iPadOS 26.2, macOS Sequoia 15.7.4, macOS… |
CVE-2025-46300 | Medium | 5.7 | 2026-02-11 | The issue was addressed with improved bounds checks. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.2 and iPadOS 26.2, macOS Sequoia 15.7.4, macOS… |
CVE-2025-46290 | High | 7.5 | 2026-02-11 | A logic issue was addressed with improved checks. This issue is fixed in iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Sequoia 15.7.4, macOS So… |
CVE-2025-43537 | Medium | 5.5 | 2026-02-11 | A path handling issue was addressed with improved validation. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.2 and iPadOS 26.2. Restoring a malici… |
CVE-2025-43417 | Medium | 5.5 | 2026-02-11 | A path handling issue was addressed with improved logic. This issue is fixed in macOS Sonoma 14.8.4, macOS Tahoe 26.2. An app may be able to access user-sensit… |
CVE-2025-43403 | Medium | 5.5 | 2026-02-11 | An authorization issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26. An app m… |
CVE-2026-2323 | Medium | 4.3 | 2026-02-11 | Inappropriate implementation in Downloads in Google Chrome prior to 145.0.7632.45 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Ch… |
CVE-2026-2322 | Medium | 5.4 | 2026-02-11 | Inappropriate implementation in File input in Google Chrome prior to 145.0.7632.45 allowed a remote attacker who convinced a user to engage in specific UI gest… |
CVE-2026-2321 | High | 8.8 | 2026-02-11 | Use after free in Ozone in Google Chrome prior to 145.0.7632.45 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially… |
CVE-2026-2320 | Medium | 6.5 | 2026-02-11 | Inappropriate implementation in File input in Google Chrome prior to 145.0.7632.45 allowed a remote attacker who convinced a user to engage in specific UI gest… |
CVE-2026-2319 | High | 7.5 | 2026-02-11 | Race in DevTools in Google Chrome prior to 145.0.7632.45 allowed a remote attacker who convinced a user to engage in specific UI gestures and install a malicio… |
CVE-2026-2318 | Medium | 6.5 | 2026-02-11 | Inappropriate implementation in PictureInPicture in Google Chrome prior to 145.0.7632.45 allowed a remote attacker who convinced a user to engage in specific U… |
CVE-2026-2317 | Medium | 6.5 | 2026-02-11 | Inappropriate implementation in Animation in Google Chrome prior to 145.0.7632.45 allowed a remote attacker to leak cross-origin data via a crafted HTML page… |
CVE-2026-2316 | Medium | 6.5 | 2026-02-11 | Insufficient policy enforcement in Frames in Google Chrome prior to 145.0.7632.45 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Ch… |
CVE-2026-2315 | High | 8.8 | 2026-02-11 | Inappropriate implementation in WebGPU in Google Chrome prior to 145.0.7632.45 allowed a remote attacker to potentially perform out of bounds memory access via… |
CVE-2026-2314 | High | 8.8 | 2026-02-11 | Heap buffer overflow in Codecs in Google Chrome prior to 145.0.7632.45 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page… |
CVE-2026-2313 | High | 8.8 | 2026-02-11 | Use after free in CSS in Google Chrome prior to 145.0.7632.45 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromi… |
CVE-2026-21347 | High | 7.8 | 2026-02-10 | Bridge versions 15.1.3, 16.0.1 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the… |
CVE-2026-21346 | High | 7.8 | 2026-02-10 | Bridge versions 15.1.3, 16.0.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of… |
CVE-2026-21345 | High | 7.8 | 2026-02-10 | Substance3D - Stager versions 3.1.6 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read p… |
CVE-2026-21344 | High | 7.8 | 2026-02-10 | Substance3D - Stager versions 3.1.6 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read p… |
CVE-2026-21343 | High | 7.8 | 2026-02-10 | Substance3D - Stager versions 3.1.6 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read p… |
CVE-2026-21342 | High | 7.8 | 2026-02-10 | Substance3D - Stager versions 3.1.6 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the conte… |
CVE-2026-21341 | High | 7.8 | 2026-02-10 | Substance3D - Stager versions 3.1.6 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the conte… |
CVE-2026-21358 | Medium | 5.5 | 2026-02-10 | InDesign Desktop versions 21.1, 20.5.1 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in application denial-of-servic… |
CVE-2026-21357 | High | 7.8 | 2026-02-10 | InDesign Desktop versions 21.1, 20.5.1 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in… |
CVE-2026-21351 | High | 7.8 | 2026-02-10 | After Effects versions 25.6 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the curr… |
CVE-2026-21350 | Medium | 5.5 | 2026-02-10 | After Effects versions 25.6 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to application denial-of-service. An attacker… |
CVE-2026-21332 | Medium | 5.5 | 2026-02-10 | InDesign Desktop versions 21.1, 20.5.1 and earlier are affected by an out-of-bounds read vulnerability that could lead to memory exposure. An attacker could le… |
CVE-2026-21330 | High | 7.8 | 2026-02-10 | After Effects versions 25.6 and earlier are affected by an Access of Resource Using Incompatible Type ('Type Confusion') vulnerability that could result in arb… |
CVE-2026-21329 | High | 7.8 | 2026-02-10 | After Effects versions 25.6 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the curr… |
CVE-2026-21328 | High | 7.8 | 2026-02-10 | After Effects versions 25.6 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of th… |
CVE-2026-21327 | High | 7.8 | 2026-02-10 | After Effects versions 25.6 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of th… |
CVE-2026-21326 | High | 7.8 | 2026-02-10 | After Effects versions 25.6 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the curr… |
CVE-2026-21325 | High | 7.8 | 2026-02-10 | After Effects versions 25.6 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the… |
CVE-2026-21324 | High | 7.8 | 2026-02-10 | After Effects versions 25.6 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the… |
CVE-2026-21323 | High | 7.8 | 2026-02-10 | After Effects versions 25.6 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the curr… |
CVE-2026-21322 | High | 7.8 | 2026-02-10 | After Effects versions 25.6 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the… |
CVE-2026-21321 | High | 7.8 | 2026-02-10 | After Effects versions 25.6 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the co… |
CVE-2026-21320 | High | 7.8 | 2026-02-10 | After Effects versions 25.6 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the curr… |
CVE-2026-21319 | Medium | 5.5 | 2026-02-10 | After Effects versions 25.6 and earlier are affected by an Out-of-bounds Read vulnerability that could lead to memory exposure. An attacker could leverage this… |
CVE-2026-21318 | High | 7.8 | 2026-02-10 | After Effects versions 25.6 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of th… |
CVE-2026-21218 | High | 7.5 | 2026-02-10 | Improper handling of missing special element in .NET allows an unauthorized attacker to perform spoofing over a network. |
CVE-2026-25157 | High | 7.7 | 2026-02-04 | OpenClaw is a personal AI assistant. Prior to version 2026.1.29, there is an OS command injection vulnerability via the Project Root Path in sshNodeCommand. Th… |
CVE-2026-1862 | High | 8.8 | 2026-02-03 | Type Confusion in V8 in Google Chrome prior to 144.0.7559.132 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromi… |
CVE-2026-1861 | High | 8.8 | 2026-02-03 | Heap buffer overflow in libvpx in Google Chrome prior to 144.0.7559.132 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML pag… |
CVE-2026-24070 | High | 8.8 | 2026-02-02 | During the installation of the Native Access application, a privileged helper `com.native-instruments.NativeAccess.Helper2`, which is used by Native Access to… |
CVE-2026-24687 | Medium | 6.5 | 2026-01-29 | Umbraco Forms is a form builder that integrates with the Umbraco content management system. It's possible for an authenticated backoffice-user to enumerate and… |
CVE-2025-46316 | Medium | 4.3 | 2026-01-28 | An out-of-bounds read was addressed with improved input validation. This issue is fixed in Pages 15.1, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1. Processing a… |
CVE-2025-46306 | Medium | 5.5 | 2026-01-28 | The issue was addressed with improved bounds checks. This issue is fixed in Keynote 15.1, iOS 26 and iPadOS 26, macOS Tahoe 26. Processing a maliciously crafte… |
CVE-2026-20613 | High | 7.8 | 2026-01-23 | The ArchiveReader.extractContents() function used by cctl image load and container image load performs no pathname validation before extracting an archive memb… |
CVE-2026-0908 | High | 8.8 | 2026-01-20 | Use after free in ANGLE in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chro… |
CVE-2026-0907 | Critical | 9.8 | 2026-01-20 | Incorrect security UI in Split View in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium… |
CVE-2026-0906 | Critical | 9.8 | 2026-01-20 | Incorrect security UI in Google Chrome on Android prior to 144.0.7559.59 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafte… |
CVE-2026-0905 | Critical | 9.8 | 2026-01-20 | Insufficient policy enforcement in Network in Google Chrome prior to 144.0.7559.59 allowed an attack who obtained a network log file to potentially obtain pote… |
CVE-2026-0904 | Medium | 5.4 | 2026-01-20 | Incorrect security UI in Digital Credentials in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to perform domain spoofing via a crafted HTML pa… |
CVE-2026-0903 | Medium | 5.4 | 2026-01-20 | Inappropriate implementation in Downloads in Google Chrome on Windows prior to 144.0.7559.59 allowed a remote attacker to bypass dangerous file type protection… |
CVE-2026-0902 | High | 8.8 | 2026-01-20 | Inappropriate implementation in V8 in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML… |
CVE-2026-0901 | Medium | 5.4 | 2026-01-20 | Inappropriate implementation in Blink in Google Chrome on Android prior to 144.0.7559.59 allowed a remote attacker to perform UI spoofing via a crafted HTML pa… |
CVE-2026-0900 | High | 8.8 | 2026-01-20 | Inappropriate implementation in V8 in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to potentially exploit object corruption via a crafted HTM… |
CVE-2026-0899 | High | 8.8 | 2026-01-20 | Out of bounds memory access in V8 in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to potentially exploit object corruption via a crafted HTML… |
CVE-2025-43508 | Medium | 5.5 | 2026-01-16 | A logging issue was addressed with improved data redaction. This issue is fixed in macOS Tahoe 26.1. An app may be able to access sensitive user data. |
CVE-2025-31186 | Low | 3.3 | 2026-01-16 | A permissions issue was addressed with additional restrictions. This issue is fixed in Xcode 16.3. An app may be able to bypass Privacy preferences. |
CVE-2025-24090 | Low | 3.3 | 2026-01-16 | A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 18.3 and iPadOS 18.3. An app may be able to enumerate a user's insta… |
CVE-2025-24089 | Medium | 5.3 | 2026-01-16 | A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 18.3 and iPadOS 18.3. An app may be able to enumerate a user's insta… |
CVE-2024-54556 | Low | 2.4 | 2026-01-16 | This issue was addressed through improved state management. This issue is fixed in iOS 18.1 and iPadOS 18.1. A user may be able to view restricted content from… |
CVE-2024-44238 | High | 7.8 | 2026-01-16 | The issue was addressed with improved bounds checks. This issue is fixed in iOS 18.1 and iPadOS 18.1, macOS Sequoia 15.1. An app may be able to corrupt coproce… |
CVE-2024-44210 | Low | 3.3 | 2026-01-16 | This issue was addressed with improved permissions checking. This issue is fixed in macOS Sequoia 15.1. An app may be able to access user-sensitive data. |
CVE-2022-50891 | Medium | 5.0 | 2026-01-13 | Owlfiles File Manager 12.0.1 contains a cross-site scripting vulnerability that allows attackers to inject malicious scripts through the path parameter in HTTP… |
CVE-2022-50890 | High | 7.5 | 2026-01-13 | Owlfiles File Manager 12.0.1 contains a path traversal vulnerability in its built-in HTTP server that allows attackers to access system directories. Attackers… |
CVE-2026-21287 | High | 7.8 | 2026-01-13 | Substance3D - Stager versions 3.1.5 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of… |
CVE-2026-21304 | High | 7.8 | 2026-01-13 | InDesign Desktop versions 21.0, 19.5.5 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in… |
CVE-2026-21288 | Medium | 5.5 | 2026-01-13 | Illustrator versions 29.8.3, 30.0 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to application denial-of-service. An att… |
CVE-2026-21283 | High | 7.8 | 2026-01-13 | Bridge versions 15.1.2, 16.0 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the contex… |
CVE-2026-21281 | High | 7.8 | 2026-01-13 | InCopy versions 21.0, 19.5.5 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the contex… |
CVE-2026-21280 | High | 8.6 | 2026-01-13 | Illustrator versions 29.8.3, 30.0 and earlier are affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the conte… |
CVE-2026-21278 | Medium | 5.5 | 2026-01-13 | InDesign Desktop versions 21.0, 19.5.5 and earlier are affected by an Out-of-bounds Read vulnerability that could lead to memory exposure. An attacker could le… |
CVE-2026-21277 | High | 7.8 | 2026-01-13 | InDesign Desktop versions 21.0, 19.5.5 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in… |
CVE-2026-21276 | High | 7.8 | 2026-01-13 | InDesign Desktop versions 21.0, 19.5.5 and earlier are affected by an Access of Uninitialized Pointer vulnerability that could result in arbitrary code executi… |
CVE-2026-21275 | High | 7.8 | 2026-01-13 | InDesign Desktop versions 21.0, 19.5.5 and earlier are affected by an Access of Uninitialized Pointer vulnerability that could result in arbitrary code executi… |
CVE-2026-21274 | High | 7.8 | 2026-01-13 | Dreamweaver Desktop versions 21.6 and earlier are affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the con… |
CVE-2026-21272 | High | 8.6 | 2026-01-13 | Dreamweaver Desktop versions 21.6 and earlier are affected by an Improper Input Validation vulnerability that could lead to arbitrary file system write. An att… |
CVE-2026-21271 | High | 8.6 | 2026-01-13 | Dreamweaver Desktop versions 21.6 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the c… |
CVE-2026-21268 | High | 8.6 | 2026-01-13 | Dreamweaver Desktop versions 21.6 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the c… |
CVE-2026-21267 | High | 8.6 | 2026-01-13 | Dreamweaver Desktop versions 21.6 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vul… |
CVE-2025-46299 | Medium | 4.3 | 2026-01-09 | A memory initialization issue was addressed with improved memory handling. This issue is fixed in Safari 26.2, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, tvOS… |
CVE-2025-46298 | Medium | 6.5 | 2026-01-09 | The issue was addressed with improved memory handling. This issue is fixed in Safari 26.2, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, tvOS 26.2, visionOS 26.2… |
CVE-2025-46297 | Medium | 5.5 | 2026-01-09 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26.2. An app may be able to access protected files within an… |
CVE-2025-46286 | Medium | 4.3 | 2026-01-09 | A logic issue was addressed with improved validation. This issue is fixed in iOS 26.2 and iPadOS 26.2. Restoring from a backup may prevent passcode from being… |
CVE-2025-66723 | High | 7.5 | 2025-12-30 | inMusic Brands Engine DJ before 4.3.4 suffers from Insecure Permissions due to exposed HTTP service in the Remote Library, which allows attackers to access all… |
CVE-2025-66499 | High | 7.8 | 2025-12-19 | A heap-based buffer overflow vulnerability exists in the PDF parsing of Foxit PDF Reader when processing specially crafted JBIG2 data. An integer overflow in t… |
CVE-2025-66497 | Medium | 5.3 | 2025-12-19 | A memory corruption vulnerability exists in the 3D annotation handling of Foxit PDF Reader due to insufficient bounds checking when parsing PRC data. When open… |
CVE-2025-66495 | High | 7.8 | 2025-12-19 | A use-after-free vulnerability exists in the annotation handling of Foxit PDF Reader before 2025.2.1, 14.0.1, and 13.2.1 on Windows and MacOS. When opening a P… |
CVE-2025-64724 | High | 7.3 | 2025-12-18 | Arduino IDE is an integrated development environment. Prior to version 2.3.7, Arduino IDE for macOS is installed with world-writable file permissions on sensit… |