Filtered by vendor Apple
Subscribe
Total
15947 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-50528 | 3 Apple, Linux, Microsoft | 6 Macos, Linux Kernel, .net and 3 more | 2026-10-28 | N/A | 8.2 HIGH |
| Incorrect authorization in .NET allows an unauthorized attacker to bypass a security feature over a network. | |||||
| CVE-2026-50527 | 3 Apple, Linux, Microsoft | 19 Macos, Linux Kernel, .net and 16 more | 2026-10-28 | N/A | 7.5 HIGH |
| Stack-based buffer overflow in .NET Framework allows an unauthorized attacker to deny service over a network. | |||||
| CVE-2026-50526 | 3 Apple, Linux, Microsoft | 6 Macos, Linux Kernel, .net and 3 more | 2026-10-28 | N/A | 7.0 HIGH |
| Improper link resolution before file access ('link following') in .NET allows an authorized attacker to perform tampering locally. | |||||
| CVE-2026-50525 | 3 Apple, Linux, Microsoft | 19 Macos, Linux Kernel, .net and 16 more | 2026-10-28 | N/A | 7.5 HIGH |
| Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network. | |||||
| CVE-2026-50524 | 3 Apple, Linux, Microsoft | 6 Macos, Linux Kernel, .net and 3 more | 2026-10-28 | N/A | 7.5 HIGH |
| Improper validation of specified type of input in .NET Framework allows an unauthorized attacker to deny service over a network. | |||||
| CVE-2026-47303 | 3 Apple, Linux, Microsoft | 6 Macos, Linux Kernel, .net and 3 more | 2026-10-28 | N/A | 8.8 HIGH |
| Authentication bypass by assumed-immutable data in ASP.NET Core allows an authorized attacker to elevate privileges over a network. | |||||
| CVE-2026-47302 | 3 Apple, Linux, Microsoft | 19 Macos, Linux Kernel, .net and 16 more | 2026-10-28 | N/A | 7.5 HIGH |
| Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network. | |||||
| CVE-2026-47300 | 3 Apple, Linux, Microsoft | 6 Macos, Linux Kernel, .net and 3 more | 2026-10-28 | N/A | 8.8 HIGH |
| Incorrect implementation of authentication algorithm in ASP.NET Core allows an authorized attacker to elevate privileges over a network. | |||||
| CVE-2023-43000 | 1 Apple | 4 Ipados, Iphone Os, Macos and 1 more | 2026-10-28 | N/A | 8.8 HIGH |
| A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Ventura 13.5, iOS 16.6 and iPadOS 16.6, Safari 16.6, iOS 15.8.7 and iPadOS 15.8.7. Processing maliciously crafted web content may lead to memory corruption. | |||||
| CVE-2023-22231 | 3 Adobe, Apple, Microsoft | 3 Bridge, Macos, Windows | 2026-10-28 | N/A | 5.5 MEDIUM |
| Adobe Bridge versions 12.0.3 (and earlier) and 13.0.1 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | |||||
| CVE-2026-113943 | 1 Apple | 1 Macos | 2026-10-28 | N/A | 6.5 MEDIUM |
| An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2. Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory. | |||||
| CVE-2026-84496 | 1 Apple | 1 Macos | 2026-10-28 | N/A | 6.5 MEDIUM |
| An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS Tahoe 26.7.2. Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory. | |||||
| CVE-2026-65327 | 1 Apple | 1 Macos | 2026-10-28 | N/A | 8.4 HIGH |
| A logic issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. A local attacker may be able to elevate their privileges. | |||||
| CVE-2026-96521 | 3 Adobe, Apple, Microsoft | 3 Photoshop, Macos, Windows | 2026-10-28 | N/A | 7.8 HIGH |
| Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | |||||
| CVE-2026-86929 | 1 Apple | 1 Macos | 2026-10-28 | N/A | 8.8 HIGH |
| An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. Processing a maliciously crafted file may lead to arbitrary code execution. | |||||
| CVE-2024-46062 | 2 Apple, Conda | 2 Macos, Miniconda3 | 2026-10-27 | N/A | 7.8 HIGH |
| Miniconda3 macOS installers before 23.11.0-1 contain a local privilege escalation vulnerability when installed outside the user's home directory. During installation, world-writable files are created and executed with root privileges. This flaw allows a local low-privileged user to inject arbitrary commands, leading to code execution as the root user. | |||||
| CVE-2026-86950 | 1 Apple | 3 Ipados, Iphone Os, Macos | 2026-10-27 | N/A | 8.8 HIGH |
| An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.11 and iPadOS 18.7.11, iOS 26.7.1 and iPadOS 26.7.1, macOS Sequoia 15.8.1, macOS Tahoe 26.7.1. Processing a maliciously crafted file may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27. | |||||
| CVE-2025-62686 | 2 Apple, Plugin-alliance | 2 Macos, Installation Manager | 2026-10-27 | N/A | 6.2 MEDIUM |
| A local privilege escalation vulnerability exists in the Plugin Alliance InstallationHelper service included with Plugin Alliance Installation Manager v1.4.0 on macOS. Due to the absence of a hardened runtime and a __RESTRICT segment, a local user may exploit the DYLD_INSERT_LIBRARIES environment variable to inject a dynamic library, potentially resulting in code execution with elevated privileges. | |||||
| CVE-2026-28909 | 1 Apple | 1 Container | 2026-10-26 | N/A | 6.5 MEDIUM |
| Users who connect to malicious registries with hostnames matching the bypass patterns will have their registry credentials exposed in plaintext. This issue is fixed in container version 0.12.3. | |||||
| CVE-2026-30867 | 2 Apple, Emqx | 3 Iphone Os, Macos, Cocoamqtt | 2026-10-26 | N/A | 5.7 MEDIUM |
| CocoaMQTT is a MQTT 5.0 client library for iOS and macOS written in Swift. Prior to version 2.2.2, a vulnerability exists in the packet parsing logic of CocoaMQTT that allows an attacker (or a compromised/malicious MQTT broker) to remotely crash the host iOS/macOS/tvOS application. If an attacker publishes the 4-byte malformed payload to a shared topic with the RETAIN flag set to true, the MQTT broker will persist the payload. Any time a vulnerable client connects and subscribes to that topic, the broker will automatically push the malformed packet. The app will instantly crash in the background before the user can even interact with it. This effectively "bricks" the mobile application (a persistent DoS) until the retained message is manually wiped from the broker database. This issue has been patched in version 2.2.2. | |||||