CVE-2025-43192

A configuration issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7. Account-driven User Enrollment may still be possible with Lockdown Mode turned on...

CVE-2025-43184

This issue was addressed by adding an additional prompt for user consent. This issue is fixed in macOS Sonoma 14.7.7, macOS Ventura 13.7.7, macOS Sequoia 15.4. A shortcut may be able to bypass sensitive Shortcuts app settings...

PT-2025-31338 · Apple · Apple Macos

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 15.6 Description: A privacy issue was addressed by removing the vulnerable code. A sandboxed process may be able to circumvent sandbox restrictions. Recommendations: Update to macOS version 15.6...

PT-2025-31334 · Apple · Apple Macos

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 15.6 macOS versions prior to 14.7.7 macOS versions prior to 13.7.7 Description: A permissions issue was addressed with additional restrictions. An app may be able to break out of its sandbox. Recommendations: Update to...

Mozilla Firefox < 141.0

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 141.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2025-56 advisory. - Memory safety bugs present in Firefox 140 and Thunderbird 140. Some of these bugs showed evidence of memory...

CVE-2025-51497

An issue was discovered in AdGuard plugin before 1.11.22 for Safari on MacOS. AdGaurd verbosely logged each url that Safari accessed when the plugin was active. These logs went into the MacOS general logs for any unsandboxed process to read. This may be disabled in version 1.11.22...

Google Chrome < 138.0.7204.157 Multiple Vulnerabilities

The version of Google Chrome installed on the remote macOS host is prior to 138.0.7204.157. It is, therefore, affected by multiple vulnerabilities as referenced in the 202507stable-channel-update-for-desktop15 advisory. - Use after free in WebRTC in Google Chrome prior to 138.0.7204.157 allowed a...

PT-2025-29286

Name of the Vulnerable Software and Affected Versions: Multipass versions up to and including 1.15.1 Description: Incorrect default permissions in Canonical Multipass on macOS allow a local attacker to escalate privileges by modifying files executed with administrative privileges by a Launch Daem...

CVE-2025-0141

CVE-2025-0141 corresponds to an incorrect privilege assignment in Palo Alto Networks GlobalProtect App. The vulnerability allows a locally authenticated, non-administrative user to escalate to root on macOS/Linux or to NT AUTHORITY\SYSTEM on Windows. Affected platforms exclude GlobalProtect on iO...

PT-2025-28968 · Palo Alto Networks · Palo Alto Networks Autonomous Digital Experience Manager

Name of the Vulnerable Software and Affected Versions: Palo Alto Networks Autonomous Digital Experience Manager affected versions not specified Description: An incorrect privilege assignment exists in Palo Alto Networks Autonomous Digital Experience Manager. A locally authenticated low-privileged...

Adobe InDesign < 19.5.4 / 20.0 < 20.4.0 Multiple Arbitrary code execution (APSB25-60) (macOS)

The version of Adobe InDesign installed on the remote macOS host is prior to 19.5.4, 20.4.0. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB25-60 advisory. - InDesign Desktop versions 19.5.3 and earlier are affected by an Integer Underflow Wrap or Wraparound...

CVE-2025-34089

An unauthenticated remote code execution vulnerability exists in Remote for Mac, a macOS remote control utility developed by Aexol Studio, in versions up to and including 2025.7. When the application is configured with authentication disabled i.e., the "Allow unknown devices" option is enabled, t...

CVE-2025-34089 Remote for Mac Unauthenticated Remote Code Execution via AppleScript Injection

An unauthenticated remote code execution vulnerability exists in Remote for Mac, a macOS remote control utility developed by Aexol Studio, in versions up to and including 2025.7. When the application is configured with authentication disabled i.e., the "Allow unknown devices" option is enabled, t...

Mozilla Thunderbird < 128.12

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 128.12. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2025-55 advisory. - The executable file warning did not warn users before opening files with the terminal extension. This b...

Mozilla Thunderbird < 140.0

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 140.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2025-54 advisory. - Memory safety bugs present in Firefox 139 and Thunderbird 139. Some of these bugs showed evidence of...

CVE-2025-6426

The executable file warning did not warn users before opening files with the terminal extension. This bug only affects Firefox for macOS. Other versions of Firefox are unaffected.. This vulnerability was fixed in Firefox 140, Firefox ESR 128.12, Thunderbird 140, and Thunderbird 128.12...

Google Chrome < 138.0.7204.49 Multiple Vulnerabilities

The version of Google Chrome installed on the remote macOS host is prior to 138.0.7204.49. It is, therefore, affected by multiple vulnerabilities as referenced in the 202506stable-channel-update-for-desktop24 advisory. - Insufficient data validation in DevTools in Google Chrome on Windows prior t...

Mozilla Firefox ESR < 115.25

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 115.25. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2025-52 advisory. - A use-after-free in FontFaceSet resulted in a potentially exploitable crash. CVE-2025-6424 - An attacke...

Mozilla Firefox ESR < 128.12

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 128.12. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2025-53 advisory. - The executable file warning did not warn users before opening files with the terminal extension. This b...

CVE-2025-5255

The Phoenix Code's configuration on macOS, specifically the presence of entitlements: "com.apple.security.cs.allow-dyld-environment-variables" and "com.apple.security.cs.disable-library-validation" allows for Dynamic Library Dylib injection. A local attacker with unprivileged access can use...