CVE-2025-46281

A logic issue was addressed with improved checks. This issue is fixed in macOS Tahoe 26.2. An app may be able to break out of its sandbox...

CVE-2025-46277

A logging issue was addressed with improved data redaction. This issue is fixed in iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, watchOS 26.2. An app may be able to access a user’s Safari history...

CVE-2025-46282

The issue was addressed with additional permissions checks. This issue is fixed in Safari 26.2, macOS Tahoe 26.2. An app may be able to access sensitive user data...

CVE-2025-46291

A logic issue was addressed with improved validation. This issue is fixed in macOS Tahoe 26.2. An app may bypass Gatekeeper checks...

CVE-2025-64724

Arduino IDE is an integrated development environment. Prior to version 2.3.7, Arduino IDE for macOS is installed with world-writable file permissions on sensitive application components, allowing any local user to replace legitimate files with malicious code. When another user launches the...

CVE-2025-64723

Arduino IDE is an integrated development environment. Prior to version 2.3.7, Arduino IDE for macOS was configured with overly permissive security entitlements that could bypass macOS Hardened Runtime protections. This configuration allows attackers to inject malicious dynamic libraries into the...

CVE-2025-64724

Arduino IDE for macOS prior to version 2.3.7 is installed with world-writable permissions on sensitive components, allowing a local user to replace legitimate files. When another user runs the app, malicious code could execute with that user’s privileges, enabling privilege escalation and access ...

CVE-2025-64724 Arduino IDE for macOS has Insecure File Permissions

Arduino IDE is an integrated development environment. Prior to version 2.3.7, Arduino IDE for macOS is installed with world-writable file permissions on sensitive application components, allowing any local user to replace legitimate files with malicious code. When another user launches the...

CVE-2025-64724 Arduino IDE for macOS has Insecure File Permissions

Arduino IDE is an integrated development environment. Prior to version 2.3.7, Arduino IDE for macOS is installed with world-writable file permissions on sensitive application components, allowing any local user to replace legitimate files with malicious code. When another user launches the...

CVE-2025-64723 Arduino IDE for macOS has TCC Bypass via Dynamic Library Injection

Arduino IDE is an integrated development environment. Prior to version 2.3.7, Arduino IDE for macOS was configured with overly permissive security entitlements that could bypass macOS Hardened Runtime protections. This configuration allows attackers to inject malicious dynamic libraries into the...

CVE-2025-64723 Arduino IDE for macOS has TCC Bypass via Dynamic Library Injection

Arduino IDE is an integrated development environment. Prior to version 2.3.7, Arduino IDE for macOS was configured with overly permissive security entitlements that could bypass macOS Hardened Runtime protections. This configuration allows attackers to inject malicious dynamic libraries into the...

CVE-2024-46060

Anaconda3 macOS installers before 2024.06-1 contain a local privilege escalation vulnerability when installed outside the user's home directory. During installation, world-writable files are created and executed with root privileges. This allows a local low-privileged user to inject arbitrary...

CVE-2024-46062

Miniconda3 macOS installers before 23.11.0-1 contain a local privilege escalation vulnerability when installed outside the user's home directory. During installation, world-writable files are created and executed with root privileges. This flaw allows a local low-privileged user to inject arbitra...

SUSE CVE-2025-43541

A type confusion issue was addressed with improved state handling. This issue is fixed in Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, visionOS 26.2. Processing maliciously crafted web content may lead to an unexpected Safari crash...

Mozilla Thunderbird < 2.0.0.16

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 2.0.0.16. It is, therefore, affected by a vulnerability as referenced in the mfsa2008-24 advisory. - Mozilla Firefox before 2.0.0.15, Thunderbird 2.0.0.14 and earlier, and SeaMonkey before 1.1.10 allow remote...

Mozilla Thunderbird < 16.0

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 16.0. It is, therefore, affected by a vulnerability as referenced in the mfsa2012-75 advisory. - Mozilla Firefox before 16.0, Thunderbird before 16.0, and SeaMonkey before 2.13 do not properly handle navigation...

Mozilla Firefox < 20.0

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 20.0. It is, therefore, affected by a vulnerability as referenced in the mfsa2013-40 advisory. - CERTDecodeCertPackage reads bytes outside the input bufferCVE-2013-0791 CVE-2013-0791 Note that Nessus has not tested...

Mozilla Thunderbird ESR < 17.0.5

The version of Thunderbird ESR installed on the remote macOS or Mac OS X host is prior to 17.0.5. It is, therefore, affected by a vulnerability as referenced in the mfsa2013-40 advisory. - CERTDecodeCertPackage reads bytes outside the input bufferCVE-2013-0791 CVE-2013-0791 Note that Nessus has n...

Mozilla Firefox < 19.0

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 19.0. It is, therefore, affected by a vulnerability as referenced in the mfsa2013-22 advisory. - out-of-bounds-read in mozilla::image::RasterImage::DrawFrameToCVE-2013-0772 CVE-2013-0772 Note that Nessus has not...

Mozilla Firefox < 3.0.12

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 3.0.12. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2009-34 advisory. - The JavaScript engine in Mozilla Firefox before 3.0.12 and Thunderbird allows remote attackers to cause a...