CVE-2022-26711

CVE-2022-26711: Apple ImageIO WebP Integer Overflow An integer overflow vulnerability in Apple's ImageIO framework when parsing WebP images, leading to an out-of-bounds memory access. Full Writeup - Detailed root cause analysis with disassembly walkthrough. Overview An integer overflow occurs...

CVE-2025-70342

CVE-2025-70342: Credential Interception via Named Pipe in erase-install Summary erase-install prior to v40.4 commit 2c31239 writes swiftDialog credential output to a hardcoded path /var/tmp/dialog.json. On Apple Silicon Macs, admin credentials entered during reinstall/erase operations are written...

iDictPy

iDictPy A salty-ass 100% verified hacker status python script to turn apple id's into apple crisp nicememe I initially made this as a better alternative to this piece of shit: https://github.com/Pr0x13/iDict/ but then i forgot i'm a little bit drunk and then this happened. prerequisites are...

Apple-Platform-Security-Guides

Apple Platform Security Guides Every Apple Platform Security Guide Older iOS Security Guides & older OS X/ macOS Whitepapers Official Apple Document revision history Date| macOS| iOS| watchOS| Comments ---|---|---|---|--- Fall 2019| 10.15.2| 13.3| 6.1.1| Spring 2020| 10.15.4| 13.4| 6.2| February...

CVE-2025

CVE-2025-43300: iOS/macOS DNG Image Processing Memory Corruption Overview CVE-2025-43300 is a critical memory corruption vulnerability in Apple's image processing framework that affects iOS 18.6.1 and macOS systems. The vulnerability exists in the JPEG Lossless decompression code within...

MStore API <= 4.10.7 - Unauthorized Account Access and Privilege Escalation

The MStore API plugin for WordPress is vulnerable to Unauthorized Account Access and Privilege Escalation in versions up to, and including, 4.10.7 due to improper implementation of the Apple login feature. This allows unauthenticated attackers to log in as any user as long as they know the user's...

check_icmp_dos

checkicmpdos iOS 12 / OS X Remote Kernel Heap Overflow CVE-2018-4407 POC: pip install scapy sudo scapy sendIPdst=“Target IP“,options=IPOption“A”8/TCPdport=2323,options=19, “1"18,19, “2”18 Or use the script python checkicmpdos.py 127.0.0.1 This vulnerability allows an attacker, as long as they are...

Fix-Apple-Mail-CVE-2020-9922

Fix-Apple-Mail-CVE-2020-9922 Apple Mail has a scary zero-click vulnerability. Versions of OS X prior to High Sierra were not patched. https://mikko-kenttala.medium.com/zero-click-vulnerability-in-apples-macos-mail-59e0c14b106c I made this quickly and only tested it on Mavericks. I don't see any...

CVE-2025-43537

CVE-2025-43537 Apple Security Credit Researcher: Al Sadman Awal Officially credited by Apple Product Security for the responsible disclosure of CVE-2025-43537. Overview CVE-2025-43537 is a security vulnerability identified during independent security research and responsibly disclosed to Apple...

sudo-cve-2019-18634

CVE-2019-18634 https://www.sudo.ws/alerts/pwfeedback.html https://nvd.nist.gov/vuln/detail/CVE-2019-18634 Credit to Joe Vennix from Apple Information Security for finding the bug...

CVE-2019-8656

CVE-2019-8656 CVE-2019-8656 GateKeeper Bypass https://www.fcvl.net/vulnerabilities/macosx-gatekeeper-bypass...

CVE-2026-28858

⚠️ CVE-2026-28858 — Buffer Overflow in Apple iOS/iPadOS ╔══════════════════════════════════════════════════════════════╗ ║ SEVERITY: CRITICAL │ CVSS: 9.8 │ CWE-120 │ REMOTE ║ ╚══════════════════════════════════════════════════════════════╝ A remote user can cause unexpected system termination or...

uaf-2023-28205

CVE-2023-28205: Apple WebKit Use-After-Free Vulnerability This vulnerability can be exploited through maliciously crafted web content, allowing attackers to execute arbitrary code. Description The code triggers a use-after-free UAF vulnerability by delaying the addition of Map and Date objects,...

cplt

cplt Kernel-enforced sandbox for AI coding agents. cplt wraps GitHub Copilot CLI, OpenCode, Gemini CLI, Antigravity CLI, Pi, Claude Code, goose, DeepSeek Harness, or any shell, so the agent can write code but cannot steal credentials, push to main, merge PRs, or exfiltrate secrets. macOS : Apple...

extra_recipe-iOS-10.2

extrarecipe-iOS-10.2 CVE-2017-2370 Code & Exploit by ianbeer https://bugs.chromium.org/p/project-zero/issues/detail?id=1004 Fixed https://support.apple.com/en-us/HT207482...

CVE-2026-93152

A flaw was found in the Linux kernel's nvme-apple driver. The driver incorrectly handled memory synchronization when initializing and enabling a queue. This could lead to the queue's state not being properly updated before it is accessed by other parts of the system, potentially causing unexpecte...

cve-2026-64725-poc

What's in the repository? A PoC for CVE-2026-64725. See the source code and the blog post for details. How to reproduce? Platforms Found on macOS 26.4.1 build 25E253; Darwin 25.4.0 xnu-12377.101.151; Apple Silicon T8103 / M1. Apple confirms that macOS/iOS/iPadOS 26.6 are vulnerable. PoC 1. Make...

check_icmp_dos-CVE-2018-4407-

Principle The principle is to make other fields of the 'icmp' packet illegal. When the macOS or iPhone kernel parses it, it does not implement size checking, causing a crash. Affected Devices 1. Apple iOS 11 and earlier: all devices 2. Apple macOS High Sierra highest affected version 10.13.6: all...

Apple-Safari-Remote-Code-Execution-CVE-2020-27930

This repository does not have a README...

jit

JitPass You have API keys and tokens in plaintext on your Mac. Use JitPass to protect them. Download for Mac · brew install jitpass/tap/jitpass · Docs · jitpass.com Free for personal and internal company use · Source-available · No account · No telemetry · Nothing leaves your Mac · Secure Enclave...