CVE-2025-6183

The StrongDM macOS client incorrectly processed JSON-formatted messages. Attackers could potentially modify macOS system configuration by crafting a malicious JSON message...

About the security content of iOS 18.6.2 and iPadOS 18.6.2

About the security content of iOS 18.6.2 and iPadOS 18.6.2 This document describes the security content of iOS 18.6.2 and iPadOS 18.6.2. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and...

Apple iOS < 18.6.2 Vulnerability (124925)

Binary data appleios1862check.nbin...

Multiple Apple products suffer from an out-of-bounds write vulnerability

iPadOS is Apple's mobile operating system for iPad devices, which is based on iOS and optimized for the iPad. iPhone OS is Apple's operating system for the iPhone and iPod touch. macOS is a set of Apple-developed MacOS is an operating system developed by Apple that runs on the Macintosh family of...

PT-2025-34177

Name of the Vulnerable Software and Affected Versions iOS versions prior to 15.8.5 iOS versions 16.x prior to 16.7.12 iOS versions prior to 18.6.2 iPadOS versions prior to 15.8.5 iPadOS versions 16.x prior to 16.7.12 iPadOS versions 17.x prior to 17.7.10 iPadOS versions prior to 18.6.2 macOS...

Linux Distros Unpatched Vulnerability : CVE-2025-43211

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6, iPadOS 17.7.9, macOS Sequoia 15.6, tvOS 18....

VulnCheck KEV: CVE-2025-43300

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.8.5 and iPadOS 15.8.5, iOS 16.7.12 and iPadOS 16.7.12, iOS 18.6.2 and iPadOS 18.6.2, iPadOS 17.7.10, macOS Sequoia 15.6.1, macOS Sonoma 14.7.8, macOS Ventura 13.7.8. Processing a malicious imag...

VulnCheck KEV: CVE-2025-55177

Incomplete authorization of linked device synchronization messages in WhatsApp for iOS prior to v2.25.21.73, WhatsApp Business for iOS v2.25.21.78, and WhatsApp for Mac v2.25.21.78 could have allowed an unrelated user to trigger processing of content from an arbitrary URL on a target’s device. We...

SUSE CVE-2025-38557

In the Linux kernel, the following vulnerability has been resolved: HID: apple: validate feature-report field count to prevent NULL pointer dereference A malicious HID device with quirk APPLEMAGICBACKLIGHT can trigger a NULL pointer dereference whilst the power feature-report is toggled and sent ...

CVE-2025-55033

Dragging JavaScript links to the URL bar in Focus for iOS could be utilized to run malicious scripts, potentially resulting in XSS attacks. This vulnerability was fixed in Focus for iOS 142...

CVE-2025-55032

Focus for iOS would not respect a Content-Disposition header of type Attachment and would incorrectly display the content inline, potentially allowing for XSS attacks. This vulnerability was fixed in Focus for iOS 142...

CVE-2025-55031

Malicious pages could use Firefox for iOS to pass FIDO: links to the OS and trigger the hybrid passkey transport. An attacker within Bluetooth range could have used this to trick the user into using their passkey to log the attacker's computer into the target account. This vulnerability affects...

CVE-2025-54144

The URL scheme used by Firefox to facilitate searching of text queries could incorrectly allow attackers to open arbitrary website URLs or internal pages if a user was tricked into clicking a link. This vulnerability was fixed in Firefox for iOS 141...

CVE-2025-54143

Sandboxed iframes on webpages could potentially allow downloads to the device, bypassing the expected sandbox restrictions declared on the parent page. This vulnerability was fixed in Firefox for iOS 141...

CVE-2025-55033 Drag and drop gestures in Focus for iOS could allow JavaScript links to be executed incorrectly

Dragging JavaScript links to the URL bar in Focus for iOS could be utilized to run malicious scripts, potentially resulting in XSS attacks. This vulnerability was fixed in Focus for iOS 142...

CVE-2025-55032 Focus incorrectly ignores Content-Disposition headers for some MIME types

Focus for iOS would not respect a Content-Disposition header of type Attachment and would incorrectly display the content inline, potentially allowing for XSS attacks. This vulnerability was fixed in Focus for iOS 142...

CVE-2025-55028 JavaScript alerts could impede UI interaction or allow denial of service attacks

Malicious scripts utilizing repetitive JavaScript alerts could prevent client user interaction in some scenarios and allow for denial of service attacks. This vulnerability was fixed in Firefox for iOS 142...

CVE-2025-55031 Passkey phishing within Bluetooth range

Malicious pages could use Firefox for iOS to pass FIDO: links to the OS and trigger the hybrid passkey transport. An attacker within Bluetooth range could have used this to trick the user into using their passkey to log the attacker's computer into the target account. This vulnerability was fixed...

CVE-2025-54143

CVE-2025-54143 is tied to Firefox for iOS prior to version 141. The issue arises from sandboxed iframes on web pages that could bypass the parent page’s sandbox restrictions, potentially allowing downloads to the device. Affected product: Firefox for iOS

DEBIAN-CVE-2025-38557

In the Linux kernel, the following vulnerability has been resolved: HID: apple: validate feature-report field count to prevent NULL pointer dereference A malicious HID device with quirk APPLEMAGICBACKLIGHT can trigger a NULL pointer dereference whilst the power feature-report is toggled and sent ...