CVE-2025-43450

A logic issue was addressed with improved checks. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1. An app may be able to learn information about the current camera view before being granted camera access...

CVE-2025-43309

A logic issue was addressed with improved checks. This issue is fixed in iOS 26 and iPadOS 26. An attacker with physical access to an iOS device may be able to view notification contents from the Lock Screen...

CVE-2025-43309

CVE-2025-43309 describes a logic issue in iOS/iPadOS that could allow a physically proximate attacker to view lock-screen notification contents. Affected software is iOS 26 and iPadOS 26. Root cause cited as a logic/checks issue; Apple patched this with the iOS 26 / iPadOS 26 security updates. Im...

CVE-2025-43348

A logic issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.7.2, macOS Tahoe 26.1, macOS Sonoma 14.8.2. An app may bypass Gatekeeper checks...

CVE-2025-43396

CVE-2025-43396 is a logic issue in macOS that could allow a sandboxed app to access sensitive user data. It is reported as a LOCAL, low complexity (UI: REQUIRED) vulnerability with high confidentiality impact and no user interaction required beyond the app’s sandbox privileges. Apple fixes are av...

CVE-2025-43396

A logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7.2, macOS Tahoe 26.1, macOS Sonoma 14.8.2. A sandboxed app may be able to access sensitive user data...

CVE-2025-43322

A logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7.2, macOS Tahoe 26.1, macOS Sonoma 14.8.2. An app may be able to access user-sensitive data...

CVE-2025-43322

CVE-2025-43322 is a logic-issue vulnerability affecting macOS Sonoma 14.8.2, macOS Sequoia 15.7.2, and macOS Tahoe 26.1. The issue could allow an app to access user‑sensitive data due to improved checks in the affected components. Apple lists mitigation as the respective OS updates (Sonoma 14.8.2...

CVE-2025-43322

A logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1. An app may be able to access user-sensitive data...

CVE-2025-43460

CVE-2025-43460 affects Apple iOS and iPadOS through a logic issue that allows an attacker with physical access to a locked device to view sensitive user information. The vulnerability is tied to insufficient checks and is fixed in iOS 26.1 and iPadOS 26.1. Affected component details are not expli...

CVE-2025-43460

A logic issue was addressed with improved checks. This issue is fixed in iOS 26.1 and iPadOS 26.1. An attacker with physical access to a locked device may be able to view sensitive user information...

CVE-2025-43376

A logic issue was addressed with improved state management. This issue is fixed in Safari 26, tvOS 26, watchOS 26, iOS 26 and iPadOS 26, visionOS 26. A remote attacker may be able to view leaked DNS queries with Private Relay turned on...

PT-2025-44810

A logic issue was addressed with improved checks. This issue is fixed in iOS 26 and iPadOS 26. An attacker with physical access to an iOS device may be able to view notification contents from the Lock Screen...

PT-2025-44891

A logic issue was addressed with improved checks. This issue is fixed in iOS 26.1 and iPadOS 26.1. An attacker with physical access to a locked device may be able to view sensitive user information...

PT-2025-44884

A logic issue was addressed with improved checks. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2. An app may be able to learn information about the current camera view before being granted camera access...

PT-2025-44811

Name of the Vulnerable Software and Affected Versions macOS versions prior to Sonoma 14.8.2 macOS versions prior to Sequoia 15.7.2 Description A logic issue existed due to insufficient checks, potentially allowing an application to access user-sensitive data. Recommendations Update to macOS Sonom...

PT-2025-44791

Name of the Vulnerable Software and Affected Versions lighttpd version 1.4.80 Description The software improperly merges trailer fields into headers following HTTP request parsing, which can be leveraged to carry out HTTP Header Smuggling attacks. Successful exploitation could allow an attacker t...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: iouring/rsrc: Do not rely on user vaddr alignment. There is no guaranteed alignment for user pointers. However, the calculation of the offset from the first page to a folio after coalescing uses some strange bit mask logic;...

CVE-2025-58149 Incorrect removal of permissions on PCI device unplug

When passing through PCI devices, the detach logic in libxl won't remove access permissions to any 64bit memory BARs the device might have. As a result a domain can still have access any 64bit memory BAR when such device is no longer assigned to the domain. For PV domains the permission leak allo...

CVE-2025-58149

CVE-2025-58149 affects the Xen hypervisor. The detach logic for PCI devices fails to remove access permissions to 64‑bit memory BARs when a device is unplugged, allowing PV guests to access memory of devices no longer assigned to them (HVM implications noted with required compromised device model...