CVE-2020-9807

CVE-2020-9807 is a memory corruption issue in WebKit components that can occur when processing maliciously crafted web content, potentially enabling arbitrary code execution. The vulnerability affects WebKitGTK and related WebKit builds prior to the fixed version, with upstream fix in WebKit 2.28...

CVE-2022-26700

CVE-2022-26700: A memory corruption issue in WebKit-derived components is addressed. According to the CVE page, processing maliciously crafted web content may lead to arbitrary code execution. Apple specifies fixes in tvOS 15.5, watchOS 8.6, iOS 15.5 and iPadOS 15.5, macOS Monterey 12.4, and Safa...

CVE-2019-8769

CVE-2019-8769 concerns WebKit: an issue in the drawing of web page elements could allow leakage of browsing history when visiting a malicious site. Public fixes span multiple platforms and projects: Apple webkit (iOS 13.1/iPadOS 13.1 and macOS Catalina 10.15), WebKitGTK/WebKitGTK+ (e.g., webkitgt...

CVE-2021-30952

CVE-2021-30952 is an Apple WebKit/WebKitGTK-affected integer overflow in processing malicious web content that can lead to arbitrary code execution. The issue is addressed in tvOS 15.2, macOS Monterey 12.1, Safari 15.2, iOS 15.2, iPadOS 15.2, and watchOS 8.3, with fixes via input validation impro...

CVE-2020-3862

CVE-2020-3862 is a denial-of-service issue affecting WebKit/Safari in Apple ecosystems. The vulnerability stems from memory handling in WebKit that could be triggered by visiting a malicious website, potentially impacting availability. Apple fixed this in iOS 13.3.1 and iPadOS 13.3.1, tvOS 13.3.1...

CVE-2021-30749

CVE-2021-30749 is a WebKitGTK/WebKit memory corruption issue that can lead to arbitrary code execution when processing malicious web content. It affects WebKitGTK/WebKit prior to version 2.32.3 and is addressed upstream in 2.32.3; Debian/Arch advisories also enumerate related CVEs in the same Web...

CVE-2023-38261

CVE-2023-38261 affects Apple devices (iOS, iPadOS, macOS) with a kernel-privilege arbitrary code execution possibility. The description states the issue was mitigated by improved memory handling and is fixed in iOS 16.6, iPadOS 16.6, and macOS Ventura 13.5. The available connected documents corro...

CVE-2023-41072

CVE-2023-41072 concerns a privacy issue addressed by Apple: improved private data redaction for log entries. Affected products include macOS Sonoma 14.1, iOS 17.1 and iPadOS 17.1. The issue could allow an app to access sensitive user data due to insufficient redaction in logs. The NVD entry mirro...

CVE-2021-30689

CVE-2021-30689 affects WebKitGTK and WPE WebKit prior to version 2.32.3. The vulnerability is a logic issue that can allow processing of malicious web content to lead to universal cross-site scripting (XSS). Affected products include WebKitGTK and WebKit in various WebKit-based stacks; the issue ...

CVE-2019-8811

CVE-2019-8811 is a memory corruption vulnerability in WebKit that affected WebKit components used by Apple and related Windows apps (e.g., iCloud for Windows) and could be triggered by processing malicious web content to achieve arbitrary code execution. The vulnerability is addressed in the Appl...

CVE-2022-46689

CVE-2022-46689 describes a race condition in the XNU kernel copy-on-write (COW) mechanism, affecting macOS, iOS, iPadOS, tvOS, and watchOS. The flaw allows an attacker to modify read-only, root-owned files by exploiting a timing window between the kernel checking a page and creating a new copy, p...

CVE-2023-23541

CVE-2023-23541 affects Apple iOS/iPadOS. A privacy issue could allow an app to access information about a user’s contacts due to insufficient private data redaction in log entries. The issue is fixed in iOS 15.7.4 / iPadOS 15.7.4 and in iOS 16.4 / iPadOS 16.4. Affected components are tied to log-...

CVE-2020-3864

CVE-2020-3864 is a logic issue where a DOM object context may not have had a unique security origin. It is fixed in Apple/software updates across multiple platforms: iCloud for Windows 7.17, iTunes for Windows 12.10.4, iCloud for Windows 10.9.2, tvOS 13.3.1, Safari 13.0.5, iOS 13.3.1 and iPadOS 1...

CVE-2019-8808

CVE-2019-8808 refers to memory corruption issues in WebKit-related components that could allow arbitrary code execution when processing malicious web content. Publicly documented fixes target Apple platforms: iOS/iPadOS 13.2, watchOS 6.1, tvOS 13.2, Safari 13.0.3, and iTunes for Windows 12.10.2; ...

CVE-2023-40447

CVE-2023-40447 is a WebKit-related vulnerability that could allow arbitrary code execution when processing web content. The weakness is addressed in Safari 17.1, iOS 17.1/iPadOS 17.1, watchOS 10.1, macOS Sonoma 14.1, macOS Ventura 13.6.1, iOS 16.7.2/iPadOS 16.7.2, macOS Monterey 12.7.1, and relat...

CVE-2024-4558

CVE-2024-4558: Use-after-free in ANGLE within Google Chrome/Chromium's WebKit/ANGLE path allows a remote attacker to potentially trigger heap corruption via a crafted HTML page. Affects Chrome/Chromium builds prior to version 124.0.6367.155. The issue is addressed in the referenced Chrome update;...

CVE-2019-8814

CVE-2019-8814 involves multiple memory corruption issues in WebKit that may be triggered by processing malicious web content, potentially enabling arbitrary code execution. Affected: WebKit/WebKitGTK/WebKit processes across Apple platforms (Safari on iOS/iPadOS/tvOS/macOS) and related WebKitGTK/W...

CVE-2021-30887

CVE-2021-30887 is a WebKit-related logic issue affecting how Content Security Policy is enforced when processing malicious web content. The description states that improved restrictions fix the problem, with the vulnerability fixed in Apple platforms: macOS Monterey 12.0.1, iOS 15.1 and iPadOS 15...

CVE-2023-38425

CVE-2023-38425 affects Apple systems (iOS, iPadOS, macOS) where the kernel could be compromised due to a memory handling issue in a component named in Apple’s advisories. The vulnerability could allow an app to execute arbitrary code with kernel privileges, according to the CVE entry. It has been...

CVE-2023-42849

CVE-2023-42849 affects Apple platforms (iOS/iPadOS 17.1/16.7.2; macOS Monterey 12.7.1, Ventura/Sonoma 13.6.1/14.1; watchOS 10.1) where the issue concerns memory handling. The root cause allows an attacker who already has kernel code execution to bypass kernel memory mitigations, potentially eleva...

CVE-2020-9952

CVE-2020-9952 refers to an input validation issue that could enable a cross-site scripting (XSS) attack when processing maliciously crafted web content. The official guidance states this was addressed with improved input validation and is fixed in Apple software releases: iOS 14.0 and iPadOS 14.0...

CVE-2024-54551

A memory handling issue in WebKitGTK and various Apple products (Safari, iOS, iPadOS, macOS, tvOS, visionOS, and watchOS) can lead to a denial-of-service when processing web content. The vulnerability is addressed in Safari 17.6 , iOS 17.6 , iPadOS 17.6 , macOS Sonoma 14.6 , tvOS 17.6 , visionOS ...

CVE-2020-11764

OpenEXR before 2.4.1 contains an out-of-bounds write in copyIntoFrameBuffer (ImfMisc.cpp), CVE-2020-11764. Amazon Linux 2 ALAS2-2020-1499 confirms the OpenEXR fix and provides updated packages; Red Hat/CentOS advisories (RHSA-2020:4039) also address CVE-2020-11764 among related OpenEXR issues. Re...

CVE-2023-41254

CVE-2023-41254 is a privacy-related issue in Apple platforms where log entries could reveal sensitive user data. It affects iOS/iPadOS 16.7.2 and 17.1, watchOS 10.1, macOS Ventura 13.6.1 and Sonoma 14.1. The root cause is improper private data redaction in logs. The issue is fixed in iOS/iPadOS 1...

CVE-2023-42841

CVE-2023-42841: The issue is addressed by improved memory handling and is fixed in macOS Sonoma 14.1, iOS 17.1 and iPadOS 17.1, iOS 16.7.2 and iPadOS 16.7.2, and macOS Ventura 13.6.1. Description states: an app may be able to execute arbitrary code with kernel privileges. This is confirmed by con...

CVE-2023-42845

CVE-2023-42845 is an authentication issue in Apple platforms where Photos in the Hidden Photos Album could be viewed without authentication. The vulnerability is addressed by improved state management and is fixed in macOS Sonoma 14.1, iOS 17.1, and iPadOS 17.1. No exploitation details are provid...

CVE-2023-40423

CVE-2023-40423 is an Apple vulnerability where improved memory handling fixed an issue that could let an app execute arbitrary code with kernel privileges. Affected/fixed versions per sources: iOS 17.1/iPadOS 17.1, macOS Monterey 12.7.1, macOS Ventura 13.6.1, macOS Sonoma 14.1, and earlier OS ver...

CVE-2023-41976

CVE-2023-41976 is a use-after-free vulnerability in processing web content that can lead to arbitrary code execution. Affected products include Apple platforms: iOS 17.1 and iPadOS 17.1, watchOS 10.1, iOS 16.7.2 and iPadOS 16.7.2, macOS Sonoma 14.1, Safari 17.1, and tvOS 17.1. The issue is fixed ...

CVE-2021-30797

CVE-2021-30797 is a WebKit/WebKitGTK/WebKit2GTK-related vulnerability affecting WebKit-based components. In Arch Linux advisories ASA-202107-67/68, CVE-2021-30797 is listed among multiple issues in webkit2gtk that could allow arbitrary code execution when processing malicious web content, with pa...

CVE-2021-30818

CVE-2021-30818 is a type confusion vulnerability in WebKitGTK/WebKit, leading to arbitrary code execution when processing malicious web content. The issue is fixed in Apple platforms (iOS 14.8+, iPadOS 14.8+, Safari 15+, watchOS 8, tvOS 15) and is correlated with WebKitGTK/WebKit fixes in Linux p...

CVE-2026-65346

Apple has addressed an integer overflow vulnerability in the ImageIO framework, which handles image parsing. Processing a malicious image can allow an attacker to perform an integer operation where the result exceeds the allocated memory space, potentially leading to arbitrary code execution on t...

CVE-2023-40416

CVE-2023-40416 affects Apple ImageIO: processing an image may disclose process memory. Fixed in iOS 17.1 / iPadOS 17.1, macOS Monterey 12.7.1, iOS 16.7.2 / iPadOS 16.7.2, macOS Ventura 13.6.1, macOS Sonoma 14.1. The Nessus/OpenVAS entries corroborate the vulnerability family (memory disclosure vi...

CVE-2019-8823

CVE-2019-8823 affects WebKitGTK/WebKitGTK4. Affected component: WebKitGTK4, part of WebKit; issue described as memory corruption in WebKit leading to possible arbitrary code execution when processing malicious web content. Public references in Apple advisories (WebKit) list CVE-2019-8823 among We...

CVE-2021-30934

The CVE-2021-30934 entry is valid and has concrete details across connected documents. It concerns WebKit/WebKitGTK family processing malicious web content leading to arbitrary code execution due to a buffer overflow. Affected products include Apple platforms: Safari 15.2, macOS Monterey 12.1, iO...

CVE-2023-41982

CVE-2023-41982 affects Apple devices where an attacker with physical access can use Siri from a locked device to access sensitive user data. The issue is addressed by restricting options offered on a locked device and is fixed in macOS Sonoma 14.1, watchOS 10.1, iOS 16.7.2 and iPadOS 16.7.2, and ...

CVE-2023-41997

CVE-2023-41997 affects Apple platforms where the issue is mitigated by code changes that restrict options on a locked device to prevent Siri from leaking data. The public description confirms vulnerable behavior: an attacker with physical access could use Siri to access sensitive user data. The f...

CVE-2022-22600

CVE-2022-22600 affects Apple platforms: tvOS 15.4, iOS 15.4, iPadOS 15.4, macOS Monterey 12.3, and watchOS 8.5. The bulletin states a bypass of certain Privacy preferences via a malicious app, due to an issue in permissions logic. The available sources in the initial description confirm the fix w...

CVE-2024-54658

CVE-2024-54658 is a memory-handling issue in processing web content that can lead to a denial-of-service. The primary public description states the fix is in Apple software: iOS 17.4 and iPadOS 17.4, Safari 17.4, tvOS 17.4, watchOS 10.4, visionOS 1.1, and macOS Sonoma 14.4. The vulnerability is m...

CVE-2021-36976

CVE-2021-36976 affects libarchive 3.4.1 through 3.5.1 with a use-after-free in copy_string (invoked by do_uncompress_block and process_block). Connected advisories show affected packages across multiple distributions (e.g., Debian libarchive updates to 3.4.3-2+deb11u2; Fedora/libarchive 3.5.3-1; ...

CVE-2023-42857

CVE-2023-42857 describes a privacy issue where private data redaction for log entries was improved. Affected platforms: macOS Sonoma 14.1, iOS 17.1, and iPadOS 17.1. Root cause: leakage of sensitive user data through logs due to insufficient redaction. Impact: an app may be able to access sensiti...

CVE-2021-30682

CVE-2021-30682 is a WebKit/Apple logic-issue vulnerability disclosed as fixed in tvOS 14.6, iOS 14.6, iPadOS 14.6, Safari 14.1.1, macOS Big Sur 11.4, and watchOS 7.5. The issue allows a malicious application to leak sensitive user information due to improper restrictions. Connected sources confir...

CVE-2025-31205

A vulnerability in WebKit and webkit2gtk allows a malicious website to exfiltrate data cross-origin . The root cause was addressed through improved checks . Affected products include Safari, iOS, iPadOS, macOS Sequoia, tvOS, visionOS, and watchOS . Remediation is available in versions 18.5 (Safar...

CVE-2020-11765

CVE-2020-11765 concerns OpenEXR prior to 2.4.1, where an off-by-one error in the ImfXdr.h read function used by DwaCompressor::Classifier::Classifier caused an out-of-bounds read. Public disclosures and vendor advisories (OpenEXR/OpenEXR 2.4.1 release notes; GLSA-202107-27; Debian DLA-2358-1) con...

CVE-2023-40413

CVE-2023-40413 affects Apple platforms (iOS 17.1/iPadOS 17.1 and earlier/macOS/macOS Sonoma 14.1 etc.) in the Find My component. The issue is described as an improvement in cache handling that could allow an app to read sensitive location information. The vulnerability is fixed in iOS 17.1/iPadOS...

CVE-2020-11758

CVE-2020-11758 affects OpenEXR before 2.4.1 via an out-of-bounds read in ImfOptimizedPixelReading.h. Public docs (Debian DLA-2358-1) note potential denial of service and possible arbitrary code execution when processing malformed EXR files; OpenEXR/ImageIO entries reference the same CVE family. R...

CVE-2020-11760

CVE-2020-11760 affects OpenEXR before 2.4.1. There is an out-of-bounds read during RLE uncompression in ImfRle.cpp (function rleUncompress). OpenEXR releases indicate the fix is to upgrade to v2.4.1. Public references in the connected documents confirm the CVE entry is included among OpenEXR issu...

CVE-2023-40449

CVE-2023-40449 is an Apple vulnerability where an application may cause a denial-of-service due to an issue in memory handling. The published entry specifies a local attack surface with user interaction required, and the root cause is related to memory handling that could be exploited by a compro...

CVE-2023-41977

CVE-2023-41977 is a Safari-related issue where improved cache handling fixes a vulnerability that could allow a malicious website to reveal browsing history. Affected products/versions (per connected sources): macOS Sonoma 14.1; iOS 16.7.2; iPadOS 16.7.2. Remedy: Apple has addressed the issue in ...

CVE-2023-42847

CVE-2023-42847 is a logic-issue vulnerability fixed by Apple in macOS Sonoma 14.1, iOS 17.1, and iPadOS 17.1. The issue allowed access to passkeys without authentication due to insufficient checks. Affected products: macOS Sonoma 14.1+, iOS 17.1, iPadOS 17.1. Impact, as stated: an attacker may ac...

CVE-2022-32816

CVE-2022-32816 is a WebKitGTK/WebKit issue where visiting a website that frames malicious content may lead to UI spoofing. Connected advisories confirm this vulnerability in WebKitGTK/WebKit related packages (e.g., webkitgtk/webkit2gtk) with upstream fixes around version 2.36.5+; Arch Linux ASA-2...