CVE-2023-42847

CVE-2023-42847 is a logic-issue vulnerability fixed by Apple in macOS Sonoma 14.1, iOS 17.1, and iPadOS 17.1. The issue allowed access to passkeys without authentication due to insufficient checks. Affected products: macOS Sonoma 14.1+, iOS 17.1, iPadOS 17.1. Impact, as stated: an attacker may ac...

CVE-2022-26706

CVE-2022-26706 concerns an access issue in Apple’s sandboxing that allowed a sandboxed process to circumvent sandbox restrictions. Apple fixed the bug in tvOS 15.5, iOS 15.5 / iPadOS 15.5, watchOS 8.6, macOS Big Sur 11.6.6, and macOS Monterey 12.4. The vulnerability was addressed by tightening sa...

CVE-2023-23520

CVE-2023-23520 involves a race condition in the Apple Crash Reporter that could allow a user to read arbitrary files as root. The issue was addressed with additional validation and patched in watchOS 9.3, tvOS 16.3, macOS Ventura 13.2, iOS 16.3, and iPadOS 16.3. Affected components and exact root...

CVE-2021-30851

CVE-2021-30851 affects WebKitGTK and WPE WebKit. A memory corruption vulnerability could allow arbitrary code execution when processing malicious web content. Upstream fix is WebKitGTK/WebKit/WPE WebKit 2.34.1; Debian/Arch Linux advisories (DSA-4995/4996, ASA-202110-10) note remediation by upgrad...

CVE-2023-41988

CVE-2023-41988 concerns an issue where an attacker with physical access could use Siri to access sensitive user data on locked devices. The fixed behavior is to restrict options offered on a locked device. Affected/affected-by details in the provided documents indicate remediation in macOS Sonoma...

CVE-2022-21658

CVE-2022-21658 affects Rust’s std::fs::remove_dir_all, due to a race condition (CWE-363) that could allow an attacker to trick a privileged process into deleting files/directories outside the target. Affected Rust releases: 1.0.0–1.58.0; patch released in 1.58.1. Impact can be significant for pri...

CVE-2022-26711

CVE-2022-26711 describes an integer overflow in Apple's ImageIO WebP parsing. The root cause is an overflow in row-bytes calculation leading to an undersized buffer and out-of-bounds access during image decoding, enabling arbitrary code execution in apps using ImageIO (Safari, Preview, Mail, Mess...

CVE-2022-32885

CVE-2022-32885 is a WebKitGTK/WebKit memory corruption issue triggered by processing malicious web content. The connected advisories confirm the root cause as memory corruption from handling web content and show affected/patch targets across platforms: Apple devices (iOS 15.6, iPadOS 15.6, macOS ...

CVE-2021-30846

CVE-2021-30846 is a memory corruption vulnerability in WebKitGTK and WPE WebKit that could allow remote code execution when processing malicious web content. It is publicly fixed upstream in WebKitGTK/WPE WebKit around version 2.34.1 (Arch Linux ASA-202110-9/ASA-202110-10 indicate vulnerability i...

CVE-2021-30889

CVE-2021-30889 : Buffer overflow in WebKitGTK leading to arbitrary code execution when processing malicious web content. Affected product: WebKitGTK/WebKit. Root cause: buffer overflow in WebKitGTK components (WebCore::ImageBufferCairoImageSurfaceBackend::create). Public references in ALAS2 advis...

CVE-2021-30888

CVE-2021-30888 is an information-leakage flaw in WebKitGTK and WebKit where a malicious website using Content Security Policy can leak information via redirect behavior. Remediation is provided by Apple in the iOS 15.1/iPadOS 15.1, macOS Monterey 12.0.1, iOS 14.8.1/iPadOS 14.8.1, tvOS 15.1, and w...

CVE-2022-22594

CVE-2022-22594 describes a cross-origin data exfiltration issue in WebKit/WebKitGTK via cross-origin tracking, later fixed in Safari 15.3, iOS 15.3, iPadOS 15.3, watchOS 8.4, tvOS 15.3, and macOS Monterey 12.2. The connected documents indicate the vulnerability allowed tracking of sensitive user ...

CVE-2025-24126

CVE-2025-24126 describes an input validation issue in AirPlay across Apple platforms. The vulnerability allows a local-network actor to cause an unexpected termination or memory corruption. Patches are provided in visionOS 2.3, iOS 18.3, iPadOS 18.3, macOS Sequoia 15.3, watchOS 11.3, and tvOS 18....

CVE-2021-30890

CVE-2021-30890 is a WebKit/WebKitGTK/WebKitGTK-derived vulnerability described as a logic/state issue where processing maliciously crafted web content may lead to universal cross-site scripting. Public mentions appear in multiple connected advisories: Debian DSA-5030-1 (webkit2gtk) and DSA-5031-1...

CVE-2022-42867

CVE-2022-42867 is a use-after-free in WebKit/WebKitGTK (WebKitGTK). The root cause is a memory management issue that, when processing malicious web content, could lead to arbitrary code execution. The advisory notes this is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 16.2, iPadOS 16....

CVE-2022-46698

CVE-2022-46698 is a logic issue in WebKitGTK where processing malicious web content may disclose sensitive user information. Multiple connected advisories confirm this issue in WebKitGTK/WebKit2GTK components and list it among fixed CVEs after updates to WebKitGTK packages. Affected products incl...

CVE-2021-1820

CVE-2021-1820 is a memory initialization issue fixed in macOS Big Sur 11.3, iOS 14.5, iPadOS 14.5, watchOS 7.4, and tvOS 14.5. The description states that processing maliciously crafted web content may lead to disclosure of process memory. Connected documentation confirms the vulnerability is a m...

CVE-2022-26709

CVE-2022-26709 is a use-after-free in WebKitGTK that can lead to arbitrary code execution when processing malicious web content. The initial CVE entry notes the fix across Apple platforms (tvOS 15.5, iOS 15.5/iPadOS 15.5, watchOS 8.6, macOS Monterey 12.4, Safari 15.5). Connected advisories (Debia...

CVE-2023-23514

CVE-2023-23514 is a macOS kernel-use-after-free vulnerability. In macOS Ventura 13.3 (and related updates) the issue was addressed by improved memory management, fixing a flaw that could allow an app to execute arbitrary code with kernel privileges. Public references in Apple advisories show the ...

CVE-2025-31257

CVE-2025-31257 affects WebKit/WebKitGTK components used by Safari across Apple platforms. The issue is described as a memory handling problem that may cause a crash when processing maliciously crafted web content. Concrete fixes exist in watchOS 11.5, tvOS 18.5, iOS 18.5, iPadOS 18.5, macOS Sequo...

CVE-2021-30954

CVE-2021-30954 is a type-confusion vulnerability in WebKit/WebKitGTK that could allow arbitrary code execution when processing malicious web content. The issue is fixed in Apple platforms: tvOS 15.2, macOS Monterey 12.1, Safari 15.2, iOS 15.2, and iPadOS 15.2. The connected Astra Linux advisory a...

CVE-2022-22592

CVE-2022-22592 is a WebKit/WebKitGTK logic issue (state management) that may allow malicious web content to bypass or prevent enforcement of Content Security Policy. In the connected advisories, the vulnerability is cited across multiple ecosystems: Apple platforms (WebKit/WebKitGPU stack) with f...

CVE-2019-8763

CVE-2019-8763 is a WebKit-related memory corruption issue addressed across Apple platforms. The description in the initial doc notes multiple memory corruption problems resolved by improved memory handling, with fixes in iOS 13.1 and iPadOS 13.1, tvOS 13, Safari 13.0.1, iTunes for Windows 12.10.1...

CVE-2022-26702

CVE-2022-26702 is a use-after-free vulnerability in Apple software that could allow an attacker to execute arbitrary code with kernel privileges on affected devices. Apple fixes are listed for watchOS 8.6, tvOS 15.5, iOS 15.5, and iPadOS 15.5. The provided documents identify this vulnerability as...

CVE-2022-26751

CVE-2022-26751 describes a memory corruption issue triggered by processing a maliciously crafted image. The vulnerability is addressed by Apple in iTunes 12.12.4 for Windows, and in iOS 15.5 / iPadOS 15.5, Security Update 2022-004 Catalina, macOS Big Sur 11.6.6, and macOS Monterey 12.4. The fixed...

CVE-2022-32922

CVE-2022-32922 describes a use-after-free in Safari-related web content processing that could lead to arbitrary code execution. Affected products/versions include Safari 16.1, iOS 16.1, iPadOS 16, and macOS Ventura 13; the issue is addressed by memory-management fixes in these versions. The conne...

CVE-2024-54534

CVE-2024-54534 is an Apple memory-corruption issue triggered by processing malicious web content. Public details in connected documents show the vulnerability affects multiple Apple platforms (watchOS, visionOS, tvOS, macOS, Safari, iOS, iPadOS) and is mitigated by memory-management fixes. Fixed ...

CVE-2021-1826

CVE-2021-1826 describes a logic issue in WebKit where processing malicious web content could trigger universal cross-site scripting on Apple platforms. The vulnerability was fixed in Apple software updates across multiple OSes: macOS Big Sur 11.3, iOS 14.5, iPadOS 14.5, watchOS 7.4, and tvOS 14.5...

CVE-2019-14899

CVE-2019-14899 is a routing-path/kernel issue affecting macOS (and cited across Linux, FreeBSD, OpenBSD, iOS, Android). The root cause is a VPN-tunnel routing problem that allows a local/adjacent attacker to inject into active VPN connections, enabling data injection and potential VPN hijacking. ...

CVE-2021-30928

CVE-2021-30928 is a memory corruption vulnerability in CoreGraphics affecting processing of maliciously crafted images, leading to arbitrary code execution. The Apple advisories indicate the issue is fixed in macOS Big Sur 11.6 and in iOS 14.8 / 15, iPadOS 14.8 / 15, watchOS 8, and tvOS 15. The A...

CVE-2021-30953

CVE-2021-30953 is a WebKit Web content handling vulnerability (out-of-bounds read) that could allow arbitrary code execution. It is fixed in Safari 15.2, iOS 15.2, iPadOS 15.2, macOS Monterey 12.1, and tvOS 15.2. Public sources in the Connected Documents corroborate the issue as an out-of-bounds ...

CVE-2023-28201

CVE-2023-28201 affects Apple WebKit Web Inspector used by Safari/WebKit components on macOS ( Ventura 13.3 ), iOS 16.4 / 15.7.4, iPadOS 16.4 / 15.7.4, and tvOS 16.4. The root cause is related to improved state management in WebKit; the issue could allow a remote attacker to cause unexpected app t...

CVE-2020-6616

CVE-2020-6616 involves Broadcom BCM4361 Bluetooth RNG: a low-entropy PRNG is used where a Hardware RNG should be, enabling spoofing risks. Publicly documented impact references include Apple’s iOS 13.5/iPadOS 13.5 notes, which list CVE-2020-6616 under Bluetooth with a low-entropy PRNG issue, affe...

CVE-2023-28198

CVE-2023-28198: A use-after-free in WebKit processing web content was fixed. Affected: Apple platforms (iOS/iPadOS/macOS) as per the description. Impact stated: arbitrary code execution if exploited via processing web content. Root cause: memory management/use-after-free vulnerability. Remediatio...

CVE-2024-54467

CVE-2024-54467 involves a cookie-management issue in WebKitGTK (webkit2gtk) that can allow a malicious website to exfiltrate data cross-origin. The initial description notes fixes across Apple platforms (watchOS 11, macOS Sequoia 15, Safari 18, visionOS 2, iOS 18, iPadOS 18, tvOS 18). Connected d...

CVE-2025-24150

CVE-2025-24150 concerns WebKitGTK/WebKit components where copying a URL from Web Inspector may lead to command injection. The Initial Description identifies Apple platforms fixed in macOS Sequoia 15.3, Safari 18.3, iOS 18.3 and iPadOS 18.3. Connected documents corroborate the CVE in WebKitGTK con...

CVE-2023-32445

CVE-2023-32445 is a cross-site scripting vulnerability triggered when processing a document. The issue affects Apple platforms including Safari, macOS Ventura, iOS, iPadOS, watchOS, and tvOS as listed, with exploitation potential tied to document handling. Apple states the vulnerability is resolv...

CVE-2021-30823

CVE-2021-30823 is a logic issue in WebKit that allowed bypassing HSTS when processing web content. It is addressed in macOS Monterey 12.0.1, iOS 14.8/iPadOS 14.8, tvOS 15, Safari 15, and watchOS 8. Connected sources also list WebKitGTK+ and Apple advisories referencing the same CVE as part of a b...

CVE-2021-30809

CVE-2021-30809 is a WebKit/WebKitGTK use-after-free vulnerability. The Debian/AlmaLinux/Amazon advisories and Debian security tracker describe it as a use-after-free issue in WebKitGTK that could allow arbitrary code execution when processing malicious web content, with fixes implemented in Safar...

CVE-2019-8822

CVE-2019-8822 is an Apple WebKit vulnerability involving multiple memory corruption issues when processing malicious web content, fixed in iOS 13.2 / iPadOS 13.2, tvOS 13.2, Safari 13.0.3, iTunes for Windows 12.10.2, and iCloud for Windows 11.0 (and 7.15). The issue enables arbitrary code executi...

CVE-2023-23530

CVE-2023-23530 relates to an Apple memory handling issue that could allow an app to execute arbitrary code outside its sandbox or with elevated privileges. The vulnerability is addressed in macOS Ventura 13.2, iOS 16.3, and iPadOS 16.3, indicating an Apple memory-management fault in the affected ...

CVE-2023-34425

CVE-2023-34425 involves an issue in Apple software where improved memory handling fixes allow arbitrary code execution with kernel privileges. Affected are watchOS 9.6, macOS Monterey 12.6.8, iOS 15.7.8 and iPadOS 15.7.8, macOS Big Sur 11.7.9, iOS 16.6 and iPadOS 16.6, and macOS Ventura 13.5. The...

CVE-2025-30427

CVE-2025-30427 is a use-after-free vulnerability in processing maliciously crafted web content that may lead to an unexpected Safari crash. Affected in multiple Apple platforms; fixes are implemented in visionOS 2.4, tvOS 18.4, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, and Safari 18.4. Debian...

CVE-2026-65346

An integer overflow in Apple's ImageIO framework (CVE-2026-65346) allows arbitrary code execution when processing a malicious image on iOS 26.6.1, iPadOS 26.6.1, and macOS Tahoe 26.6.2. No in-the-wild exploitation is reported; updates are available via Apple's security advisories.

CVE-2022-46692

CVE-2022-46692 is a logic issue in WebKitGTK/WebKit causing a bypass of the Same Origin Policy when processing malicious web content. The Apple ecosystem fixes (Safari 16.2, iOS 16.2/iPadOS 16.2, macOS Ventura 13.1, watchOS 9.2, etc.) are documented in the initial CVE description. Connected advis...

CVE-2023-36495

CVE-2023-36495 involves an integer overflow that Apple fixed by improving input validation. Affected platforms include watchOS 9.6, macOS Monterey 12.6.8, iOS 15.7.8/iPadOS 15.7.8, tvOS 16.6, iOS 16.6/iPadOS 16.6, and macOS Ventura 13.5. The issue could allow an app to execute arbitrary code with...

CVE-2021-30984

CVE-2021-30984 is a race condition in WebKit-based engines (WebKitGTK/WebKit) that could allow processing malicious web content to execute arbitrary code. Apple advisory notes fixes in tvOS 15.2, macOS Monterey 12.1, Safari 15.2, iOS 15.2 and iPadOS 15.2, watchOS 8.3. Connected docs also referenc...

CVE-2022-42799

CVE-2022-42799 describes a UI spoofing vulnerability in WebKitGTK/WebKit-based browsers when visiting a malicious site. The Apple OS updates fixed this (tvOS/macOS/iOS/watchOS Safari/WebKit) to mitigate UI spoofing. Connected advisories show WebKitGTK/WebKit fixes: Debian/Ubuntu advisories (CVE-2...

CVE-2023-38598

CVE-2023-38598 is a use-after-free in Apple operating system components that was addressed via memory-management fixes. The vulnerability can lead to arbitrary code execution with kernel privileges and is fixed in multiple Apple OS versions: watchOS 9.6, macOS Big Sur 11.7.9, macOS Monterey 12.6....

CVE-2022-26981

Liblouis up to version 3.21.0 is affected by a buffer overflow in compilePassOpcode within compileTranslationTable.c (indirectly via tools/lou_checktable.c). The issue lies in Liblouis 3.21.0 and earlier, with the vulnerable code path being invoked during translation table compilation. The effect...