CVE-2022-40303

CVE-2022-40303 affects libxml2 prior to 2.10.3. When parsing multi‑gigabyte XML with XML_PARSE_HUGE enabled, integer counters can overflow and cause an access at a negative 2GB offset, typically leading to a segmentation fault. Public sources (including libxml2‑focused advisories and AWS ALAS/BSN...

CVE-2023-42916

Technical details about CVE-2023-42916 are not provided in the connected documents. Please monitor for updates from official advisories.

CVE-2025-24149

CVE-2025-24149 is an out-of-bounds read resolved by Apple through improved bounds checking. Affected products/versions include iPadOS 17.7.4, iOS 18.3; macOS Ventura 13.7.3, macOS Sonoma 14.7.3, macOS Sequoia 15.3; visionOS 2.3; watchOS 11.3; and tvOS 18.3. The issue could lead to disclosure of u...

CVE-2025-24085

CVE-2025-24085 is a use-after-free in CoreMedia that could allow privilege escalation. It affects Apple platforms (visionOS, iOS, iPadOS, macOS, watchOS, tvOS) and is fixed in the following releases: visionOS 2.3; iOS 18.3; iPadOS 18.3; macOS Sequoia 15.3; watchOS 11.3; tvOS 18.3. The associated ...

CVE-2023-23517

CVE-2023-23517 is a memory corruption vulnerability in WebKitGTK/WebKit that can be triggered by processing malicious web content, potentially allowing arbitrary code execution. The issue is addressed by WebKitGTK/WebKit updates (e.g., WebKitGTK/WebKit fixes referenced in multiple advisories) and...

CVE-2020-13631

CVE-2020-13631 affects SQLite up to version 3.32.0, where a vulnerability allows renaming a virtual table to the name of one of its shadow tables (related to alter.c and build.c). Connected advisories confirm the issue in SQLite prior to 3.32.0 and note the remediation is to upgrade SQLite to 3.3...

CVE-2025-24123

CVE-2025-24123 affects multiple Apple OSes where parsing a file could cause an unexpected app termination. According to the document, the issue is fixed in iPadOS 17.7.4, macOS Ventura 13.7.3, macOS Sonoma 14.7.3, visionOS 2.3, iOS 18.3 and iPadOS 18.3, macOS Sequoia 15.3, watchOS 11.3, and tvOS ...

CVE-2019-20044

CVE-2019-20044 affects zsh prior to 5.8. An attacker who can run commands and is able to execute zmodload via MODULE_PATH can restore original privileges that were dropped by --no-PRIVILEGED, because zsh fails to overwrite the saved uid. This allows privilege escalation to the original user even ...

CVE-2024-23225

CVE-2024-23225 is a memory-corruption vulnerability in Apple’s kernel that could allow an attacker with local access and kernel read/write capabilities to bypass kernel memory protections. The issue is addressed by patches in iOS 16.7.6 / iPadOS 16.7.6 and iOS 17.4 / iPadOS 17.4. Apple’s advisory...

CVE-2024-44308

CVE-2024-44308 affects WebKit-derived components (Apple WebKit in Safari and WebKitGTK/WebKit2GTK for Linux). The issue, caused by improper handling of maliciously crafted web content, can lead to arbitrary code execution. Public details in the Apple advisory cite a fix in Safari 18.1.1, iOS 18.1...

CVE-2020-13630

CVE-2020-13630 affects SQLite prior to 3.32.0, with a use-after-free in ext/fts3/fts3.c (fts3EvalNextRow) related to the snippet feature. Multiple connected advisories (Astra Linux, BSA, AlmaLinux) confirm the issue in SQLite and reference the same function/file. The provided sources do not quant...

CVE-2023-27932

CVE-2023-27932 affects WebKitGTK/WebKitGTK-based WebKit implementations (notably WebKit2GTK) and is a Same Origin Policy bypass via processing malicious web content. Public advisories in Debian, Fedora, and AlmaLinux confirm this CVE is fixed by updates to webkit2gtk/webkitgtk components (e.g., D...

CVE-2023-23499

The CVE-2023-23499 issue is addressed by enabling hardened runtime and is fixed in macOS Monterey 12.6.3, macOS Ventura 13.2, watchOS 9.3, macOS Big Sur 11.7.3, tvOS 16.3, iOS 16.3, and iPadOS 16.3. Affects Apple platforms where an app could access user-sensitive data, as stated in multiple sourc...

CVE-2023-41074

CVE-2023-41074 is a WebKit-related vulnerability where processing web content may lead to arbitrary code execution. Connected advisories confirm the issue across multiple platforms and ports, notably WebKit-on-Apple ecosystems (Safari/WebKit) and WebKitGTK+-based products. The root cause is descr...

CVE-2025-31200

CVE-2025-31200 affects Apple’s CoreAudio, specifically the AudioConverterService AAC decoder, where a memory corruption issue can lead to code execution when processing a malicious audio stream. Affected products include iOS, iPadOS, macOS, and related OSes prior to the patch, with fixes implemen...

CVE-2020-36330

CVE-2020-36330 describes an out-of-bounds read in libwebp prior to version 1.0.1, triggered in the ChunkVerifyAndAssign function. The documented impact is data confidentiality loss and reduced availability. Public references in the Connected documents corroborate the flaw in libwebp and align wit...

CVE-2021-1844

CVE-2021-1844 is a memory corruption vulnerability in WebKit/WebKitGTK/WebKitGTK-related workflows triggered by processing malicious web content, with potential arbitrary code execution. Affected components include WebKit/WebKitGTK in Apple products (Safari 14.0.3 and iOS/iPadOS/macOS updates) an...

CVE-2020-3868

CVE-2020-3868 involves multiple memory corruption issues that are fixed by improved memory handling. The public advisories indicate the vulnerability could allow arbitrary code execution when processing malicious web content. The documented fixes show updates across Apple platforms: iOS 13.3.1 an...

CVE-2022-40304

CVE-2022-40304: libxml2 before 2.10.3 contains invalid XML entity definitions that can corrupt a hash table key, potentially triggering logic errors and, in at least one case, a double-free. Affected library is libxml2; CVSS v3.1 shows base score 7.8 (HIGH) with LOCAL access, high impact. Public ...

CVE-2025-24252

CVE-2025-24252 is a use-after-free vulnerability in Apple’s AirPlay ecosystem that has multiple PoCs and public PoCs outlining crash/RCe and sandbox-escape chains. Public materials describe a local-network attacker potentially exploiting mDNS/AirPlay services to trigger remote code execution or s...

CVE-2022-3970

LibTIFF vulnerability CVE-2022-3970 affects TIFFReadRGBATileExt in libtiff, causing an integer overflow and enabling remote impact. The issue is publicly disclosed; remediation is to apply the patch referenced as 227500897dfb07fb7d27f7aa570050e62617e3be (no explicit version). Multiple connected a...

CVE-2020-9983

CVE-2020-9983 is a WebKit-related out-of-bounds write vulnerability addressed by multiple vendors. Apple security entries show CVE-2020-9983 as part of the WebKit set fixed in iOS/tvOS/watchOS/macOS updates, with impact noted as arbitrary code execution when processing malicious web content. Fedo...

CVE-2021-1825

CVE-2021-1825 is a WebKit/WebKit-related input validation issue that could enable cross-site scripting when processing malicious web content. Apple’s security content for Safari 14.1 and related WebKit components lists this CVE under WebKit’s input validation and notes it is fixed in Safari 14.1 ...

CVE-2024-54478

CVE-2024-54478 is an out-of-bounds access vulnerability in Apple’s ICU component that affects multiple Apple platforms. The issue arises when processing malicious web content, potentially causing an unexpected process crash. Affected products include iPadOS, iPadOS 18.2, iOS 18.2, visionOS, tvOS,...

CVE-2023-38580

CVE-2023-38580 affects Apple platforms and is fixed in iOS 16.6, iPadOS 16.6, macOS Ventura 13.5, and watchOS 9.6. The issue comes from memory handling that may allow an app to execute arbitrary code with kernel privileges. This is resolved by updates listed above; no exploitation details are pro...

CVE-2021-1788

CVE-2021-1788 : A use-after-free in WebKitGTK/WebKit leads to arbitrary code execution when processing malicious web content. Fixes are documented in macOS/iOS/Safari updates (macOS Big Sur 11.2, Security Update 2021-001 Catalina, Mojave; Safari 14.0.3; iOS 14.4; tvOS 14.4; watchOS 7.3), and in W...

CVE-2020-9805

CVE-2020-9805 is a WebKit/Web content handling issue reported by an anonymous researcher, fixed in Apple platforms. The connected Apple security entries show a logic issue in WebKit that could lead to universal cross-site scripting when processing maliciously crafted web content. Apple patch refe...

CVE-2023-42852

CVE-2023-42852 is a WebKitGTK/WebKitGTK4 vulnerability described as a logic issue where processing web content may lead to arbitrary code execution. Affected products include the WebKitGTK/WebKitGTK4 stack; the issue is fixed in WebKitGTK/WebKitGTK4 updates (examples: AL2 ALAS advisory references...

CVE-2023-40408

CVE-2023-40408 is an Apple product issue described as an inconsistent user interface problem addressed by improved state management. The NVD entry notes the patch is included in macOS Sonoma 14.1, watchOS 10.1, iOS 16.7.2 and iPadOS 16.7.2, and iOS 17.1/iPadOS 17.1, with Hide My Email potentially...

CVE-2023-38603

CVE-2023-38603 affects Apple platforms (iOS/iPadOS/macOS) with a remote DoS possibility. The description indicates issue was addressed by improved checks and is fixed in iOS 16.6, iPadOS 16.6, and macOS Ventura 13.5. The exact component/function and root cause are not provided in the documents. U...

CVE-2019-8820

CVE-2019-8820 is a WebKit vulnerability described as multiple memory corruption issues that could allow arbitrary code execution when processing malicious web content. The connected notes confirm the issue is present in WebKit components and was fixed in a range of Apple platforms/releases: iOS 1...

CVE-2023-23505

CVE-2023-23505 describes a privacy issue where an app could access information about a user’s contacts due to insufficient private data redaction in log entries. Affected products include Apple platforms: macOS Monterey 12.6.3, macOS Ventura 13.2, macOS Big Sur 11.7.3, watchOS 9.3, iOS 15.7.3 and...

CVE-2020-9806

CVE-2020-9806 is a WebKit memory-corruption defect reported in multiple Apple security advisories. The issue affects WebKit components underlying Safari and system web content handling, with impact described as arbitrary code execution when processing maliciously crafted web content. Remediation ...

CVE-2020-9850

CVE-2020-9850 is a WebKit logic issue that allowed arbitrary code execution in affected Apple products (iOS 13.5, iPadOS 13.5, tvOS 13.4.5, watchOS 6.2.5, Safari 13.1.1, iTunes/iCloud Windows) and upstream WebKit/WebKitGTK. The issue was fixed in WebKit/WebKitGTK versions released around 2020 (Ap...

CVE-2023-41983

CVE-2023-41983 is a WebKitGTK/WebKitGTK4 memory-handling related DoS vulnerability. Connected advisories show the issue affects WebKitGTK/WebKitGTK4 components and is fixed by newer builds (e.g., webkitgtk4 2.42.3-3.amzn2.0.1.x86_64 in AL2, and corresponding WebKitGTK updates in other distributio...

CVE-2023-32734

CVE-2023-32734 affects Apple platforms (iOS/iPadOS 16.6, tvOS 16.6, macOS Ventura 13.5, watchOS 9.6). The root cause is improved memory handling that could allow an app to execute arbitrary code with kernel privileges. The vulnerability is addressed in the listed updates (iOS 16.6/iPadOS 16.6, tv...

CVE-2025-6558

CVE-2025-6558 involves insufficient validation of untrusted input in ANGLE and GPU within Google Chrome, enabling a remote attacker to potentially escape the sandbox via a crafted HTML page. Connected sources specify Chrome components ANGLE and GPU as affected, with the patch previously shipped i...

CVE-2020-9803

CVE-2020-9803 is a memory corruption flaw disclosed as affecting processing of malicious web content, leading to arbitrary code execution. The Connected documents confirm it is addressed by an upstream WebKit fix and by Apple platform updates. Specifically: Apple pages (iOS 13.5/iPadOS 13.5, tvOS...

CVE-2023-35993

CVE-2023-35993 is a use-after-free vulnerability affecting Apple's platforms (macOS, iOS, iPadOS, tvOS, watchOS) where an app may execute arbitrary code with kernel privileges. The issue stems from incorrect memory management and is fixed in specific releases: macOS Monterey 12.6.8, macOS Big Sur...

CVE-2020-9951

CVE-2020-9951 is a WebKit use-after-free vulnerability in Safari (WebKit GTK also mirrors related WebKit issues). Exploitation requires a victim to visit a specially crafted web site, potentially enabling arbitrary code execution on affected Apple platforms. The issue is addressed in Safari/WebKi...

CVE-2021-30849

CVE-2021-30849 is a WebKit/WebKitGTK family issue reporting multiple memory corruption defects that could allow arbitrary code execution when processing malicious web content. Publicly documented fixes cover WebKitGTK/WebKit in Apple platforms (iOS 14.8/iPadOS 14.8, watchOS 8, Safari 15, tvOS 15,...

CVE-2023-41990

The CVE-2023-41990 issue affects Apple platforms (iOS, iPadOS, macOS, tvOS, watchOS) and was triggered by processing a font file, with the root cause tied to cache handling. It can lead to arbitrary code execution and is rated high severity (local access, user interaction required) per the report...

CVE-2020-9925

CVE-2020-9925 concerns a logic issue in WebKit that affects Safari/WebKit components across Apple platforms. The vulnerability could allow universal cross-site scripting when processing malicious web content. Apple patched this by updating to iOS 13.6/iPadOS 13.6, tvOS 13.4.8, watchOS 6.2.8, Safa...

CVE-2019-8846

CVE-2019-8846 is a use-after-free vulnerability in WebKit-related components that can lead to arbitrary code execution when handling malicious web content. The issue was addressed with improved memory management and is fixed in several Apple platforms: tvOS 13.3, iOS/iPadOS 13.3, Safari 13.0.4, a...

CVE-2020-9843

CVE-2020-9843 is a WebKit/WebKitGTK issue described as an input validation weakness that may lead to cross-site scripting when processing malicious web content. The vulnerability is documented across multiple platforms: Apple: WebKit-related entries in iOS 13.5/iPadOS 13.5/watchOS 6.2.5/Safari 13...

CVE-2020-3867

CVE-2020-3867 is a WebKitGTK/WebKit vulnerability categorized as a logic issue in state management that could enable universal cross-site scripting when processing malicious web content. According to the documents, the issue affects WebKitGTK/WebKit components (notably webkitgtk4) and was fixed i...

CVE-2020-36329

CVE-2020-36329 is a libwebp use-after-free vulnerability present in versions before 1.0.1, caused by a thread being killed too early. The impact can affect data confidentiality, integrity, and system availability. Remediation is via updates/patches provided by distributions; notable fixes include...

CVE-2020-9895

CVE-2020-9895 is a use-after-free in memory management that Apple fixed across multiple platforms. Fixed in iOS 13.6, iPadOS 13.6, tvOS 13.4.8, watchOS 6.2.8, Safari 13.1.2, iTunes 12.10.8 for Windows, and iCloud for Windows 11.3/7.20. The issue could allow remote code execution or cause arbitrar...

CVE-2025-24124

CVE-2025-24124 affects several Apple platforms. The vulnerability involves a parsing issue that may cause an unexpected app termination. Mitigation is available via updates: iPadOS 17.7.4, iOS 18.3, iPadOS 18.3, macOS Ventura 13.7.3, macOS Sonoma 14.7.3, macOS Sequoia 15.3, visionOS 2.3, watchOS ...

CVE-2020-9894

CVE-2020-9894 affects WebKit in Windows 10+ (via Microsoft Store) with an out-of-bounds read addressed by improved input validation. Impact: remote termination or arbitrary code execution. Remediation: apply the relevant Apple/Safari security updates (Safari 13.1.2; iOS 13.6/iPadOS 13.6; Safari m...