Filtered by vendor Apple Subscriptions
Filtered by product Macos Subscriptions
Total 6298 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2022-42916 5 Apple, Fedoraproject, Haxx and 2 more 5 Macos, Fedora, Curl and 2 more 2026-02-13 7.5 High
In curl before 7.86.0, the HSTS check could be bypassed to trick it into staying with HTTP. Using its HSTS support, curl can be instructed to use HTTPS directly (instead of using an insecure cleartext HTTP step) even when HTTP is provided in the URL. This mechanism could be bypassed if the host name in the given URL uses IDN characters that get replaced with ASCII counterparts as part of the IDN conversion, e.g., using the character UTF-8 U+3002 (IDEOGRAPHIC FULL STOP) instead of the common ASCII full stop of U+002E (.). The earliest affected version is 7.77.0 2021-05-26.
CVE-2022-32221 6 Apple, Debian, Haxx and 3 more 16 Macos, Debian Linux, Curl and 13 more 2026-02-13 9.8 Critical
When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle previously was used to issue a `PUT` request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the subsequent `POST` request. The problem exists in the logic for a reused handle when it is changed from a PUT to a POST.
CVE-2025-53950 3 Apple, Fortinet, Microsoft 4 Macos, Fortidlp, Fortidlp Agent and 1 more 2026-01-14 5.1 Medium
An Exposure of Private Personal Information ('Privacy Violation') vulnerability [CWE-359] in Fortinet FortiDLP Agent's Outlookproxy plugin for MacOS and Windows 11.5.1 and 11.4.2 through 11.4.6 and 11.3.2 through 11.3.4 and 11.2.0 through 11.2.3 and 11.1.1. through 11.1.2 and 11.0.1 and 10.5.1 and 10.4.0, and 10.3.1 may allow an authenticated administrator to collect current user's email information.
CVE-2025-54658 2 Apple, Fortinet 3 Macos, Fortidlp, Fortidlp Agent 2026-01-14 7.2 High
An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability [CWE-22] in Fortinet FortiDLP Agent's Outlookproxy plugin for MacOS 11.5.1 and 11.4.2 through 11.4.6 and 11.3.2 through 11.3.4 and 11.2.0 through 11.2.3 and 11.1.1 through 11.1.2 and 11.0.1 and 10.5.1 and 10.4.0, and 10.3.1 may allow an authenticated attacker to escalate their privilege to Root via sending a crafted request to a local listening port.
CVE-2023-32409 1 Apple 6 Ipados, Iphone Os, Macos and 3 more 2026-01-14 8.6 High
The issue was addressed with improved bounds checks. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, iOS 15.7.8 and iPadOS 15.7.8, Safari 16.5, iOS 16.5 and iPadOS 16.5. A remote attacker may be able to break out of Web Content sandbox. Apple is aware of a report that this issue may have been actively exploited.
CVE-2025-64738 2 Apple, Zoom 6 Macos, Meeting Software Development Kit, Workplace and 3 more 2026-01-13 5 Medium
External control of file name or path in Zoom Workplace for macOS before version 6.5.10 may allow an authenticated user to conduct a disclosure of information via local access.
CVE-2025-55311 3 Apple, Foxit, Microsoft 4 Macos, Pdf Editor, Pdf Reader and 1 more 2026-01-07 6.5 Medium
An issue was discovered in Foxit PDF and Editor for Windows and macOS before 13.2 and 2025 before 2025.2. A crafted PDF can use JavaScript to alter annotation content and subsequently clear the file's modification status via JavaScript interfaces. This circumvents digital signature verification by hiding document modifications, allowing an attacker to mislead users about the document's integrity and compromise the trustworthiness of signed PDFs.
CVE-2025-55309 3 Apple, Foxit, Microsoft 4 Macos, Pdf Editor, Pdf Reader and 1 more 2026-01-06 6.7 Medium
An issue was discovered in Foxit PDF and Editor for Windows and macOS before 13.2 and 2025 before 2025.2. A crafted PDF can contain JavaScript that attaches an OnBlur action on a form field that destroys an annotation. During user right-click interaction, the program's internal focus change handling prematurely releases the annotation object, resulting in a use-after-free vulnerability that may cause memory corruption or application crashes.
CVE-2025-66723 3 Apple, Inmusicbrands, Microsoft 3 Macos, Engine Dj Desktop, Windows 2026-01-05 7.5 High
inMusic Brands Engine DJ before 4.3.4 suffers from Insecure Permissions due to exposed HTTP service in the Remote Library, which allows attackers to access all files and network paths.
CVE-2025-12843 2 Apple, Waveterm 3 Macos, Wave Terminal, Waveterm 2026-01-05 5.5 Medium
Code Injection using Electron Fuses in waveterm on MacOS allows TCC Bypass. This issue affects waveterm: 0.12.2.
CVE-2024-46060 2 Anaconda, Apple 2 Anaconda3, Macos 2026-01-05 7.8 High
Anaconda3 macOS installers before 2024.06-1 contain a local privilege escalation vulnerability when installed outside the user's home directory. During installation, world-writable files are created and executed with root privileges. This allows a local low-privileged user to inject arbitrary commands, leading to code execution as the root user.
CVE-2024-46062 3 Anaconda, Apple, Conda 3 Miniconda3, Macos, Miniconda3 2026-01-05 7.8 High
Miniconda3 macOS installers before 23.11.0-1 contain a local privilege escalation vulnerability when installed outside the user's home directory. During installation, world-writable files are created and executed with root privileges. This flaw allows a local low-privileged user to inject arbitrary commands, leading to code execution as the root user.
CVE-2025-65741 2 Apple, Sublimetext 2 Macos, Sublime Text 3 2026-01-03 9.8 Critical
Sublime Text 3 Build 3208 or prior for MacOS is vulnerable to Dylib Injection. An attacker could compile a .dylib file and force the execution of this library in the context of the Sublime Text application.
CVE-2025-67461 2 Apple, Zoom 3 Macos, Rooms, Zoom 2025-12-30 5 Medium
External control of file name or path in Zoom Rooms for macOS before version 6.6.0 may allow an authenticated user to conduct a disclosure of information via local access.
CVE-2025-52842 3 Apple, Laundry Project, Linux 3 Macos, Laundry, Linux Kernel 2025-12-23 6.1 Medium
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Laundry on Linux, MacOS allows Account Takeover. This issue affects Laundry: 2.3.0.
CVE-2025-52841 3 Apple, Laundry Project, Linux 3 Macos, Laundry, Linux Kernel 2025-12-23 8.8 High
Cross-Site Request Forgery (CSRF) vulnerability in Laundry on Linux, MacOS allows to perform an Account Takeover. This issue affects Laundry: 2.3.0.
CVE-2025-66499 5 Apple, Foxit, Foxit Software and 2 more 7 Macos, Pdf Editor, Pdf Reader and 4 more 2025-12-23 7.8 High
A heap-based buffer overflow vulnerability exists in the PDF parsing of Foxit PDF Reader when processing specially crafted JBIG2 data. An integer overflow in the calculation of the image buffer size may occur, potentially allowing a remote attacker to execute arbitrary code.
CVE-2025-66497 4 Apple, Foxit, Foxitsoftware and 1 more 5 Macos, Pdf Editor, Pdf Reader and 2 more 2025-12-23 5.3 Medium
A memory corruption vulnerability exists in the 3D annotation handling of Foxit PDF Reader due to insufficient bounds checking when parsing PRC data. When opening a PDF file containing malformed or specially crafted PRC content, out-of-bounds memory access may occur, resulting in memory corruption.
CVE-2025-66495 5 Apple, Foxit, Foxit Software and 2 more 7 Macos, Pdf Editor, Pdf Reader and 4 more 2025-12-23 7.8 High
A use-after-free vulnerability exists in the annotation handling of Foxit PDF Reader before 2025.2.1, 14.0.1, and 13.2.1 on Windows and MacOS. When opening a PDF containing specially crafted JavaScript, a pointer to memory that has already been freed may be accessed or dereferenced, potentially allowing a remote attacker to execute arbitrary code.
CVE-2025-10751 2 Apple, Macenhance 2 Macos, Macforge 2025-12-22 7.8 High
MacForge contains an insecure XPC service that allows local, unprivileged users to escalate their privileges to root.This issue affects MacForge: 1.2.0 Beta 1.