Filtered by vendor Apple Subscriptions
Total 13097 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2025-61819 3 Adobe, Apple, Microsoft 3 Photoshop, Macos, Windows 2025-12-11 7.8 High
Photoshop Desktop versions 26.8.1 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2025-61834 3 Adobe, Apple, Microsoft 3 Substance 3d Stager, Macos, Windows 2025-12-11 7.8 High
Substance3D - Stager versions 3.1.5 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2025-64531 3 Adobe, Apple, Microsoft 3 Substance 3d Stager, Macos, Windows 2025-12-11 7.8 High
Substance3D - Stager versions 3.1.5 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2025-61833 3 Adobe, Apple, Microsoft 3 Substance 3d Stager, Macos, Windows 2025-12-11 7.8 High
Substance3D - Stager versions 3.1.5 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2025-61835 3 Adobe, Apple, Microsoft 3 Substance 3d Stager, Macos, Windows 2025-12-11 7.8 High
Substance3D - Stager versions 3.1.5 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2024-6387 13 Almalinux, Amazon, Apple and 10 more 85 Almalinux, Amazon Linux, Macos and 82 more 2025-12-11 8.1 High
A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.
CVE-2025-43376 1 Apple 7 Ios, Ipados, Iphone Os and 4 more 2025-12-11 7.5 High
A logic issue was addressed with improved state management. This issue is fixed in Safari 26, tvOS 26, watchOS 26, iOS 26 and iPadOS 26, visionOS 26. A remote attacker may be able to view leaked DNS queries with Private Relay turned on.
CVE-2025-5471 2 Apple, Yandex 2 Macos, Yandex Telemost 2025-12-10 N/A
Uncontrolled Search Path Element vulnerability in Yandex Telemost on MacOS allows Search Order Hijacking.This issue affects Telemost: before 2.19.1.
CVE-2025-5470 2 Apple, Yandex 2 Macos, Disk 2025-12-10 N/A
Uncontrolled Search Path Element vulnerability in Yandex Disk on MacOS allows Search Order Hijacking.This issue affects Disk: before 3.2.45.3275.
CVE-2025-5469 2 Apple, Yandex 2 Macos, Messenger 2025-12-10 N/A
Uncontrolled Search Path Element vulnerability in Yandex Messenger on MacOS allows Search Order Hijacking.This issue affects Telemost: before 2.245
CVE-2025-64894 3 Adobe, Apple, Microsoft 3 Dng Software Development Kit, Macos, Windows 2025-12-10 5.5 Medium
DNG SDK versions 1.7.0 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could lead to application denial-of-service. An attacker could exploit this issue to cause the application to crash or become unresponsive. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2025-64784 3 Adobe, Apple, Microsoft 3 Dng Software Development Kit, Macos, Windows 2025-12-10 7.1 High
DNG SDK versions 1.7.0 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could lead to memory exposure or application denial of service. An attacker could leverage this vulnerability to disclose sensitive memory information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2025-64783 3 Adobe, Apple, Microsoft 3 Dng Software Development Kit, Macos, Windows 2025-12-10 7.8 High
DNG SDK versions 1.7.0 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2025-64893 3 Adobe, Apple, Microsoft 3 Dng Software Development Kit, Macos, Windows 2025-12-10 7.1 High
DNG SDK versions 1.7.0 and earlier are affected by an Out-of-bounds Read vulnerability that could lead to memory exposure or application denial of service. An attacker could leverage this vulnerability to disclose sensitive information stored in memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2025-13639 4 Apple, Google, Linux and 1 more 4 Macos, Chrome, Linux Kernel and 1 more 2025-12-08 8.1 High
Inappropriate implementation in WebRTC in Google Chrome prior to 143.0.7499.41 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: Low)
CVE-2025-66270 3 Apple, Google, Kde 6 Ios, Android, Gsconnect and 3 more 2025-12-08 4.7 Medium
The KDE Connect protocol 8 before 2025-11-28 does not correlate device IDs across two packets. This affects KDE Connect before 25.12 on desktop, KDE Connect before 0.5.4 on iOS, KDE Connect before 1.34.4 on Android, GSConnect before 68, and Valent before 1.0.0.alpha.49.
CVE-2025-32900 3 Apple, Google, Kde 6 Ios, Android, Gsconnect and 3 more 2025-12-08 4.3 Medium
In the KDE Connect information-exchange protocol before 2025-04-18, a packet can be crafted to temporarily change the displayed information about a device, because broadcast UDP is used. This affects KDE Connect before 1.33.0 on Android, KDE Connect before 25.04 on desktop, KDE Connect before 0.5 on iOS, Valent before 1.0.0.alpha.47, and GSConnect before 59.
CVE-2025-32898 3 Apple, Google, Kde 6 Ios, Android, Gsconnect and 3 more 2025-12-08 4.7 Medium
The KDE Connect verification-code protocol before 2025-04-18 uses only 8 characters and therefore allows brute-force attacks. This affects KDE Connect before 1.33.0 on Android, KDE Connect before 25.04 on desktop, KDE Connect before 0.5 on iOS, Valent before 1.0.0.alpha.47, and GSConnect before 59.
CVE-2025-66555 2 Airkeyboardapp, Apple 2 Airkeyboard Ios App, Ios 2025-12-08 N/A
AirKeyboard iOS App 1.0.5 contains a missing authentication vulnerability that allows unauthenticated attackers to type arbitrary keystrokes directly into the victim's iOS device in real-time without user interaction, resulting in full remote input control.
CVE-2025-5317 2 Apple, Bitdefender 3 Macos, Endpoint Security, Endpoint Security Tools 2025-12-08 5.5 Medium
An improper access restriction to a folder in Bitdefender Endpoint Security Tools for Mac (BEST) before 7.20.52.200087 allows local users with administrative privileges to bypass the configured uninstall password protection. An unauthorized user with sudo privileges can manually remove the application directory (/Applications/Endpoint Security for Mac.app/) and the related directories within /Library/Bitdefender/AVP without needing the uninstall password.