Filtered by CWE-284
Filtered by vendor Subscriptions
Total 5040 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2025-43294 1 Apple 1 Macos 2026-04-28 3.3 Low
An issue existed in the handling of environment variables. This issue was addressed with improved validation. This issue is fixed in iOS 26.1 and iPadOS 26.1, macOS Tahoe 26, tvOS 26.1, watchOS 26.1. An app may be able to access sensitive user data.
CVE-2025-43328 1 Apple 1 Macos 2026-04-28 3.3 Low
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26. An app may be able to access sensitive user data.
CVE-2026-35172 1 Distribution 1 Distribution 2026-04-28 7.5 High
Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.0, distribution can restore read access in repo a after an explicit delete when storage.cache.blobdescriptor: redis and storage.delete.enabled: true are both enabled. The delete path clears the shared digest descriptor but leaves stale repo-scoped membership behind, so a later Stat or Get from repo b repopulates the shared descriptor and makes the deleted blob readable from repo a again. This vulnerability is fixed in 3.1.0.
CVE-2025-43313 1 Apple 4 Macos, Macos Sequoia, Macos Sonoma and 1 more 2026-04-28 5.5 Medium
A logic issue was addressed with improved restrictions. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app may be able to access sensitive user data.
CVE-2025-10638 1 Wordpress 1 Wordpress 2026-04-28 5.3 Medium
The NS Maintenance Mode for WP WordPress plugin through 1.3.1 lacks authorization in its subscriber export function allowing unauthenticated attackers to download a list of a site's subscribers containing their name and email address
CVE-2025-9544 1 Wordpress 1 Wordpress 2026-04-28 6.5 Medium
The Doppler Forms WordPress plugin through 2.5.1 registers an AJAX action install_extension without verifying user capabilities or using a nonce. As a result, any authenticated user — including those with the Subscriber role — can install and activate additional Doppler Forms WordPress plugin through 2.5.1 (limited to those whitelisted by the main Doppler Forms WordPress plugin through 2.5.1).
CVE-2025-43408 1 Apple 3 Macos, Macos Sequoia, Macos Sonoma 2026-04-28 2.4 Low
This issue was addressed by restricting options offered on a locked device. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1. An attacker with physical access may be able to access contacts from the lock screen.
CVE-2025-43335 1 Apple 3 Macos, Macos Sequoia, Macos Sonoma 2026-04-28 5.5 Medium
The issue was addressed by adding additional logic. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1. An app may be able to access user-sensitive data.
CVE-2025-43476 1 Apple 1 Macos 2026-04-28 7.8 High
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1. An app may be able to break out of its sandbox.
CVE-2025-43499 1 Apple 3 Macos, Macos Sequoia, Macos Sonoma 2026-04-28 5.5 Medium
This issue was addressed with additional entitlement checks. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1. An app may be able to access sensitive user data.
CVE-2025-43477 1 Apple 3 Macos, Macos Sequoia, Macos Sonoma 2026-04-28 5.5 Medium
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1. An app may be able to access sensitive user data.
CVE-2025-43334 1 Apple 3 Macos, Macos Sequoia, Macos Sonoma 2026-04-28 5.5 Medium
This issue was addressed with additional entitlement checks. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1. An app may be able to access user-sensitive data.
CVE-2025-43322 1 Apple 3 Macos, Macos Sequoia, Macos Sonoma 2026-04-28 5.5 Medium
A logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1. An app may be able to access user-sensitive data.
CVE-2025-43396 1 Apple 3 Macos, Macos Sequoia, Macos Sonoma 2026-04-28 5.5 Medium
A logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1. A sandboxed app may be able to access sensitive user data.
CVE-2025-43309 1 Apple 4 Ios, Ipad Os, Ipados and 1 more 2026-04-28 2.4 Low
A logic issue was addressed with improved checks. This issue is fixed in iOS 26 and iPadOS 26. An attacker with physical access to an iOS device may be able to view notification contents from the Lock Screen.
CVE-2025-43407 1 Apple 7 Ios, Ipados, Iphone Os and 4 more 2026-04-28 7.8 High
This issue was addressed with improved entitlements. This issue is fixed in iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1. An app may be able to break out of its sandbox.
CVE-2025-43418 1 Apple 4 Ios, Ipad Os, Ipados and 1 more 2026-04-28 4.6 Medium
This issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1. An attacker with physical access to a locked device may be able to view sensitive user information.
CVE-2025-11855 1 Wordpress 1 Wordpress 2026-04-28 7.5 High
The age-restriction WordPress plugin through 3.0.2 does not have authorisation in the age_restrictionRemoteSupportRequest function, allowing any authenticated users, such as subscriber to create an admin user with a hardcoded username and arbitrary password.
CVE-2025-43393 1 Apple 2 Macos, Macos Tahoe 2026-04-28 5.2 Medium
A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Tahoe 26.1. An app may be able to break out of its sandbox.
CVE-2025-43351 1 Apple 2 Macos, Macos Tahoe 2026-04-28 5.5 Medium
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26.1. An app may be able to access protected user data.