Apple macOS vulnerabilities
3,438 known vulnerabilities affecting apple/macos.
Total CVEs
3,438
CISA KEV
75
actively exploited
Public exploits
68
Exploited in wild
116
Severity breakdown
CRITICAL204HIGH1438MEDIUM1494LOW151UNKNOWN151
Vulnerabilities
Page 5 of 172
CVE-2022-42864P1HIGHCVSS 7.0ExploitedPoCfixed in 11.7.2≥ 12.0, < 12.6.2+2 more2022-12-15
CVE-2022-42864 [HIGH] CWE-362 CVE-2022-42864: A race condition was addressed with improved state handling. This issue is fixed in tvOS 16.2, macOS
A race condition was addressed with improved state handling. This issue is fixed in tvOS 16.2, macOS Monterey 12.6.2, macOS Ventura 13.1, macOS Big Sur 11.7.2, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.2 and iPadOS 16.2, watchOS 9.2. An app may be able to execute arbitrary code with kernel privileges.
nvd
CVE-2018-5383P1MEDIUMCVSS 6.8ExploitedRansomware≥ 10.13 High Sierra, < 10.13.62018-08-07
CVE-2018-5383 [MEDIUM] CWE-325 CVE-2018-5383: Bluetooth firmware or operating system software drivers in macOS versions before 10.13, High Sierra
Bluetooth firmware or operating system software drivers in macOS versions before 10.13, High Sierra and iOS versions before 11.4, and Android versions before the 2018-06-05 patch may not sufficiently validate elliptic curve parameters used to generate public keys during a Diffie-Hellman key exchange, which may allow a remote attacker to obtain the encr
nvd
CVE-2022-46691P1HIGHCVSS 8.8Exploitedfixed in 13.12022-12-15
CVE-2022-46691 [HIGH] CWE-787 CVE-2022-46691: A memory consumption issue was addressed with improved memory handling. This issue is fixed in Safar
A memory consumption issue was addressed with improved memory handling. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Processing maliciously crafted web content may lead to arbitrary code execution.
nvd
CVE-2022-46700P1HIGHCVSS 8.8Exploitedv13.02022-12-15
CVE-2022-46700 [HIGH] CWE-787 CVE-2022-46700: A memory corruption issue was addressed with improved input validation. This issue is fixed in Safar
A memory corruption issue was addressed with improved input validation. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Processing maliciously crafted web content may lead to arbitrary code execution.
nvd
CVE-2022-46692P1MEDIUMCVSS 5.5Exploitedfixed in 13.12022-12-15
CVE-2022-46692 [MEDIUM] CWE-345 CVE-2022-46692: A logic issue was addressed with improved state management. This issue is fixed in Safari 16.2, tvOS
A logic issue was addressed with improved state management. This issue is fixed in Safari 16.2, tvOS 16.2, iCloud for Windows 14.1, iOS 15.7.2 and iPadOS 15.7.2, macOS Ventura 13.1, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Processing maliciously crafted web content may bypass Same Origin Policy.
nvd
CVE-2023-23496P1HIGHCVSS 8.8Exploitedfixed in 13.2≥ unspecified, < 13.22023-02-27
CVE-2023-23496 [HIGH] CWE-94 CVE-2023-23496: The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.2, watchOS 9.3
The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.2, watchOS 9.3, iOS 15.7.2 and iPadOS 15.7.2, Safari 16.3, tvOS 16.3, iOS 16.3 and iPadOS 16.3. Processing maliciously crafted web content may lead to arbitrary code execution.
nvd
CVE-2022-46690P1HIGHCVSS 7.8Exploitedfixed in 13.12022-12-15
CVE-2022-46690 [HIGH] CWE-787 CVE-2022-46690: An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in iO
An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 13.1, tvOS 16.2, watchOS 9.2. An app may be able to execute arbitrary code with kernel privileges.
nvd
CVE-2022-42855P1HIGHCVSS 7.1Exploitedfixed in 12.6.2v13.02022-12-15
CVE-2022-42855 [HIGH] CWE-269 CVE-2022-42855: A logic issue was addressed with improved state management. This issue is fixed in tvOS 16.2, macOS
A logic issue was addressed with improved state management. This issue is fixed in tvOS 16.2, macOS Monterey 12.6.2, macOS Ventura 13.1, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.2 and iPadOS 16.2. An app may be able to use arbitrary entitlements.
nvd
CVE-2020-9870P1HIGHCVSS 8.8Exploited≥ unspecified, < macOS Catalina 10.15.62020-10-16
CVE-2020-9870 [HIGH] CWE-20 CVE-2020-9870: A logic issue was addressed with improved validation. This issue is fixed in iOS 13.6 and iPadOS 13.
A logic issue was addressed with improved validation. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, tvOS 13.4.8. An attacker with memory write capability may be able to bypass pointer authentication codes and run arbitrary code.
nvd
CVE-2022-46695P1MEDIUMCVSS 6.5Exploitedfixed in 13.12022-12-15
CVE-2022-46695 [MEDIUM] CWE-1021 CVE-2022-46695: A spoofing issue existed in the handling of URLs. This issue was addressed with improved input valid
A spoofing issue existed in the handling of URLs. This issue was addressed with improved input validation. This issue is fixed in tvOS 16.2, macOS Ventura 13.1, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Visiting a website that frames malicious content may lead to UI spoofing.
nvd
CVE-2021-30737P1HIGHCVSS 8.8Exploited≥ 11.0.1, < 11.4≥ unspecified, < 11.4+4 more2021-09-08
CVE-2021-30737 [HIGH] CWE-787 CVE-2021-30737: A memory corruption issue in the ASN.1 decoder was addressed by removing the vulnerable code. This i
A memory corruption issue in the ASN.1 decoder was addressed by removing the vulnerable code. This issue is fixed in tvOS 14.6, Security Update 2021-004 Mojave, iOS 14.6 and iPadOS 14.6, iOS 12.5.4, Security Update 2021-003 Catalina, macOS Big Sur 11.4, watchOS 7.5. Processing a maliciously crafted certificate may lead to arbitrary code execution.
nvd
CVE-2022-42840P1HIGHCVSS 7.8Exploited≥ 11.0, < 11.7.2≥ 12.0.0, < 12.6.2+6 more2022-12-15
CVE-2022-42840 [HIGH] CWE-787 CVE-2022-42840: The issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.6.2,
The issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.6.2, macOS Ventura 13.1, macOS Big Sur 11.7.2, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.2 and iPadOS 16.2. An app may be able to execute arbitrary code with kernel privileges.
nvd
CVE-2022-40303P2HIGHCVSS 7.5Exploited≥ 11.0, < 11.7.2≥ 12.0, < 12.6.22022-11-23
CVE-2022-40303 [HIGH] CWE-190 CVE-2022-40303: An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with th
An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the XML_PARSE_HUGE parser option enabled, several integer counters can overflow. This results in an attempt to access an array at a negative 2GB offset, typically leading to a segmentation fault.
nvd
CVE-2022-42852P1MEDIUMCVSS 6.5Exploitedv13.02022-12-15
CVE-2022-42852 [MEDIUM] CWE-200 CVE-2022-42852: The issue was addressed with improved memory handling. This issue is fixed in Safari 16.2, tvOS 16.2
The issue was addressed with improved memory handling. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Processing maliciously crafted web content may result in the disclosure of process memory.
nvd
CVE-2022-42837P2CRITICALCVSS 9.8Exploitedv13.0≥ unspecified, < 13.1+2 more2022-12-15
CVE-2022-42837 [CRITICAL] CWE-20 CVE-2022-42837: An issue existed in the parsing of URLs. This issue was addressed with improved input validation. Th
An issue existed in the parsing of URLs. This issue was addressed with improved input validation. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 13.1, iOS 15.7.2 and iPadOS 15.7.2, watchOS 9.2. A remote user may be able to cause unexpected app termination or arbitrary code execution.
nvd
CVE-2022-40304P2HIGHCVSS 7.8Exploited≥ 11.0, < 11.7.2≥ 12.0, < 12.6.22022-11-23
CVE-2022-40304 [HIGH] CWE-415 CVE-2022-40304: An issue was discovered in libxml2 before 2.10.3. Certain invalid XML entity definitions can corrupt
An issue was discovered in libxml2 before 2.10.3. Certain invalid XML entity definitions can corrupt a hash table key, potentially leading to subsequent logic errors. In one case, a double-free can be provoked.
nvd
CVE-2021-1801P1MEDIUMCVSS 6.5Exploited≥ 11.0.1, < 11.2≥ unspecified, < 11.2+2 more2021-04-02
CVE-2021-1801 [MEDIUM] CVE-2021-1801: This issue was addressed with improved iframe sandbox enforcement. This issue is fixed in macOS Big
This issue was addressed with improved iframe sandbox enforcement. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, watchOS 7.3, tvOS 14.4, iOS 14.4 and iPadOS 14.4. Maliciously crafted web content may violate iframe sandboxing policy.
nvd
CVE-2021-1765P1MEDIUMCVSS 6.5Exploited≥ 11.0, < 11.2≥ unspecified, < 11.22021-04-02
CVE-2021-1765 [MEDIUM] CVE-2021-1765: This issue was addressed with improved iframe sandbox enforcement. This issue is fixed in macOS Big
This issue was addressed with improved iframe sandbox enforcement. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave. Maliciously crafted web content may violate iframe sandboxing policy.
nvd
CVE-2023-32402P1MEDIUMCVSS 6.5Exploited≥ 13.0, < 13.4≥ unspecified, < 13.42023-06-23
CVE-2023-32402 [MEDIUM] CWE-125 CVE-2023-32402: An out-of-bounds read was addressed with improved input validation. This issue is fixed in watchOS 9
An out-of-bounds read was addressed with improved input validation. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, Safari 16.5, iOS 16.5 and iPadOS 16.5. Processing web content may disclose sensitive information.
nvd
CVE-2023-23514P2HIGHCVSS 7.8Exploited≥ 13.0, < 13.2.1≥ unspecified, < 13.3+3 more2023-02-27
CVE-2023-23514 [HIGH] CWE-416 CVE-2023-23514: A use after free issue was addressed with improved memory management. This issue is fixed in macOS V
A use after free issue was addressed with improved memory management. This issue is fixed in macOS Ventura 13.3, macOS Monterey 12.6.4, iOS 16.3.1 and iPadOS 16.3.1, macOS Ventura 13.2.1, macOS Big Sur 11.7.5. An app may be able to execute arbitrary code with kernel privileges.
nvd