Apple Safari vulnerabilities

1,719 known vulnerabilities affecting apple/safari.

Total CVEs

1,719

CISA KEV

actively exploited

Public exploits

168

Exploited in wild

Severity breakdown

CRITICAL211HIGH637MEDIUM821LOW22UNKNOWN28

Vulnerabilities

SortPage 36 of 86

CVE-2011-0218P3CRITICALCVSS 9.3≤ 5.0.5v1.0+54 more2011-07-21

CVE-2011-0218 [CRITICAL] CWE-119 CVE-2011-0218: WebKit, as used in Apple Safari before 5.0.6, allows remote attackers to execute arbitrary code or c WebKit, as used in Apple Safari before 5.0.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2011-07-20-1.

nvd

CVE-2011-0238P3CRITICALCVSS 9.3≤ 5.0.5v1.0+54 more2011-07-21

CVE-2011-0238 [CRITICAL] CWE-119 CVE-2011-0238: WebKit, as used in Apple Safari before 5.0.6, allows remote attackers to execute arbitrary code or c WebKit, as used in Apple Safari before 5.0.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2011-07-20-1.

nvd

CVE-2011-0225P3CRITICALCVSS 9.3≤ 5.0.5v1.0+54 more2011-07-21

CVE-2011-0225 [CRITICAL] CWE-119 CVE-2011-0225: WebKit, as used in Apple Safari before 5.0.6, allows remote attackers to execute arbitrary code or c WebKit, as used in Apple Safari before 5.0.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2011-07-20-1.

nvd

CVE-2011-0221P3CRITICALCVSS 9.3≤ 5.0.5v1.0+54 more2011-07-21

CVE-2011-0221 [CRITICAL] CWE-119 CVE-2011-0221: WebKit, as used in Apple Safari before 5.0.6, allows remote attackers to execute arbitrary code or c WebKit, as used in Apple Safari before 5.0.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2011-07-20-1.

nvd

CVE-2011-1462P3CRITICALCVSS 9.3≤ 5.0.5v1.0+54 more2011-07-21

CVE-2011-1462 [CRITICAL] CWE-119 CVE-2011-1462: WebKit, as used in Apple Safari before 5.0.6, allows remote attackers to execute arbitrary code or c WebKit, as used in Apple Safari before 5.0.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2011-07-20-1.

nvd

CVE-2011-0232P3CRITICALCVSS 9.3≤ 5.0.5v1.0+54 more2011-07-21

CVE-2011-0232 [CRITICAL] CWE-119 CVE-2011-0232: WebKit, as used in Apple Safari before 5.0.6, allows remote attackers to execute arbitrary code or c WebKit, as used in Apple Safari before 5.0.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2011-07-20-1.

nvd

CVE-2011-1453P3CRITICALCVSS 9.3≤ 5.0.5v1.0+54 more2011-07-21

CVE-2011-1453 [CRITICAL] CWE-119 CVE-2011-1453: WebKit, as used in Apple Safari before 5.0.6, allows remote attackers to execute arbitrary code or c WebKit, as used in Apple Safari before 5.0.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2011-07-20-1.

nvd

CVE-2011-0234P3CRITICALCVSS 9.3≤ 5.0.5v1.0+54 more2011-07-21

CVE-2011-0234 [CRITICAL] CWE-119 CVE-2011-0234: WebKit, as used in Apple Safari before 5.0.6, allows remote attackers to execute arbitrary code or c WebKit, as used in Apple Safari before 5.0.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2011-07-20-1.

nvd

CVE-2011-1457P3CRITICALCVSS 9.3≤ 5.0.5v1.0+54 more2011-07-21

CVE-2011-1457 [CRITICAL] CWE-119 CVE-2011-1457: WebKit, as used in Apple Safari before 5.0.6, allows remote attackers to execute arbitrary code or c WebKit, as used in Apple Safari before 5.0.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2011-07-20-1.

nvd

CVE-2011-0254P3CRITICALCVSS 9.3≤ 5.0.5v1.0+54 more2011-07-21

CVE-2011-0254 [CRITICAL] CWE-119 CVE-2011-0254: WebKit, as used in Apple Safari before 5.0.6, allows remote attackers to execute arbitrary code or c WebKit, as used in Apple Safari before 5.0.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2011-07-20-1.

nvd

CVE-2017-2376P3HIGHCVSS 7.5≤ 10.0.32017-04-02

CVE-2017-2376 [HIGH] CVE-2017-2376: An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 i An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. The issue involves the "Safari" component. It allows remote attackers to spoof the address bar by leveraging text input during the loading of a page.

nvdapple

CVE-2010-0048P3HIGHCVSS 8.8≤ 4.0.4v4.0+3 more2010-03-15

CVE-2010-0048 [HIGH] CWE-399 CVE-2010-0048: Use-after-free vulnerability in WebKit in Apple Safari before 4.0.5 allows remote attackers to execu Use-after-free vulnerability in WebKit in Apple Safari before 4.0.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted XML document.

nvd

CVE-2016-7613P3HIGHCVSS 7.8≤ 10.0.02017-02-20

CVE-2016-7613 [HIGH] CWE-264 CVE-2016-7613: An issue was discovered in certain Apple products. iOS before 10.1 is affected. macOS before 10.12.1 An issue was discovered in certain Apple products. iOS before 10.1 is affected. macOS before 10.12.1 is affected. tvOS before 10.0.1 is affected. watchOS before 3.1 is affected. The issue involves the "Kernel" component. It allows attackers to execute arbitrary code in a privileged context via a crafted app that leverages object-lifetime mishandling dur

nvd

CVE-2025-43480P3HIGHCVSS 8.1fixed in 26.12025-11-04

CVE-2025-43480 [HIGH] CWE-942 CVE-2025-43480: The issue was addressed with improved checks. This issue is fixed in Safari 26.1, iOS 26.1 and iPadO The issue was addressed with improved checks. This issue is fixed in Safari 26.1, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. A malicious website may exfiltrate data cross-origin.

nvdapple

CVE-2026-64713P3HIGHCVSS 8.1fixed in 26.62026-07-27

CVE-2026-64713 [HIGH] CWE-203 CVE-2026-64713: This issue was addressed with improved checks. This issue is fixed in Safari 26.6, iOS 26.6 and iPad This issue was addressed with improved checks. This issue is fixed in Safari 26.6, iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. Websites may know if the user has visited a given link.

nvd

CVE-2018-4277P3HIGHCVSS 7.5fixed in 11.1.12019-01-11

CVE-2018-4277 [HIGH] CWE-20 CVE-2018-4277: In iOS before 11.4.1, watchOS before 4.3.2, tvOS before 11.4.1, Safari before 11.1.1, macOS High Sie In iOS before 11.4.1, watchOS before 4.3.2, tvOS before 11.4.1, Safari before 11.1.1, macOS High Sierra before 10.13.6, a spoofing issue existed in the handling of URLs. This issue was addressed with improved input validation.

nvdapple

CVE-2020-9911P3HIGHCVSS 7.5fixed in 13.1.2≥ unspecified, < Safari 13.1.22020-10-16

CVE-2020-9911 [HIGH] CVE-2020-9911: A logic issue was addressed with improved restrictions. This issue is fixed in iOS 13.6 and iPadOS 1 A logic issue was addressed with improved restrictions. This issue is fixed in iOS 13.6 and iPadOS 13.6, Safari 13.1.2. An issue in Safari Reader mode may allow a remote attacker to bypass the Same Origin Policy.

nvdapple

CVE-2025-7424P3HIGHCVSS 7.5v18.62025-07-30

CVE-2025-7424 [HIGH] CVE-2025-7424: Safari 18.6 Apple Security Update: About the security content of Safari 18.6 Product: Safari Version: 18.6 CVE: CVE-2025-7424 Component: Safari 18.6 Impact: Processing a file may lead to memory corruption Description: This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org.

apple

CVE-2010-1401P3CRITICALCVSS 9.3≤ 4.0.5v4.0+5 more2010-06-11

CVE-2010-1401 [CRITICAL] CWE-399 CVE-2010-1401: Use-after-free vulnerability in the Cascading Style Sheets (CSS) implementation in WebKit in Apple S Use-after-free vulnerability in the Cascading Style Sheets (CSS) implementation in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving the :first-letter pseudo-element.

nvd

CVE-2025-24213P3HIGHCVSS 7.8fixed in 18.4fixed in 18.52025-03-31

CVE-2025-24213 [HIGH] CWE-843 CVE-2025-24213: This issue was addressed with improved handling of floats. This issue is fixed in Safari 18.5, iOS 1 This issue was addressed with improved handling of floats. This issue is fixed in Safari 18.5, iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 15.5, tvOS 18.5, visionOS 2.5, watchOS 11.5. A type confusion issue could lead to memory corruption.

nvdapple

← Previous36 / 86Next →