Apple Safari vulnerabilities

1,719 known vulnerabilities affecting apple/safari.

Total CVEs

1,719

CISA KEV

actively exploited

Public exploits

168

Exploited in wild

Severity breakdown

CRITICAL211HIGH637MEDIUM821LOW22UNKNOWN28

Vulnerabilities

SortPage 37 of 86

CVE-2020-3864P3HIGHCVSS 7.8fixed in 13.0.5≥ unspecified, < 13.02020-10-27

CVE-2020-3864 [HIGH] CWE-346 CVE-2020-3864: A logic issue was addressed with improved validation. This issue is fixed in iCloud for Windows 7.17 A logic issue was addressed with improved validation. This issue is fixed in iCloud for Windows 7.17, iTunes 12.10.4 for Windows, iCloud for Windows 10.9.2, tvOS 13.3.1, Safari 13.0.5, iOS 13.3.1 and iPadOS 13.3.1. A DOM object context may not have had a unique security origin.

nvd

CVE-2017-17821P3CRITICALCVSS 9.8v462017-12-21

CVE-2017-17821 [CRITICAL] CWE-119 CVE-2017-17821: WTF/wtf/FastBitVector.h in WebKit, as distributed in Safari Technology Preview Release 46, allows re WTF/wtf/FastBitVector.h in WebKit, as distributed in Safari Technology Preview Release 46, allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact because it calls the FastBitVectorWordOwner::resizeSlow function (in WTF/wtf/FastBitVector.cpp) for a purpose other than initializing a bitvector

nvd

CVE-2009-1704P3CRITICALCVSS 9.3≤ 4.0_betav0.8+24 more2009-06-10

CVE-2009-1704 [CRITICAL] CWE-94 CVE-2009-1704: CFNetwork in Apple Safari before 4.0 misinterprets downloaded image files as local HTML documents in CFNetwork in Apple Safari before 4.0 misinterprets downloaded image files as local HTML documents in unspecified circumstances, which allows remote attackers to execute arbitrary JavaScript code by placing it in an image file.

nvd

CVE-2026-28962P3HIGHCVSS 7.5fixed in 26.52026-05-11

CVE-2026-28962 [HIGH] CWE-200 CVE-2026-28962: This issue was addressed with improved access restrictions. This issue is fixed in Safari 26.5, iOS This issue was addressed with improved access restrictions. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, visionOS 26.5. Processing maliciously crafted web content may disclose sensitive user information.

nvd

CVE-2009-0321P4MEDIUMCVSS 4.3PoCv3.2.12009-01-28

CVE-2009-0321 [MEDIUM] CWE-59 CVE-2009-0321: Apple Safari 3.2.1 (aka AppVer 3.525.27.1) on Windows allows remote attackers to cause a denial of s Apple Safari 3.2.1 (aka AppVer 3.525.27.1) on Windows allows remote attackers to cause a denial of service (infinite loop or access violation) via a link to an http URI in which the authority (aka hostname) portion is either a (1) . (dot) or (2) .. (dot dot) sequence.

nvd

CVE-2010-1758P3CRITICALCVSS 9.3≤ 4.0.5v4.0+5 more2010-06-11

CVE-2010-1758 [CRITICAL] CWE-399 CVE-2010-1758: Use-after-free vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Use-after-free vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving DOM Range objects.

nvd

CVE-2010-1761P3CRITICALCVSS 9.3≤ 4.0.5v4.0+5 more2010-06-11

CVE-2010-1761 [CRITICAL] CWE-399 CVE-2010-1761: Use-after-free vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Use-after-free vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving HTML document subtrees.

nvd

CVE-2010-1405P3CRITICALCVSS 9.3≤ 4.0.5v4.0+5 more2010-06-11

CVE-2010-1405 [CRITICAL] CWE-399 CVE-2010-1405: Use-after-free vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Use-after-free vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via an HTML element that has custom vertical positioning.

nvd

CVE-2009-1690P3CRITICALCVSS 9.3≤ 4.0_betav0.8+24 more2009-06-10

CVE-2009-1690 [CRITICAL] CWE-399 CVE-2009-1690: Use-after-free vulnerability in WebKit, as used in Apple Safari before 4.0, iPhone OS 1.0 through 2. Use-after-free vulnerability in WebKit, as used in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, iPhone OS for iPod touch 1.1 through 2.2.1, Google Chrome 1.0.154.53, and possibly other products, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) by setting an unspecified

nvd

CVE-2010-1771P3CRITICALCVSS 9.3≤ 4.0.5v4.0+5 more2010-06-11

CVE-2010-1771 [CRITICAL] CWE-399 CVE-2010-1771: Use-after-free vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Use-after-free vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving fonts.

nvd

CVE-2010-1786P3CRITICALCVSS 9.3≤ 5.0v4.0+7 more2010-07-30

CVE-2010-1786 [CRITICAL] CWE-399 CVE-2010-1786: Use-after-free vulnerability in WebKit in Apple Safari before 5.0.1 on Mac OS X 10.5 through 10.6 an Use-after-free vulnerability in WebKit in Apple Safari before 5.0.1 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.1 on Mac OS X 10.4; and webkitgtk before 1.2.6; allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a foreignObject element in an SVG document.

nvd

CVE-2010-0053P3CRITICALCVSS 9.3≤ 4.0.4v4.0+4 more2010-03-15

CVE-2010-0053 [CRITICAL] CWE-399 CVE-2010-0053: Use-after-free vulnerability in WebKit in Apple Safari before 4.0.5 allows remote attackers to execu Use-after-free vulnerability in WebKit in Apple Safari before 4.0.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors related to the run-in Cascading Style Sheets (CSS) display property.

nvd

CVE-2010-0054P3CRITICALCVSS 9.3≤ 4.0.4v4.0+4 more2010-03-15

CVE-2010-0054 [CRITICAL] CWE-399 CVE-2010-0054: Use-after-free vulnerability in WebKit in Apple Safari before 4.0.5 allows remote attackers to execu Use-after-free vulnerability in WebKit in Apple Safari before 4.0.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving HTML IMG elements.

nvd

CVE-2010-3811P3CRITICALCVSS 9.3≤ 5.0.2v5.0+51 more2010-11-22

CVE-2010-3811 [CRITICAL] CWE-399 CVE-2010-3811: Use-after-free vulnerability in WebKit in Apple Safari before 5.0.3 on Mac OS X 10.5 through 10.6 an Use-after-free vulnerability in WebKit in Apple Safari before 5.0.3 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.3 on Mac OS X 10.4, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving element attributes.

nvd

CVE-2010-3816P3CRITICALCVSS 9.3≤ 5.0.2v5.0+51 more2010-11-22

CVE-2010-3816 [CRITICAL] CWE-399 CVE-2010-3816: Use-after-free vulnerability in WebKit in Apple Safari before 5.0.3 on Mac OS X 10.5 through 10.6 an Use-after-free vulnerability in WebKit in Apple Safari before 5.0.3 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.3 on Mac OS X 10.4, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving scrollbars.

nvd

CVE-2010-3818P3CRITICALCVSS 9.3≤ 5.0.2v5.0+51 more2010-11-22

CVE-2010-3818 [CRITICAL] CWE-399 CVE-2010-3818: Use-after-free vulnerability in WebKit in Apple Safari before 5.0.3 on Mac OS X 10.5 through 10.6 an Use-after-free vulnerability in WebKit in Apple Safari before 5.0.3 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.3 on Mac OS X 10.4, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving inline text boxes.

nvd

CVE-2018-4311P3HIGHCVSS 8.1fixed in 122019-04-03

CVE-2018-4311 [HIGH] CWE-200 CVE-2018-4311: The issue was addressed by removing origin information. This issue affected versions prior to iOS 12 The issue was addressed by removing origin information. This issue affected versions prior to iOS 12, watchOS 5, Safari 12, iTunes 12.9 for Windows, iCloud for Windows 7.7.

nvdapple

CVE-2016-4733P3HIGHCVSS 7.8fixed in 10.02016-09-25

CVE-2016-4733 [HIGH] CVE-2016-4733: WebKit in Apple iOS before 10, Safari before 10, and tvOS before 10 allows remote attackers to execu WebKit in Apple iOS before 10, Safari before 10, and tvOS before 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-4611, CVE-2016-4730, CVE-2016-4734, and CVE-2016-4735.

nvdapple

CVE-2012-3674P3CRITICALCVSS 9.3≤ 5.1.7v1.0+75 more2012-07-25

CVE-2012-3674 [CRITICAL] CWE-119 CVE-2012-3674: WebKit, as used in Apple Safari before 6.0, allows remote attackers to execute arbitrary code or cau WebKit, as used in Apple Safari before 6.0, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-07-25-1.

nvd

CVE-2012-3670P3CRITICALCVSS 9.3≤ 5.1.7v1.0+75 more2012-07-25

CVE-2012-3670 [CRITICAL] CWE-119 CVE-2012-3670: WebKit, as used in Apple Safari before 6.0, allows remote attackers to execute arbitrary code or cau WebKit, as used in Apple Safari before 6.0, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-07-25-1.

nvd

← Previous37 / 86Next →