CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (2026-10-19 08:40 UTC)

What this means for you

This week: 5,437 CVEs published, 355 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 5,437; Show in the list
Critical, last 7 days: 355; Show in the list
Healthcare-tagged, last 7 days: 4; Show in the list
Known exploited (CISA KEV): 1,747; Show in the list

Showing CVEs that name the product apple:macos. Show all products

1,012 CVEs, showing 51 to 100PreviousPage 2 of 21Next

CVE	Severity	Title	Published
CVE-2021-22945	Critical 9.1	When sending data to an MQTT server, libcurl <= 7.73.0 and 7.78.0 could in some circumstances erroneously keep a pointer to an already freed memory area and both use that again in a subsequent call t… Assigned by hackerone	Sep 23, 2021
CVE-2021-22947	Medium 5.9	When curl >= 7.20.0 and <= 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrade to TLS security, the server can respond and send back multiple responses at once that c… Assigned by hackerone	Sep 29, 2021
CVE-2021-22946	High 7.5	A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server (`--ssl-reqd` on the command line or`CURLOPT_USE_SSL` set to `CURLUSES… Assigned by hackerone	Sep 29, 2021
CVE-2021-30807 Known exploited	High 7.8	A memory corruption issue was addressed with improved memory handling. Assigned by apple	Oct 19, 2021
CVE-2021-4136	High 7.3	Heap-based Buffer Overflow in vim/vim Assigned by @huntrdev	Dec 19, 2021
CVE-2021-4166	High 7.1	Out-of-bounds Read in vim/vim Assigned by @huntrdev	Dec 25, 2021
CVE-2022-0351	High 8.4	Access of Memory Location Before Start of Buffer in vim/vim Assigned by @huntrdev	Jan 25, 2022
CVE-2022-0530	Medium 5.5	A flaw was found in Unzip. Assigned by redhat	Feb 9, 2022
CVE-2022-23308	High 7.5	valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes. Assigned by mitre	Feb 26, 2022
CVE-2022-22587 Known exploited	Critical 9.8	A memory corruption issue was addressed with improved input validation. Assigned by apple	Mar 18, 2022
CVE-2022-22620 Known exploited	High 8.8	A use after free issue was addressed with improved memory management. Assigned by apple	Mar 18, 2022
CVE-2018-25032	High 7.5	zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches. Assigned by mitre	Mar 25, 2022
CVE-2022-1616	High 7.3	Use after free in append_command in vim/vim Assigned by @huntrdev	May 7, 2022
CVE-2022-1620	Medium 6.6	NULL Pointer Dereference in function vim_regexec_string at regexp.c:2729 in vim/vim Assigned by @huntrdev	May 8, 2022
CVE-2022-1619	Medium 6.1	Heap-based Buffer Overflow in function cmdline_erase_chars in vim/vim Assigned by @huntrdev	May 8, 2022
CVE-2022-1674	Medium 6.6	NULL Pointer Dereference in function vim_regexec_string at regexp.c:2733 in vim/vim Assigned by @huntrdev	May 12, 2022
CVE-2022-22674 Known exploited	Medium 5.5	An out-of-bounds read issue existed that led to the disclosure of kernel memory. Assigned by apple	May 26, 2022
CVE-2022-22675 Known exploited	High 7.8	An out-of-bounds write issue was addressed with improved bounds checking. Assigned by apple	May 26, 2022
CVE-2022-2042	High 7.4	Use After Free in vim/vim Assigned by @huntrdev	Jun 10, 2022
CVE-2022-2126	High 7.8	Out-of-bounds Read in vim/vim Assigned by @huntrdev	Jun 19, 2022
CVE-2022-2125	High 7.8	Heap-based Buffer Overflow in vim/vim Assigned by @huntrdev	Jun 19, 2022
CVE-2022-2124	High 7.8	Buffer Over-read in vim/vim Assigned by @huntrdev	Jun 19, 2022
CVE-2022-32208	Medium 5.9	When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. Assigned by hackerone	Jul 7, 2022
CVE-2022-32207	Critical 9.8	When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporary name to the final target file name.In… Assigned by hackerone	Jul 7, 2022
CVE-2022-32205	Medium 4.3	A malicious server can serve excessive amounts of `Set-Cookie:` headers in a HTTP response to curl and curl < 7.84.0 stores all of them. Assigned by hackerone	Jul 7, 2022
CVE-2022-2294 Known exploited	High 8.8	Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Assigned by Chrome	Jul 28, 2022
CVE-2022-37434	Critical 9.8	zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. Assigned by mitre	Aug 5, 2022
CVE-2022-32894 Known exploited	High 7.8	An out-of-bounds write issue was addressed with improved bounds checking. Assigned by apple	Aug 24, 2022
CVE-2022-32893 Known exploited	High 8.8	An out-of-bounds write issue was addressed with improved bounds checking. Assigned by apple	Aug 24, 2022
CVE-2022-32917 Known exploited	High 7.8	The issue was addressed with improved bounds checks. Assigned by apple	Sep 20, 2022
CVE-2022-35252	Low 3.7	When curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control codes that when later are sent back to a HTTPserver might make the server return 400 responses. Assigned by hackerone	Sep 23, 2022
CVE-2022-42915	High 8.1	curl before 7.86.0 has a double free. Assigned by mitre	Oct 29, 2022
CVE-2022-42916	High 7.5	In curl before 7.86.0, the HSTS check could be bypassed to trick it into staying with HTTP. Assigned by mitre	Oct 29, 2022
CVE-2022-40303	High 7.5	An issue was discovered in libxml2 before 2.10.3. Assigned by mitre	Nov 22, 2022
CVE-2022-40304	High 7.8	An issue was discovered in libxml2 before 2.10.3. Assigned by mitre	Nov 23, 2022
CVE-2022-35260	Medium 6.5	curl can be told to parse a `.netrc` file for credentials. Assigned by hackerone	Dec 5, 2022
CVE-2022-32221	Critical 9.8	When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same han… Assigned by hackerone	Dec 5, 2022
CVE-2022-42856 Known exploited	High 8.8	A type confusion issue was addressed with improved state handling. Assigned by apple	Dec 15, 2022
CVE-2022-43552	Medium 5.9	A use after free vulnerability exists in curl <7.87.0. Assigned by hackerone	Feb 9, 2023
CVE-2023-23529 Known exploited	High 8.8	A type confusion issue was addressed with improved checks. Assigned by apple	Feb 27, 2023
CVE-2023-28206 Known exploited	High 8.6	An out-of-bounds write issue was addressed with improved input validation. Assigned by apple	Apr 10, 2023
CVE-2023-28205 Known exploited	High 8.8	A use after free issue was addressed with improved memory management. Assigned by apple	Apr 10, 2023
CVE-2023-2953	High 7.5	A vulnerability was found in openldap. Assigned by redhat	May 30, 2023
CVE-2023-32439 Known exploited	High 8.8	A type confusion issue was addressed with improved checks. Assigned by apple	Jun 23, 2023
CVE-2023-32435 Known exploited	High 8.8	A memory corruption issue was addressed with improved state management. Assigned by apple	Jun 23, 2023
CVE-2023-32434 Known exploited	High 7.8	An integer overflow was addressed with improved input validation. Assigned by apple	Jun 23, 2023
CVE-2023-32409 Known exploited	High 8.6	The issue was addressed with improved bounds checks. Assigned by apple	Jun 23, 2023
CVE-2023-32373 Known exploited	High 8.8	A use-after-free issue was addressed with improved memory management. Assigned by apple	Jun 23, 2023
CVE-2023-28204 Known exploited	Medium 6.5	An out-of-bounds read was addressed with improved input validation. Assigned by apple	Jun 23, 2023
CVE-2023-37450 Known exploited	High 8.8	The issue was addressed with improved checks. Assigned by apple	Jul 26, 2023

PreviousPage 2 of 21Next

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.