CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (2026-10-19 09:30 UTC)

What this means for you

This week: 5,436 CVEs published, 355 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 5,436; Show in the list
Critical, last 7 days: 355; Show in the list
Healthcare-tagged, last 7 days: 4; Show in the list
Known exploited (CISA KEV): 1,747; Show in the list

Showing CVEs that name the product apple:mac_os_x. Show all products

55 CVEs, showing 1 to 50Page 1 of 2Next

CVE	Severity	Title	Published
CVE-2012-1823 Known exploited	Critical 9.8	sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which al… Assigned by certcc	May 11, 2012
CVE-2014-4404 Known exploited	High 7.8	Heap-based buffer overflow in IOHIDFamily in Apple iOS before 8 and Apple TV before 7 allows attackers to execute arbitrary code in a privileged context via an application that provides crafted key-m… Assigned by apple	Sep 18, 2014
CVE-2014-6271 Known exploited	Critical 9.8	GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, a… Assigned by debian	Sep 24, 2014
CVE-2014-7169 Known exploited	Critical 9.8	GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or poss… Assigned by mitre	Sep 25, 2014
CVE-2015-1130 Known exploited	High 7.8	The XPC implementation in Admin Framework in Apple OS X before 10.10.3 allows local users to bypass authentication and obtain admin privileges via unspecified vectors. Assigned by apple	Apr 10, 2015
CVE-2015-8126	High 7.5	Multiple buffer overflows in the (1) png_set_PLTE and (2) png_get_PLTE functions in libpng before 1.0.64, 1.1.x and 1.2.x before 1.2.54, 1.3.x and 1.4.x before 1.4.17, 1.5.x before 1.5.24, and 1.6.x… Assigned by mitre	Nov 13, 2015
CVE-2016-0718	Critical 9.8	Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a malformed input document, which triggers a buffer overflow. Assigned by redhat	May 26, 2016
CVE-2016-5131	High 8.8	Use-after-free vulnerability in libxml2 through 2.9.4, as used in Google Chrome before 52.0.2743.82, allows remote attackers to cause a denial of service or possibly have unspecified other impact via… Assigned by Chrome	Jul 23, 2016
CVE-2016-4658	Critical 9.8	xpointer.c in libxml2 before 2.9.5 (as used in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3, and other products) does not forbid namespace nodes in XPointer ranges, wh… Assigned by apple	Sep 25, 2016
CVE-2016-9841	Critical 9.8	inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic. Assigned by microfocus	May 23, 2017
CVE-2016-9840	High 8.8	inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic. Assigned by microfocus	May 23, 2017
CVE-2019-8906	Medium 4.4	do_core_note in readelf.c in libmagic.a in file 5.35 has an out-of-bounds read because memcpy is misused. Assigned by mitre	Feb 18, 2019
CVE-2019-6223 Known exploited	High 7.5	A logic issue existed in the handling of Group FaceTime calls. Assigned by apple	Mar 5, 2019
CVE-2018-4344 Known exploited	High 7.8	A memory corruption issue was addressed with improved memory handling. Assigned by apple	Apr 3, 2019
CVE-2019-13057	Medium 4.9	An issue was discovered in the server in OpenLDAP before 2.4.48. Assigned by mitre	Jul 26, 2019
CVE-2019-13565	High 7.5	An issue was discovered in OpenLDAP 2.x before 2.4.48. Assigned by mitre	Jul 26, 2019
CVE-2019-8526 Known exploited	High 7.8	A use after free issue was addressed with improved memory management. Assigned by apple	Dec 18, 2019
CVE-2019-7286 Known exploited	High 7.8	A memory corruption issue was addressed with improved input validation. Assigned by apple	Dec 18, 2019
CVE-2019-8605 Known exploited	High 7.8	A use after free issue was addressed with improved memory management. Assigned by apple	Dec 18, 2019
CVE-2019-19906	High 7.5	cyrus-sasl (aka Cyrus SASL) 2.1.27 has an out-of-bounds write leading to unauthenticated remote denial-of-service in OpenLDAP via a malformed LDAP packet. Assigned by mitre	Dec 19, 2019
CVE-2020-3837 Known exploited	High 7.8	A memory corruption issue was addressed with improved memory handling. Assigned by apple	Feb 27, 2020
CVE-2020-12243	High 7.5	In filter.c in slapd in OpenLDAP before 2.4.50, LDAP search filters with nested boolean expressions can result in denial of service (daemon crash). Assigned by mitre	Apr 28, 2020
CVE-2020-9859 Known exploited	High 7.8	A memory consumption issue was addressed with improved memory handling. Assigned by apple	Jun 5, 2020
CVE-2020-9934 Known exploited	Medium 5.5	An issue existed in the handling of environment variables. Assigned by apple	Oct 16, 2020
CVE-2020-27932 Known exploited	High 7.8	A type confusion issue was addressed with improved state handling. Assigned by apple	Dec 8, 2020
CVE-2020-27930 Known exploited	High 7.8	A memory corruption issue was addressed with improved input validation. Assigned by apple	Dec 8, 2020
CVE-2020-8284	Low 3.7	A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and this way potentially make curl extract information about ser… Assigned by hackerone	Dec 14, 2020
CVE-2020-8285	High 7.5	curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack overflow issue in FTP wildcard match parsing. Assigned by hackerone	Dec 14, 2020
CVE-2020-8286	High 7.5	curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verification of the OCSP response. Assigned by hackerone	Dec 14, 2020
CVE-2020-36223	High 7.5	A flaw was discovered in OpenLDAP before 2.4.57 leading to a slapd crash in the Values Return Filter control handling, resulting in denial of service (double free and out-of-bounds read). Assigned by mitre	Jan 25, 2021
CVE-2020-36230	High 7.5	A flaw was discovered in OpenLDAP before 2.4.57 leading in an assertion failure in slapd in the X.509 DN parsing in decode.c ber_next_element, resulting in denial of service. Assigned by mitre	Jan 25, 2021
CVE-2020-36229	High 7.5	A flaw was discovered in ldap_X509dn2bv in OpenLDAP before 2.4.57 leading to a slapd crash in the X.509 DN parsing in ad_keystring, resulting in denial of service. Assigned by mitre	Jan 25, 2021
CVE-2020-36226	High 7.5	A flaw was discovered in OpenLDAP before 2.4.57 leading to a memch->bv_len miscalculation and slapd crash in the saslAuthzTo processing, resulting in denial of service. Assigned by mitre	Jan 25, 2021
CVE-2020-36224	High 7.5	A flaw was discovered in OpenLDAP before 2.4.57 leading to an invalid pointer free and slapd crash in the saslAuthzTo processing, resulting in denial of service. Assigned by mitre	Jan 25, 2021
CVE-2020-36222	High 7.5	A flaw was discovered in OpenLDAP before 2.4.57 leading to an assertion failure in slapd in the saslAuthzTo validation, resulting in denial of service. Assigned by mitre	Jan 25, 2021
CVE-2020-36221	High 7.5	An integer underflow was discovered in OpenLDAP before 2.4.57 leading to slapd crashes in the Certificate Exact Assertion processing, resulting in denial of service (schema_init.c serialNumberAndIssu… Assigned by mitre	Jan 25, 2021
CVE-2021-1782 Known exploited	High 7.0	A race condition was addressed with improved locking. Assigned by apple	Apr 2, 2021
CVE-2021-1789 Known exploited	High 8.8	A type confusion issue was addressed with improved state handling. Assigned by apple	Apr 2, 2021
CVE-2021-1870 Known exploited	Critical 9.8	A logic issue was addressed with improved restrictions. Assigned by apple	Apr 2, 2021
CVE-2021-1871 Known exploited	Critical 9.8	A logic issue was addressed with improved restrictions. Assigned by apple	Apr 2, 2021
CVE-2020-25709	High 7.5	A flaw was found in OpenLDAP. Assigned by redhat	May 18, 2021
CVE-2021-22925	Medium 5.3	curl supports the `-t` command line option, known as `CURLOPT_TELNETOPTIONS`in libcurl. Assigned by hackerone	Aug 5, 2021
CVE-2021-30860 Known exploited	High 7.8	An integer overflow was addressed with improved input validation. Assigned by apple	Aug 24, 2021
CVE-2021-30869 Known exploited	High 7.8	A type confusion issue was addressed with improved state handling. Assigned by apple	Aug 24, 2021
CVE-2021-31010 Known exploited	High 7.5	A deserialization issue was addressed through improved validation. Assigned by apple	Aug 24, 2021
CVE-2021-30713 Known exploited	High 7.8	A permissions issue was addressed with improved validation. Assigned by apple	Sep 8, 2021
CVE-2021-30657 Known exploited	Medium 5.5	A logic issue was addressed with improved state management. Assigned by apple	Sep 8, 2021
CVE-2021-39537	High 8.8	An issue was discovered in ncurses through v6.2-1. Assigned by mitre	Sep 20, 2021
CVE-2021-4136	High 7.3	Heap-based Buffer Overflow in vim/vim Assigned by @huntrdev	Dec 19, 2021
CVE-2021-4166	High 7.1	Out-of-bounds Read in vim/vim Assigned by @huntrdev	Dec 25, 2021

Page 1 of 2Next

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.