CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (2026-10-19 05:50 UTC)

What this means for you

This week: 5,436 CVEs published, 357 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 5,436; Show in the list
Critical, last 7 days: 357; Show in the list
Healthcare-tagged, last 7 days: 4; Show in the list
Known exploited (CISA KEV): 1,747; Show in the list

Showing CVEs that name the product apple:macos. Show all products

1,012 CVEs, showing 1 to 50Page 1 of 21Next

CVE	Severity	Title	Published
CVE-2013-0340	Medium 6.8	expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of s… Assigned by redhat	Jan 21, 2014
CVE-2019-6223 Known exploited	High 7.5	A logic issue existed in the handling of Group FaceTime calls. Assigned by apple	Mar 5, 2019
CVE-2019-8526 Known exploited	High 7.8	A use after free issue was addressed with improved memory management. Assigned by apple	Dec 18, 2019
CVE-2019-7286 Known exploited	High 7.8	A memory corruption issue was addressed with improved input validation. Assigned by apple	Dec 18, 2019
CVE-2019-8605 Known exploited	High 7.8	A use after free issue was addressed with improved memory management. Assigned by apple	Dec 18, 2019
CVE-2020-3837 Known exploited	High 7.8	A memory corruption issue was addressed with improved memory handling. Assigned by apple	Feb 27, 2020
CVE-2020-13434	Medium 5.5	SQLite through 3.32.0 has an integer overflow in sqlite3_str_vappendf in printf.c. Assigned by mitre	May 24, 2020
CVE-2020-13631	Medium 5.5	SQLite before 3.32.0 allows a virtual table to be renamed to the name of one of its shadow tables, related to alter.c and build.c. Assigned by mitre	May 27, 2020
CVE-2020-13630	High 7.0	ext/fts3/fts3.c in SQLite before 3.32.0 has a use-after-free in fts3EvalNextRow, related to the snippet feature. Assigned by mitre	May 27, 2020
CVE-2020-9859 Known exploited	High 7.8	A memory consumption issue was addressed with improved memory handling. Assigned by apple	Jun 5, 2020
CVE-2020-14155	Medium 5.3	libpcre in PCRE before 8.44 allows an integer overflow via a large number after a (?C substring. Assigned by mitre	Jun 15, 2020
CVE-2019-20838	High 7.5	libpcre in PCRE before 8.43 allows a subject buffer over-read in JIT when UTF is disabled, and \X or \R has more than one fixed quantifier, a related issue to CVE-2019-20454. Assigned by mitre	Jun 15, 2020
CVE-2020-15358	Medium 5.5	In SQLite before 3.32.3, select.c mishandles query-flattener optimization, leading to a multiSelectOrderBy heap overflow because of misuse of transitive properties for constant propagation. Assigned by mitre	Jun 27, 2020
CVE-2020-9934 Known exploited	Medium 5.5	An issue existed in the handling of environment variables. Assigned by apple	Oct 16, 2020
CVE-2020-27932 Known exploited	High 7.8	A type confusion issue was addressed with improved state handling. Assigned by apple	Dec 8, 2020
CVE-2020-27950 Known exploited	Medium 5.5	A memory initialization issue was addressed. Assigned by apple	Dec 8, 2020
CVE-2020-27930 Known exploited	High 7.8	A memory corruption issue was addressed with improved input validation. Assigned by apple	Dec 8, 2020
CVE-2020-8284	Low 3.7	A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and this way potentially make curl extract information about ser… Assigned by hackerone	Dec 14, 2020
CVE-2020-8285	High 7.5	curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack overflow issue in FTP wildcard match parsing. Assigned by hackerone	Dec 14, 2020
CVE-2020-8286	High 7.5	curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verification of the OCSP response. Assigned by hackerone	Dec 14, 2020
CVE-2020-36223	High 7.5	A flaw was discovered in OpenLDAP before 2.4.57 leading to a slapd crash in the Values Return Filter control handling, resulting in denial of service (double free and out-of-bounds read). Assigned by mitre	Jan 25, 2021
CVE-2020-36227	High 7.5	A flaw was discovered in OpenLDAP before 2.4.57 leading to an infinite loop in slapd with the cancel_extop Cancel operation, resulting in denial of service. Assigned by mitre	Jan 25, 2021
CVE-2020-36230	High 7.5	A flaw was discovered in OpenLDAP before 2.4.57 leading in an assertion failure in slapd in the X.509 DN parsing in decode.c ber_next_element, resulting in denial of service. Assigned by mitre	Jan 25, 2021
CVE-2020-36229	High 7.5	A flaw was discovered in ldap_X509dn2bv in OpenLDAP before 2.4.57 leading to a slapd crash in the X.509 DN parsing in ad_keystring, resulting in denial of service. Assigned by mitre	Jan 25, 2021
CVE-2020-36228	High 7.5	An integer underflow was discovered in OpenLDAP before 2.4.57 leading to a slapd crash in the Certificate List Exact Assertion processing, resulting in denial of service. Assigned by mitre	Jan 25, 2021
CVE-2020-36226	High 7.5	A flaw was discovered in OpenLDAP before 2.4.57 leading to a memch->bv_len miscalculation and slapd crash in the saslAuthzTo processing, resulting in denial of service. Assigned by mitre	Jan 25, 2021
CVE-2020-36225	High 7.5	A flaw was discovered in OpenLDAP before 2.4.57 leading to a double free and slapd crash in the saslAuthzTo processing, resulting in denial of service. Assigned by mitre	Jan 25, 2021
CVE-2020-36224	High 7.5	A flaw was discovered in OpenLDAP before 2.4.57 leading to an invalid pointer free and slapd crash in the saslAuthzTo processing, resulting in denial of service. Assigned by mitre	Jan 25, 2021
CVE-2020-36222	High 7.5	A flaw was discovered in OpenLDAP before 2.4.57 leading to an assertion failure in slapd in the saslAuthzTo validation, resulting in denial of service. Assigned by mitre	Jan 25, 2021
CVE-2020-36221	High 7.5	An integer underflow was discovered in OpenLDAP before 2.4.57 leading to slapd crashes in the Certificate Exact Assertion processing, resulting in denial of service (schema_init.c serialNumberAndIssu… Assigned by mitre	Jan 25, 2021
CVE-2021-1782 Known exploited	High 7.0	A race condition was addressed with improved locking. Assigned by apple	Apr 2, 2021
CVE-2021-1789 Known exploited	High 8.8	A type confusion issue was addressed with improved state handling. Assigned by apple	Apr 2, 2021
CVE-2021-1870 Known exploited	Critical 9.8	A logic issue was addressed with improved restrictions. Assigned by apple	Apr 2, 2021
CVE-2021-1871 Known exploited	Critical 9.8	A logic issue was addressed with improved restrictions. Assigned by apple	Apr 2, 2021
CVE-2020-25709	High 7.5	A flaw was found in OpenLDAP. Assigned by redhat	May 18, 2021
CVE-2021-22925	Medium 5.3	curl supports the `-t` command line option, known as `CURLOPT_TELNETOPTIONS`in libcurl. Assigned by hackerone	Aug 5, 2021
CVE-2021-36690	High 7.5	A segmentation fault can occur in the sqlite3.exe command-line component of SQLite 3.36.0 via the idxGetTableInfo function when there is a crafted SQL query. Assigned by mitre	Aug 24, 2021
CVE-2021-30858 Known exploited	High 8.8	A use after free issue was addressed with improved memory management. Assigned by apple	Aug 24, 2021
CVE-2021-30860 Known exploited	High 7.8	An integer overflow was addressed with improved input validation. Assigned by apple	Aug 24, 2021
CVE-2021-30869 Known exploited	High 7.8	A type confusion issue was addressed with improved state handling. Assigned by apple	Aug 24, 2021
CVE-2021-30883 Known exploited	High 7.8	A memory corruption issue was addressed with improved memory handling. Assigned by apple	Aug 24, 2021
CVE-2021-30900 Known exploited	High 7.8	An out-of-bounds write issue was addressed with improved bounds checking. Assigned by apple	Aug 24, 2021
CVE-2021-30952 Known exploited	High 8.8	An integer overflow was addressed with improved input validation. Assigned by apple	Aug 24, 2021
CVE-2021-31010 Known exploited	High 7.5	A deserialization issue was addressed through improved validation. Assigned by apple	Aug 24, 2021
CVE-2021-30665 Known exploited	High 8.8	A memory corruption issue was addressed with improved state management. Assigned by apple	Sep 8, 2021
CVE-2021-30713 Known exploited	High 7.8	A permissions issue was addressed with improved validation. Assigned by apple	Sep 8, 2021
CVE-2021-30661 Known exploited	High 8.8	A use after free issue was addressed with improved memory management. Assigned by apple	Sep 8, 2021
CVE-2021-30657 Known exploited	Medium 5.5	A logic issue was addressed with improved state management. Assigned by apple	Sep 8, 2021
CVE-2021-30663 Known exploited	High 7.8	An integer overflow was addressed with improved input validation. Assigned by apple	Sep 8, 2021
CVE-2021-39537	High 8.8	An issue was discovered in ncurses through v6.2-1. Assigned by mitre	Sep 20, 2021

Page 1 of 21Next

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.