CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (2026-10-19 22:10 UTC)

What this means for you

This week: 5,331 CVEs published, 344 critical, and 8 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 5,331; Show in the list
Critical, last 7 days: 344; Show in the list
Healthcare-tagged, last 7 days: 5; Show in the list
Known exploited (CISA KEV): 1,748; Show in the list

Showing CVEs that name the product apple:macos. Show all products

1,013 CVEs, showing 901 to 950PreviousPage 19 of 21Next

CVE	Severity	Title	Published
CVE-2022-48618 Known exploited	High 7.0	The issue was addressed with improved checks. Assigned by apple	Jan 9, 2024
CVE-2023-48795	Medium 5.9	The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from… Assigned by mitre	Dec 18, 2023
CVE-2023-45866	Medium 6.3	Bluetooth HID Hosts in BlueZ may permit an unauthenticated Peripheral role HID Device to initiate and establish an encrypted connection, and accept HID keyboard reports, potentially permitting inject…	Dec 8, 2023
CVE-2023-42917 Known exploited	High 8.8	A memory corruption vulnerability was addressed with improved locking. Assigned by apple	Nov 30, 2023
CVE-2023-42916 Known exploited	Medium 6.5	An out-of-bounds read was addressed with improved input validation. Assigned by apple	Nov 30, 2023
CVE-2023-41074	High 8.8	The issue was addressed with improved checks.	Sep 27, 2023
CVE-2023-41993 Known exploited	High 8.8	The issue was addressed with improved checks. Assigned by apple	Sep 21, 2023
CVE-2023-41992 Known exploited	High 7.8	The issue was addressed with improved checks. Assigned by apple	Sep 21, 2023
CVE-2023-41991 Known exploited	Medium 5.5	A certificate validation issue was addressed. Assigned by apple	Sep 21, 2023
CVE-2023-41990 Known exploited	High 7.8	The issue was addressed with improved handling of caches. Assigned by apple	Sep 11, 2023
CVE-2023-41064 Known exploited	High 7.8	A buffer overflow issue was addressed with improved memory handling. Assigned by apple	Sep 7, 2023
CVE-2022-48503 Known exploited	High 8.8	The issue was addressed with improved bounds checks. Assigned by apple	Aug 14, 2023
CVE-2023-38606 Known exploited	Medium 5.5	This issue was addressed with improved state management. Assigned by apple	Jul 26, 2023
CVE-2023-37450 Known exploited	High 8.8	The issue was addressed with improved checks. Assigned by apple	Jul 26, 2023
CVE-2023-32439 Known exploited	High 8.8	A type confusion issue was addressed with improved checks. Assigned by apple	Jun 23, 2023
CVE-2023-32435 Known exploited	High 8.8	A memory corruption issue was addressed with improved state management. Assigned by apple	Jun 23, 2023
CVE-2023-32434 Known exploited	High 7.8	An integer overflow was addressed with improved input validation. Assigned by apple	Jun 23, 2023
CVE-2023-32409 Known exploited	High 8.6	The issue was addressed with improved bounds checks. Assigned by apple	Jun 23, 2023
CVE-2023-32373 Known exploited	High 8.8	A use-after-free issue was addressed with improved memory management. Assigned by apple	Jun 23, 2023
CVE-2023-28204 Known exploited	Medium 6.5	An out-of-bounds read was addressed with improved input validation. Assigned by apple	Jun 23, 2023
CVE-2023-2953	High 7.5	A vulnerability was found in openldap. Assigned by redhat	May 30, 2023
CVE-2023-28206 Known exploited	High 8.6	An out-of-bounds write issue was addressed with improved input validation. Assigned by apple	Apr 10, 2023
CVE-2023-28205 Known exploited	High 8.8	A use after free issue was addressed with improved memory management. Assigned by apple	Apr 10, 2023
CVE-2023-23529 Known exploited	High 8.8	A type confusion issue was addressed with improved checks. Assigned by apple	Feb 27, 2023
CVE-2022-43552	Medium 5.9	A use after free vulnerability exists in curl <7.87.0. Assigned by hackerone	Feb 9, 2023
CVE-2022-42856 Known exploited	High 8.8	A type confusion issue was addressed with improved state handling. Assigned by apple	Dec 15, 2022
CVE-2022-35260	Medium 6.5	curl can be told to parse a `.netrc` file for credentials. Assigned by hackerone	Dec 5, 2022
CVE-2022-32221	Critical 9.8	When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same han… Assigned by hackerone	Dec 5, 2022
CVE-2022-40304	High 7.8	An issue was discovered in libxml2 before 2.10.3. Assigned by mitre	Nov 23, 2022
CVE-2022-40303	High 7.5	An issue was discovered in libxml2 before 2.10.3. Assigned by mitre	Nov 22, 2022
CVE-2022-42915	High 8.1	curl before 7.86.0 has a double free. Assigned by mitre	Oct 29, 2022
CVE-2022-42916	High 7.5	In curl before 7.86.0, the HSTS check could be bypassed to trick it into staying with HTTP. Assigned by mitre	Oct 29, 2022
CVE-2022-35252	Low 3.7	When curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control codes that when later are sent back to a HTTPserver might make the server return 400 responses. Assigned by hackerone	Sep 23, 2022
CVE-2022-32917 Known exploited	High 7.8	The issue was addressed with improved bounds checks. Assigned by apple	Sep 20, 2022
CVE-2022-32894 Known exploited	High 7.8	An out-of-bounds write issue was addressed with improved bounds checking. Assigned by apple	Aug 24, 2022
CVE-2022-32893 Known exploited	High 8.8	An out-of-bounds write issue was addressed with improved bounds checking. Assigned by apple	Aug 24, 2022
CVE-2022-37434	Critical 9.8	zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. Assigned by mitre	Aug 5, 2022
CVE-2022-2294 Known exploited	High 8.8	Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Assigned by Chrome	Jul 28, 2022
CVE-2022-32208	Medium 5.9	When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. Assigned by hackerone	Jul 7, 2022
CVE-2022-32207	Critical 9.8	When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporary name to the final target file name.In… Assigned by hackerone	Jul 7, 2022
CVE-2022-32205	Medium 4.3	A malicious server can serve excessive amounts of `Set-Cookie:` headers in a HTTP response to curl and curl < 7.84.0 stores all of them. Assigned by hackerone	Jul 7, 2022
CVE-2022-2126	High 7.8	Out-of-bounds Read in vim/vim Assigned by @huntrdev	Jun 19, 2022
CVE-2022-2125	High 7.8	Heap-based Buffer Overflow in vim/vim Assigned by @huntrdev	Jun 19, 2022
CVE-2022-2124	High 7.8	Buffer Over-read in vim/vim Assigned by @huntrdev	Jun 19, 2022
CVE-2022-2042	High 7.4	Use After Free in vim/vim Assigned by @huntrdev	Jun 10, 2022
CVE-2022-22675 Known exploited	High 7.8	An out-of-bounds write issue was addressed with improved bounds checking. Assigned by apple	May 26, 2022
CVE-2022-22674 Known exploited	Medium 5.5	An out-of-bounds read issue existed that led to the disclosure of kernel memory. Assigned by apple	May 26, 2022
CVE-2022-1674	Medium 6.6	NULL Pointer Dereference in function vim_regexec_string at regexp.c:2733 in vim/vim Assigned by @huntrdev	May 12, 2022
CVE-2022-1620	Medium 6.6	NULL Pointer Dereference in function vim_regexec_string at regexp.c:2729 in vim/vim Assigned by @huntrdev	May 8, 2022
CVE-2022-1619	Medium 6.1	Heap-based Buffer Overflow in function cmdline_erase_chars in vim/vim Assigned by @huntrdev	May 8, 2022

PreviousPage 19 of 21Next

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.