deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-5684
Published: 2025-07-29
Description: The MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `mf-template` DOM Element in all versions up to, and including, 4.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/metform/tags/3.9.9/public/assets/js/app.js; https://www.wordfence.com/threat-intel/vulnerabilities/id/7dded505-8968-4ed2-8883-42a3ec50155c?source=cve
CVE: CVE-2025-40600
Published: 2025-07-29
Description: Use of Externally-Controlled Format String vulnerability in the SonicOS SSL VPN interface allows a remote unauthenticated attacker to cause service disruption.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-134
References: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0013
CVE: CVE-2025-4674
Published: 2025-07-29
Description: The go command may execute unexpected commands when operating in untrusted VCS repositories. This occurs when possibly dangerous VCS configuration is present in repositories. This can happen when a repository was fetched via one VCS (e.g. Git), but contains metadata for another VCS (e.g. Mercurial). Modules which are retrieved using the go command line, i.e. via "go get", are not affected.
CVSS Score: 8.6 (HIGH)
CWE: CWE-73
References: https://go.dev/cl/686515; https://go.dev/issue/74380; https://groups.google.com/g/golang-announce/c/gTNJnDXmn34
CVE: CVE-2025-54126
Published: 2025-07-29
Description: The WebAssembly Micro Runtime's (WAMR) iwasm package is the executable binary built with WAMR VMcore which supports WebAssembly System Interface (WASI) and command line interface. In versions 2.4.0 and below, iwasm uses --addr-pool with an IPv4 address that lacks a subnet mask, allowing the system to accept all IP addresses. This can unintentionally expose the service to all incoming connections and bypass intended access restrictions. Services relying on --addr-pool for restricting access by IP may unintentionally become open to all external connections. This may lead to unauthorized access in production deployments, especially when users assume that specifying an IP without a subnet mask implies a default secure configuration. This is fixed in version 2.4.1.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-668
References: https://github.com/bytecodealliance/wasm-micro-runtime/commit/121232a9957a069bbb04ebda053bdc72ab409e7a; https://github.com/bytecodealliance/wasm-micro-runtime/releases/tag/WAMR-2.4.1; https://github.com/bytecodealliance/wasm-micro-runtime/security/advisories/GHSA-vh64-mfvw-pxqp
CVE: CVE-2025-7361
Published: 2025-07-29
Description: A code injection vulnerability due to an improper initialization check exists in NI LabVIEW that may result in arbitrary code execution.  Successful exploitation requires an attacker to get a user to open a specially crafted VI using a CIN node.  This vulnerability affects 32-bit NI LabVIEW 2025 Q1 and prior versions.  LabVIEW 64-bit versions do not support CIN nodes and are not affected.
CVSS Score: 7.8 (HIGH)
CWE: CWE-94
References: https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/code-injection-vulnerability-in-ni-labview-using-cin-nodes.html
CVE: CVE-2025-7848
Published: 2025-07-29
Description: A memory corruption vulnerability due to improper input validation in lvpict.cpp exists in NI LabVIEW that may result in arbitrary code execution.  Successful exploitation requires an attacker to get a user to open a specially crafted VI.  This vulnerability affects NI LabVIEW 2025 Q1 and prior versions.
CVSS Score: 7.8 (HIGH)
CWE: CWE-1285
References: https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/memory-corruption-vulnerabilities-in-ni-labview.html
CVE: CVE-2025-7849
Published: 2025-07-29
Description: A memory corruption vulnerability due to improper error handling when a VILinkObj is null exists in NI LabVIEW that may result in arbitrary code execution.  Successful exploitation requires an attacker to get a user to open a specially crafted VI.  This vulnerability affects NI LabVIEW 2025 Q1 and prior versions.
CVSS Score: 7.8 (HIGH)
CWE: CWE-1285
References: https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/memory-corruption-vulnerabilities-in-ni-labview.html
CVE: CVE-2025-54381
Published: 2025-07-29
Description: BentoML is a Python library for building online serving systems optimized for AI apps and model inference. In versions 1.4.0 until 1.4.19, the file upload processing system contains an SSRF vulnerability that allows unauthenticated remote attackers to force the server to make arbitrary HTTP requests. The vulnerability stems from the multipart form data and JSON request handlers, which automatically download files from user-provided URLs without validating whether those URLs point to internal network addresses, cloud metadata endpoints, or other restricted resources. The documentation explicitly promotes this URL-based file upload feature, making it an intended design that exposes all deployed services to SSRF attacks by default. Version 1.4.19 contains a patch for the issue.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-918
References: https://github.com/bentoml/BentoML/commit/534c3584621da4ab954bdc3d814cc66b95ae5fb8; https://github.com/bentoml/BentoML/security/advisories/GHSA-mrmq-3q62-6cc8; https://github.com/bentoml/BentoML/security/advisories/GHSA-mrmq-3q62-6cc8
CVE: CVE-2025-24119
Published: 2025-07-30
Description: This issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15.3, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app may be able to execute arbitrary code out of its sandbox or with certain elevated privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://support.apple.com/en-us/122068; https://support.apple.com/en-us/124150; https://support.apple.com/en-us/124151
CVE: CVE-2025-24188
Published: 2025-07-30
Description: A logic issue was addressed with improved checks. This issue is fixed in Safari 18.6, macOS Sequoia 15.6. Processing maliciously crafted web content may lead to an unexpected Safari crash.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-703
References: https://support.apple.com/en-us/124149; https://support.apple.com/en-us/124152; http://seclists.org/fulldisclosure/2025/Aug/0
CVE: CVE-2025-24224
Published: 2025-07-30
Description: The issue was addressed with improved checks. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.9, macOS Sequoia 15.5, macOS Ventura 13.7.7, tvOS 18.5, visionOS 2.5, watchOS 11.5. A remote attacker may be able to cause unexpected system termination.
CVSS Score: 7.5 (HIGH)
CWE: CWE-754
References: https://support.apple.com/en-us/122404; https://support.apple.com/en-us/122716; https://support.apple.com/en-us/122720
CVE: CVE-2025-31229
Published: 2025-07-30
Description: A logic issue was addressed with improved checks. This issue is fixed in iOS 18.6 and iPadOS 18.6. Passcode may be read aloud by VoiceOver.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-261
References: https://support.apple.com/en-us/124147; http://seclists.org/fulldisclosure/2025/Jul/30
CVE: CVE-2025-31243
Published: 2025-07-30
Description: A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app may be able to gain root privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://support.apple.com/en-us/124149; https://support.apple.com/en-us/124150; https://support.apple.com/en-us/124151
CVE: CVE-2025-31273
Published: 2025-07-30
Description: The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, watchOS 11.6. Processing maliciously crafted web content may lead to memory corruption.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: https://support.apple.com/en-us/124147; https://support.apple.com/en-us/124149; https://support.apple.com/en-us/124152
CVE: CVE-2025-31275
Published: 2025-07-30
Description: A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.6. A sandboxed process may be able to launch any installed app.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-274
References: https://support.apple.com/en-us/124149; http://seclists.org/fulldisclosure/2025/Jul/32
CVE: CVE-2025-31276
Published: 2025-07-30
Description: This issue was addressed through improved state management. This issue is fixed in iOS 18.6 and iPadOS 18.6, iPadOS 17.7.9. Remote content may be loaded even when the 'Load Remote Images' setting is turned off.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-359
References: https://support.apple.com/en-us/124147; https://support.apple.com/en-us/124148; http://seclists.org/fulldisclosure/2025/Jul/31
CVE: CVE-2025-31277
Published: 2025-07-30
Description: The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, watchOS 11.6. Processing maliciously crafted web content may lead to memory corruption.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: https://support.apple.com/en-us/124147; https://support.apple.com/en-us/124149; https://support.apple.com/en-us/124152
CVE: CVE-2025-31278
Published: 2025-07-30
Description: The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6, iPadOS 17.7.9, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, watchOS 11.6. Processing maliciously crafted web content may lead to memory corruption.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: https://support.apple.com/en-us/124147; https://support.apple.com/en-us/124148; https://support.apple.com/en-us/124149
CVE: CVE-2025-31279
Published: 2025-07-30
Description: A permissions issue was addressed with additional restrictions. This issue is fixed in iPadOS 17.7.9, macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app may be able to fingerprint the user.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-200
References: https://support.apple.com/en-us/124148; https://support.apple.com/en-us/124149; https://support.apple.com/en-us/124150
CVE: CVE-2025-31280
Published: 2025-07-30
Description: A memory corruption issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.6. Processing a maliciously crafted file may lead to heap corruption.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://support.apple.com/en-us/124149; http://seclists.org/fulldisclosure/2025/Jul/32
CVE: CVE-2025-31281
Published: 2025-07-30
Description: An input validation issue was addressed with improved memory handling. This issue is fixed in iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6. Processing a maliciously crafted file may lead to unexpected app termination.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-20
References: https://support.apple.com/en-us/124147; https://support.apple.com/en-us/124149; https://support.apple.com/en-us/124153
CVE: CVE-2025-43184
Published: 2025-07-30
Description: This issue was addressed by adding an additional prompt for user consent. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. A shortcut may be able to bypass sensitive Shortcuts app settings.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: https://support.apple.com/en-us/122373; https://support.apple.com/en-us/124150; https://support.apple.com/en-us/124151
CVE: CVE-2025-43185
Published: 2025-07-30
Description: A downgrade issue was addressed with additional code-signing restrictions. This issue is fixed in macOS Sequoia 15.6. An app may be able to access protected user data.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-347
References: https://support.apple.com/en-us/124149; http://seclists.org/fulldisclosure/2025/Jul/32
CVE: CVE-2025-43186
Published: 2025-07-30
Description: The issue was addressed with improved memory handling. This issue is fixed in iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7, tvOS 18.6, visionOS 2.6, watchOS 11.6. Parsing a file may lead to an unexpected app termination.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://support.apple.com/en-us/124147; https://support.apple.com/en-us/124149; https://support.apple.com/en-us/124150
CVE: CVE-2025-43188
Published: 2025-07-30
Description: A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.6. A malicious app may be able to gain root privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://support.apple.com/en-us/124149; http://seclists.org/fulldisclosure/2025/Jul/32
CVE: CVE-2025-43189
Published: 2025-07-30
Description: This issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7. A malicious app may be able to read kernel memory.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-200
References: https://support.apple.com/en-us/124149; https://support.apple.com/en-us/124150; http://seclists.org/fulldisclosure/2025/Jul/32
CVE: CVE-2025-43191
Published: 2025-07-30
Description: A path handling issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app may be able to cause a denial-of-service.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-22
References: https://support.apple.com/en-us/124149; https://support.apple.com/en-us/124150; https://support.apple.com/en-us/124151
CVE: CVE-2025-43192
Published: 2025-07-30
Description: A configuration issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7. Account-driven User Enrollment may still be possible with Lockdown Mode turned on.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: https://support.apple.com/en-us/124149; https://support.apple.com/en-us/124150; http://seclists.org/fulldisclosure/2025/Jul/32
CVE: CVE-2025-43193
Published: 2025-07-30
Description: The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app may be able to cause a denial-of-service.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-400
References: https://support.apple.com/en-us/124149; https://support.apple.com/en-us/124150; https://support.apple.com/en-us/124151
CVE: CVE-2025-43194
Published: 2025-07-30
Description: The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app may be able to modify protected parts of the file system.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: https://support.apple.com/en-us/124149; https://support.apple.com/en-us/124150; https://support.apple.com/en-us/124151
CVE: CVE-2025-43195
Published: 2025-07-30
Description: An issue existed in the handling of environment variables. This issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app may be able to access sensitive user data.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://support.apple.com/en-us/124149; https://support.apple.com/en-us/124150; https://support.apple.com/en-us/124151
CVE: CVE-2025-43196
Published: 2025-07-30
Description: A path handling issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app may be able to gain root privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22
References: https://support.apple.com/en-us/124149; https://support.apple.com/en-us/124150; https://support.apple.com/en-us/124151
CVE: CVE-2025-43197
Published: 2025-07-30
Description: This issue was addressed with additional entitlement checks. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app may be able to access sensitive user data.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-863
References: https://support.apple.com/en-us/124149; https://support.apple.com/en-us/124150; https://support.apple.com/en-us/124151
CVE: CVE-2025-43198
Published: 2025-07-30
Description: This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7. An app may be able to access protected user data.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: https://support.apple.com/en-us/124149; https://support.apple.com/en-us/124150; http://seclists.org/fulldisclosure/2025/Jul/32
CVE: CVE-2025-43199
Published: 2025-07-30
Description: A permissions issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. A malicious app may be able to gain root privileges.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-269
References: https://support.apple.com/en-us/124149; https://support.apple.com/en-us/124150; https://support.apple.com/en-us/124151
CVE: CVE-2025-43206
Published: 2025-07-30
Description: A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app may be able to access protected user data.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-22
References: https://support.apple.com/en-us/124149; https://support.apple.com/en-us/124150; https://support.apple.com/en-us/124151
CVE: CVE-2025-43209
Published: 2025-07-30
Description: An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 18.6 and iPadOS 18.6, iPadOS 17.7.9, macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7, tvOS 18.6, visionOS 2.6, watchOS 11.6. Processing maliciously crafted web content may lead to an unexpected Safari crash.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://support.apple.com/en-us/124147; https://support.apple.com/en-us/124148; https://support.apple.com/en-us/124149
CVE: CVE-2025-43211
Published: 2025-07-30
Description: The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6, iPadOS 17.7.9, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, watchOS 11.6. Processing web content may lead to a denial-of-service.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-770
References: https://support.apple.com/en-us/124147; https://support.apple.com/en-us/124148; https://support.apple.com/en-us/124149
CVE: CVE-2025-43212
Published: 2025-07-30
Description: The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, watchOS 11.6. Processing maliciously crafted web content may lead to an unexpected Safari crash.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: https://support.apple.com/en-us/124147; https://support.apple.com/en-us/124149; https://support.apple.com/en-us/124152
CVE: CVE-2025-43213
Published: 2025-07-30
Description: The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, watchOS 11.6. Processing maliciously crafted web content may lead to an unexpected Safari crash.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: https://support.apple.com/en-us/124147; https://support.apple.com/en-us/124149; https://support.apple.com/en-us/124152
CVE: CVE-2025-43214
Published: 2025-07-30
Description: The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, watchOS 11.6. Processing maliciously crafted web content may lead to an unexpected Safari crash.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: https://support.apple.com/en-us/124147; https://support.apple.com/en-us/124149; https://support.apple.com/en-us/124152
CVE: CVE-2025-43215
Published: 2025-07-30
Description: The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.6. Processing a maliciously crafted image may result in disclosure of process memory.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://support.apple.com/en-us/124149; http://seclists.org/fulldisclosure/2025/Jul/32
CVE: CVE-2025-43216
Published: 2025-07-30
Description: A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6, iPadOS 17.7.9, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, watchOS 11.6. Processing maliciously crafted web content may lead to an unexpected Safari crash.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-416
References: https://support.apple.com/en-us/124147; https://support.apple.com/en-us/124148; https://support.apple.com/en-us/124149
CVE: CVE-2025-43217
Published: 2025-07-30
Description: The issue was addressed by adding additional logic. This issue is fixed in iOS 18.6 and iPadOS 18.6, iPadOS 17.7.9. Privacy Indicators for microphone or camera access may not be correctly displayed.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-359
References: https://support.apple.com/en-us/124147; https://support.apple.com/en-us/124148; http://seclists.org/fulldisclosure/2025/Jul/30
CVE: CVE-2025-43218
Published: 2025-07-30
Description: An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Sequoia 15.6. Processing a maliciously crafted USD file may disclose memory contents.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://support.apple.com/en-us/124149; http://seclists.org/fulldisclosure/2025/Jul/32
CVE: CVE-2025-43220
Published: 2025-07-30
Description: This issue was addressed with improved validation of symlinks. This issue is fixed in iPadOS 17.7.9, macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app may be able to access protected user data.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-59
References: https://support.apple.com/en-us/124148; https://support.apple.com/en-us/124149; https://support.apple.com/en-us/124150
CVE: CVE-2025-43221
Published: 2025-07-30
Description: An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6. Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: https://support.apple.com/en-us/124147; https://support.apple.com/en-us/124149; https://support.apple.com/en-us/124153
CVE: CVE-2025-43222
Published: 2025-07-30
Description: A use-after-free issue was addressed by removing the vulnerable code. This issue is fixed in iPadOS 17.7.9, macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An attacker may be able to cause unexpected app termination.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: https://support.apple.com/en-us/124148; https://support.apple.com/en-us/124149; https://support.apple.com/en-us/124150
CVE: CVE-2025-43223
Published: 2025-07-30
Description: A denial-of-service issue was addressed with improved input validation. This issue is fixed in iOS 18.6 and iPadOS 18.6, iPadOS 17.7.9, macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7, tvOS 18.6, visionOS 2.6, watchOS 11.6. A non-privileged user may be able to modify restricted network settings.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://support.apple.com/en-us/124147; https://support.apple.com/en-us/124148; https://support.apple.com/en-us/124149
CVE: CVE-2025-43224
Published: 2025-07-30
Description: An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6. Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory.
CVSS Score: 7.1 (HIGH)
CWE: CWE-787
References: https://support.apple.com/en-us/124147; https://support.apple.com/en-us/124149; https://support.apple.com/en-us/124153