deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-12463
Published: 2025-11-03
Description: An unauthenticated SQL Injection was discovered within the Geutebruck G-Cam E-Series Cameras through the `Group` parameter in the `/uapi-cgi/viewer/Param.cgi` script. This has been confirmed on the EFD-2130 camera running firmware version 1.12.0.19.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://blog.blacklanternsecurity.com/p/cve-2025-12463-98-unauthenticated
CVE: CVE-2025-50363
Published: 2025-11-03
Description: Phpgurukul Maid Hiring Management System 1.0 is vulnerable to Cross Site Scripting (XSS) in /maid-hiring.php va the name field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/1h3ll/BXSS_CVE; https://github.com/Adar5h16/My-CVE/blob/main/CVE-2025-50363-Exploit.md
CVE: CVE-2025-63441
Published: 2025-11-03
Description: Open Source Social Network (OSSN) 8.6 is vulnerable to Cross Site Scripting (XSS) via the parameter param` at endpoint u/administrator/friends.
CVSS Score: 7.3 (HIGH)
CWE: CWE-79
References: https://github.com/opensource-socialnetwork/opensource-socialnetwork/issues/2501; https://github.com/opensource-socialnetwork/opensource-socialnetwork/releases/tag/8.6; https://www.opensource-socialnetwork.org/discussion/view/7663/open-source-social-network-ossn-86-has-been-released
CVE: CVE-2025-45959
Published: 2025-11-03
Description: Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2025-8558
Published: 2025-11-03
Description: Insider Threat Management (ITM) Server versions prior to 7.17.2 contain an authentication bypass vulnerability that allows unauthenticated users on an adjacent network to perform agent unregistration when the number of registered agents exceeds the licensed limit. Successful exploitation prevents the server from receiving new events from affected agents, resulting in a partial loss of integrity and availability with no impact to confidentiality.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-306
References: https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2025-003
CVE: CVE-2025-12531
Published: 2025-11-03
Description: IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.
CVSS Score: 7.1 (HIGH)
CWE: CWE-611
References: https://www.ibm.com/support/pages/node/7249881
CVE: CVE-2025-12642
Published: 2025-11-03
Description: lighttpd1.4.80 incorrectly merged trailer fields into headers after http request parsing. This behavior can be exploited to conduct HTTP Header Smuggling attacks.

Successful exploitation may allow an attacker to:

  *  Bypass access control rules
  *  Inject unsafe input into backend logic that trusts request headers
  *  Execute HTTP Request Smuggling attacks under some conditions


This issue affects lighttpd1.4.80
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-444
References: https://github.com/lighttpd/lighttpd1.4/commit/35cb89c103877de62d6b63d[PII_REDACTED]d77e5e1
CVE: CVE-2025-50735
Published: 2025-11-03
Description: Directory traversal vulnerability in NextChat thru 2.16.0 due to the WebDAV proxy failing to canonicalize or reject dot path segments in its catch-all route, allowing attackers to gain sensitive information via authenticated or anonymous WebDAV endpoints.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/ChatGPTNextWeb/NextChat/blob/main/app/api/webdav/%5B...path%5D/route.ts; https://github.com/ChatGPTNextWeb/NextChat/blob/main/app/utils/cloud/webdav.ts; https://github.com/fai1424/Vulnerability-Research/tree/main/CVE-2025-50735
CVE: CVE-2025-63593
Published: 2025-11-03
Description: Grav CMS1.7.49.5 is vulnerable to Cross Site Scripting (XSS).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/PureStream108/CVE/blob/main/CVE-2025-63593/CVE-2025-63593.md; https://github.com/getgrav/grav/releases/tag/1.7.49.5
CVE: CVE-2025-12657
Published: 2025-11-03
Description: The KMIP response parser built into mongo binaries is overly tolerant of certain malformed packets, and may parse them into invalid objects. Later reads of this object can result in read access violations.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-754
References: https://jira.mongodb.org/browse/SERVER-101230
CVE: CVE-2025-63293
Published: 2025-11-03
Description: FairSketch Rise Ultimate Project Manager & CRM 3.9.4 is vulnerable to Insecure Permissions. A remote authenticated user can append comments or upload attachments to tickets for which they lack view or edit authorization, due to missing authorization checks in the ticketing/commenting API.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: http://fairsketch.com; https://medium.com/@barrattjack89/cve-2025-63293-insecure-permissions-in-rise-crm-3-9-4-452c88c24195
CVE: CVE-2016-15054
Published: 2025-11-03
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as it is a downstream effect of an already identified vulnerability, CVE-2012-6708.
CVE: CVE-2021-47698
Published: 2025-11-03
Description: Nagios XI versions prior to 5.8.7 using embedded Nagios Core are vulnerable to cross-site scripting (XSS) via the Core UI’s Views URL handling (escape_string()). Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.nagios.com/changelog/nagios-xi/; https://www.vulncheck.com/advisories/nagios-xi-xss-in-core-ui-views-url-handling
CVE: CVE-2024-13997
Published: 2025-11-03
Description: Nagios XI versions prior to 2024R1.1.3 contain a privilege escalation vulnerability in which an authenticated administrator could leverage the Migrate Server feature to obtain root privileges on the underlying XI host. By abusing the migration workflow, an admin-level attacker could execute actions outside the intended security scope of the application, resulting in full control of the operating system.
CVSS Score: 7.2 (HIGH)
CWE: CWE-269
References: https://www.nagios.com/changelog/nagios-xi/; https://www.nagios.com/products/security/#nagios-xi; https://www.vulncheck.com/advisories/nagios-xi-privilege-escalation-via-migrate-server-feature-to-root-on-host
CVE: CVE-2024-13998
Published: 2025-11-03
Description: Nagios XI versions prior to 2024R1.1.3, under certain circumstances, disclose sensitive user account information (including API keys and hashed passwords) to authenticated users who should not have access to that data. Exposure of API keys or password hashes could lead to account compromise, abuse of API privileges, or offline cracking attempts. CVE-2024-13995 addresses a similar vulnerability with a potentially incomplete fix for the underlying problem in earlier versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-497
References: https://www.nagios.com/changelog/nagios-xi/; https://www.nagios.com/products/security/#nagios-xi; https://www.vulncheck.com/advisories/nagios-xi-api-keys-and-hashed-password-authenticated-information-disclosure-2
CVE: CVE-2025-11193
Published: 2025-11-03
Description: A potential vulnerability was reported in some Lenovo Tablets that could allow a local authenticated user or application to gain access to sensitive device specific information.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-256
References: https://support.lenovo.com/us/en/product_security/LEN-202383
CVE: CVE-2025-34501
Published: 2025-11-03
Description: Deck Mate 2 is distributed with static, hard-coded credentials for the root shell and web user interface, while multiple management services (SSH, HTTP, Telnet, SMB, X11) are enabled by default. If an attacker can reach these interfaces - most often through local or near-local access such as connecting to the USB or Ethernet ports beneath the table - the built-in credentials permit administrative login and full control of the system. Once authenticated, an attacker can access firmware utilities, modify controller software, and establish persistent compromise. Remote attack paths via network, cellular, or telemetry links may exist in specific configurations but generally require additional capabilities or operator error. The vendor reports that USB access has been disabled in current firmware builds.
CWE: CWE-798
References: https://www.ioactive.com/wp-content/uploads/2025/05/IOActive-card-shuffler-security.pdf; https://www.vulncheck.com/advisories/shuffle-master-deck-mate-2-hard-coded-credentials-and-exposed-services
CVE: CVE-2025-36172
Published: 2025-11-03
Description: IBM Cloud Pak for Business Automation 25.0.0 through 25.0.0 Interim Fix 001, 24.0.1 through 24.0.1 Interim Fix 004, 24.0.0 through 24.0.0 Interim Fix 006, and earlier unsupported releases IBM Business Automation Workflow is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://www.ibm.com/support/pages/node/7250047
CVE: CVE-2025-35021
Published: 2025-11-04
Description: By failing to authenticate three times to an unconfigured Abilis CPX device via SSH, an attacker can login to a restricted shell on the fourth attempt, and from there, relay connections.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1188
References: https://support.abilis.net/relnotes/cpx2k/R9.0.html#R9.0.7; https://takeonme.org/gcves/GCVE-1337-2[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]00; https://www.runzero.com/advisories/abilis-cpx-authentication-bypass-cve-2025-35021/
CVE: CVE-2025-46556
Published: 2025-11-04
Description: Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.27.1 and below allow attackers to permanently corrupt issue activity logs by submitting extremely long notes (tested with 4,788,761 characters) due to a lack of server-side validation of note length. Once such a note is added, the activity stream UI fails to render; therefore, new notes cannot be displayed, effectively breaking all future collaboration on the issue. This issue is fixed in version 2.27.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770
References: https://github.com/mantisbt/mantisbt/commit/c99a41272532ba49b5c8dccb7797afead9864234; https://github.com/mantisbt/mantisbt/commit/d5cec6bffb44d54bd412c186b9baa409b1aa4238; https://github.com/mantisbt/mantisbt/commit/e9119c68b4a0eaa0bbde3deb121e81f5f7157361
CVE: CVE-2025-43288
Published: 2025-11-04
Description: This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Sequoia 15.7, macOS Tahoe 26. An app may be able to bypass Privacy preferences.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-59
References: https://support.apple.com/en-us/125110; https://support.apple.com/en-us/125111
CVE: CVE-2025-43309
Published: 2025-11-04
Description: A logic issue was addressed with improved checks. This issue is fixed in iOS 26 and iPadOS 26. An attacker with physical access to an iOS device may be able to view notification contents from the Lock Screen.
CVSS Score: 2.4 (LOW)
CWE: CWE-284
References: https://support.apple.com/en-us/125108
CVE: CVE-2025-43322
Published: 2025-11-04
Description: A logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1. An app may be able to access user-sensitive data.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-284
References: https://support.apple.com/en-us/125634; https://support.apple.com/en-us/125635; https://support.apple.com/en-us/125636
CVE: CVE-2025-43323
Published: 2025-11-04
Description: This issue was addressed with additional entitlement checks. This issue is fixed in iOS 26 and iPadOS 26, macOS Tahoe 26, tvOS 26, visionOS 26, watchOS 26. An app may be able to fingerprint the user.
CVSS Score: 8.1 (HIGH)
CWE: CWE-200
References: https://support.apple.com/en-us/125108; https://support.apple.com/en-us/125110; https://support.apple.com/en-us/125114
CVE: CVE-2025-43334
Published: 2025-11-04
Description: This issue was addressed with additional entitlement checks. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1. An app may be able to access user-sensitive data.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-284
References: https://support.apple.com/en-us/125634; https://support.apple.com/en-us/125635; https://support.apple.com/en-us/125636
CVE: CVE-2025-43335
Published: 2025-11-04
Description: The issue was addressed by adding additional logic. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1. An app may be able to access user-sensitive data.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-284
References: https://support.apple.com/en-us/125634; https://support.apple.com/en-us/125635; https://support.apple.com/en-us/125636
CVE: CVE-2025-43336
Published: 2025-11-04
Description: A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1. An app with root privileges may be able to access private information.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-863
References: https://support.apple.com/en-us/125634; https://support.apple.com/en-us/125635; https://support.apple.com/en-us/125636
CVE: CVE-2025-43338
Published: 2025-11-04
Description: An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 26 and iPadOS 26, macOS Sonoma 14.8.2, macOS Sonoma 14.8.4, macOS Tahoe 26. Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://support.apple.com/en-us/125108; https://support.apple.com/en-us/125110; https://support.apple.com/en-us/125636
CVE: CVE-2025-43345
Published: 2025-11-04
Description: A correctness issue was addressed with improved checks. This issue is fixed in iOS 18.7 and iPadOS 18.7, iOS 26 and iPadOS 26, macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26, tvOS 26, visionOS 26, watchOS 26. An app may be able to access sensitive user data.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://support.apple.com/en-us/125108; https://support.apple.com/en-us/125109; https://support.apple.com/en-us/125110
CVE: CVE-2025-43348
Published: 2025-11-04
Description: A logic issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1. An app may bypass Gatekeeper checks.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://support.apple.com/en-us/125634; https://support.apple.com/en-us/125635; https://support.apple.com/en-us/125636
CVE: CVE-2025-43350
Published: 2025-11-04
Description: A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.1 and iPadOS 26.1. An attacker may be able to view restricted content from the lock screen.
CVSS Score: 2.4 (LOW)
CWE: CWE-276
References: https://support.apple.com/en-us/125632
CVE: CVE-2025-43360
Published: 2025-11-04
Description: The issue was addressed with improved UI. This issue is fixed in iOS 26 and iPadOS 26. Password fields may be unintentionally revealed.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://support.apple.com/en-us/125108
CVE: CVE-2025-43361
Published: 2025-11-04
Description: An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26 and iPadOS 26, macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26, tvOS 26, visionOS 26, watchOS 26. A malicious app may be able to read kernel memory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://support.apple.com/en-us/125108; https://support.apple.com/en-us/125110; https://support.apple.com/en-us/125114
CVE: CVE-2025-43364
Published: 2025-11-04
Description: A race condition was addressed with additional validation. This issue is fixed in macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26.1. An app may be able to break out of its sandbox.
CVSS Score: 7.8 (HIGH)
CWE: CWE-362
References: https://support.apple.com/en-us/125111; https://support.apple.com/en-us/125112; https://support.apple.com/en-us/125634
CVE: CVE-2025-43365
Published: 2025-11-04
Description: A denial-of-service issue was addressed with improved input validation. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26 and iPadOS 26. An unprivileged process may be able to terminate a root processes.
CVSS Score: 2.8 (LOW)
CWE: CWE-20
References: https://support.apple.com/en-us/125108; https://support.apple.com/en-us/125633
CVE: CVE-2025-43373
Published: 2025-11-04
Description: The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1. An app may be able to cause unexpected system termination or corrupt kernel memory.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119, CWE-787
References: https://support.apple.com/en-us/125634; https://support.apple.com/en-us/125635; https://support.apple.com/en-us/125636
CVE: CVE-2025-43376
Published: 2025-11-04
Description: A logic issue was addressed with improved state management. This issue is fixed in Safari 26, iOS 18.7.7 and iPadOS 18.7.7, iOS 26 and iPadOS 26, macOS Tahoe 26, tvOS 26, visionOS 26, watchOS 26. A remote attacker may be able to view leaked DNS queries with Private Relay turned on.
CVSS Score: 7.5 (HIGH)
References: https://support.apple.com/en-us/125108; https://support.apple.com/en-us/125110; https://support.apple.com/en-us/125113
CVE: CVE-2025-43377
Published: 2025-11-04
Description: An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, macOS Sequoia 15.7.2, macOS Tahoe 26.1. An app may be able to cause a denial-of-service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://support.apple.com/en-us/125633; https://support.apple.com/en-us/125634; https://support.apple.com/en-us/125635
CVE: CVE-2025-43378
Published: 2025-11-04
Description: A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.2, macOS Tahoe 26.1. An app may be able to access sensitive user data.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://support.apple.com/en-us/125634; https://support.apple.com/en-us/125635
CVE: CVE-2025-43379
Published: 2025-11-04
Description: This issue was addressed with improved validation of symlinks. This issue is fixed in iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. An app may be able to access protected user data.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-59
References: https://support.apple.com/en-us/125632; https://support.apple.com/en-us/125634; https://support.apple.com/en-us/125635
CVE: CVE-2025-43380
Published: 2025-11-04
Description: An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1. Parsing a file may lead to an unexpected app termination.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://support.apple.com/en-us/125634; https://support.apple.com/en-us/125635; https://support.apple.com/en-us/125636
CVE: CVE-2025-43382
Published: 2025-11-04
Description: A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1. An app may be able to access sensitive user data.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-22
References: https://support.apple.com/en-us/125634; https://support.apple.com/en-us/125635; https://support.apple.com/en-us/125636
CVE: CVE-2025-43383
Published: 2025-11-04
Description: An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1. Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-125
References: https://support.apple.com/en-us/125632; https://support.apple.com/en-us/125633; https://support.apple.com/en-us/125634
CVE: CVE-2025-43384
Published: 2025-11-04
Description: An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1. Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-125
References: https://support.apple.com/en-us/125632; https://support.apple.com/en-us/125633; https://support.apple.com/en-us/125634
CVE: CVE-2025-43385
Published: 2025-11-04
Description: An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1. Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-125
References: https://support.apple.com/en-us/125632; https://support.apple.com/en-us/125633; https://support.apple.com/en-us/125634
CVE: CVE-2025-43386
Published: 2025-11-04
Description: An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1. Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://support.apple.com/en-us/125632; https://support.apple.com/en-us/125633; https://support.apple.com/en-us/125634
CVE: CVE-2025-43387
Published: 2025-11-04
Description: A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.2, macOS Tahoe 26.1. A malicious app may be able to gain root privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-863
References: https://support.apple.com/en-us/125634; https://support.apple.com/en-us/125635
CVE: CVE-2025-43389
Published: 2025-11-04
Description: A privacy issue was addressed by removing the vulnerable code. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1, visionOS 26.1. An app may be able to access sensitive user data.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-359
References: https://support.apple.com/en-us/125632; https://support.apple.com/en-us/125633; https://support.apple.com/en-us/125634
CVE: CVE-2025-43390
Published: 2025-11-04
Description: A downgrade issue affecting Intel-based Mac computers was addressed with additional code-signing restrictions. This issue is fixed in macOS Sequoia 15.7.2, macOS Tahoe 26.1. An app may be able to access user-sensitive data.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-347
References: https://support.apple.com/en-us/125634; https://support.apple.com/en-us/125635
CVE: CVE-2025-43391
Published: 2025-11-04
Description: A privacy issue was addressed with improved handling of temporary files. This issue is fixed in iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1. An app may be able to access sensitive user data.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://support.apple.com/en-us/125632; https://support.apple.com/en-us/125634; https://support.apple.com/en-us/125635
CVE: CVE-2025-43392
Published: 2025-11-04
Description: The issue was addressed with improved handling of caches. This issue is fixed in Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. A website may exfiltrate image data cross-origin.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-942
References: https://support.apple.com/en-us/125632; https://support.apple.com/en-us/125633; https://support.apple.com/en-us/125634