rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-43006 Cross-Site Scripting (XSS) vulnerability in SAP Supplier Relationship Management (Master Data Management Catalog)
SAP Supplier Relationship Management (Master Data Management Catalogue) allows an unauthenticated attacker to execute malicious scripts in the application, potentially leading to a Cross-Site Scripting (XSS) vulnerability. This has no impact on the availability of the application, but it can have some minor impact on its confidentiality and integrity.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation
Affected products: vendor: SAP_SE
product: SAP Supplier Relationship Management (Master Data Management Catalog)
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Published: 2025-05-13T00:19:01.711Z
CVE-2025-43007 Missing Authorization check in SAP Service Parts Management (SPM)
SAP Service Parts Management (SPM) does not perform necessary authorization checks for an authenticated user, allowing an attacker to escalate privileges. This has low impact on confidentiality, integrity and availability of the application.
Problem types: cwe_id: CWE-862
description: CWE-862: Missing Authorization
Affected products: vendor: SAP_SE
product: SAP Service Parts Management (SPM)
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Published: 2025-05-13T00:19:18.709Z
CVE-2025-43008 Missing Authorization check in SAP S/4HANA HCM Portugal and SAP ERP HCM Portugal
Due to missing authorization check, an unauthorized user can view the files of other company. This might lead to disclosure of personal data of employees. There is no impact on integrity and availability.
Problem types: cwe_id: CWE-862
description: CWE-862: Missing Authorization
Affected products: vendor: SAP_SE
product: SAP S/4HANA HCM Portugal and SAP ERP HCM Portugal
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.8
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N
version: 3.1
Published: 2025-05-13T00:19:30.248Z
CVE-2025-43009 Missing Authorization check in SAP Service Parts Management (SPM)
SAP Service Parts Management (SPM) does not perform necessary authorization checks for an authenticated user, allowing an attacker to escalate privileges. This has low impact on Confidentiality, integrity and availability of the application.
Problem types: cwe_id: CWE-862
description: CWE-862: Missing Authorization
Affected products: vendor: SAP_SE
product: SAP Service Parts Management (SPM)
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Published: 2025-05-13T00:19:41.795Z
CVE-2025-43010 Code injection vulnerability in SAP S/4HANA Cloud Private Edition or On Premise(SCM Master Data Layer (MDL))
SAP S/4HANA Cloud Private Edition or on Premise (SCM Master Data Layer (MDL)) allows an authenticated attacker with SAP standard authorization to execute a certain function module remotely and replace arbitrary ABAP programs, including SAP standard programs. This is due to lack of input validation and no authorization checks. This has low Confidentiality impact but high impact on integrity and availability to the application.
Problem types: cwe_id: CWE-94
description: CWE-94: Improper Control of Generation of Code
Affected products: vendor: SAP_SE
product: SAP S/4HANA Cloud Private Edition or on Premise (SCM Master Data Layer (MDL))
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.3
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
version: 3.1
Published: 2025-05-13T00:19:51.184Z
CVE-2025-43011 Missing Authorization Check in SAP Landscape Transformation (PCL Basis)
Under certain conditions, SAP Landscape Transformation's PCL Basis module does not perform the necessary authorization checks, allowing authenticated users to access restricted functionalities or data. This can lead to a high impact on confidentiality with no impact on the integrity or availability of the application.
Problem types: cwe_id: CWE-862
description: CWE-862: Missing Authorization
Affected products: vendor: SAP_SE
product: SAP Landscape Transformation (PCL Basis)
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.7
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
version: 3.1
Published: 2025-05-13T00:20:02.713Z
CVE-2025-43012 
In JetBrains Toolbox App before 2.6 command injection in SSH plugin was possible
Problem types: cwe_id: CWE-77
description: CWE-77
Affected products: vendor: JetBrains
product: Toolbox App
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 8.3
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Published: 2025-04-17T15:56:04.085Z
CVE-2025-43013 
In JetBrains Toolbox App before 2.6 unencrypted credential transmission during SSH authentication was possible
Problem types: cwe_id: CWE-319
description: CWE-319
Affected products: vendor: JetBrains
product: Toolbox App
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: LOW
availabilityImpact: LOW
baseScore: 6.9
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:L
Published: 2025-04-17T15:56:04.549Z
CVE-2025-43014 
In JetBrains Toolbox App before 2.6 the SSH plugin established connections without sufficient user confirmation
Problem types: cwe_id: CWE-304
description: CWE-304
Affected products: vendor: JetBrains
product: Toolbox App
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Published: 2025-04-17T15:56:04.945Z
CVE-2025-43015 
In JetBrains RubyMine before 2025.1 remote Interpreter overwrote ports to listen on all interfaces
Problem types: cwe_id: CWE-1188
description: CWE-1188
Affected products: vendor: JetBrains
product: RubyMine
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: LOW
baseScore: 8.3
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
Published: 2025-04-17T15:56:05.386Z
CVE-2025-43016 
In JetBrains Rider before 2025.1.2 custom archive unpacker allowed arbitrary file overwrite during remote debug session
Problem types: cwe_id: CWE-23
description: CWE-23
Affected products: vendor: JetBrains
product: Rider
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: LOW
availabilityImpact: LOW
baseScore: 5.4
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Published: 2025-04-25T14:32:32.399Z
CVE-2025-43017 HP ThinPro 8.1 SP8 Security Updates
HP ThinPro 8.1 System management application failed to verify user's true id. HP has released HP ThinPro 8.1 SP8, which includes updates to mitigate potential vulnerabilities.
Problem types: cwe_id: CWE-250
description: CWE-250: Execution with Unnecessary Privileges
Affected products: vendor: HP Inc.
product: HP ThinPro 8.1
default_status: unknown
Published: 2025-10-28T20:40:19.040Z
CVE-2025-43018 Certain HP LaserJet Pro Printers – Potential Information Disclosure
Certain HP LaserJet Pro printers may be vulnerable to information disclosure when a non-authenticated user queries a device’s local address book.
Problem types: cwe_id: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: HP, Inc.
product: Certain HP LaserJet Pro Printers
default_status: unaffected
Published: 2025-07-30T14:31:18.650Z
CVE-2025-43019 HP Support Assistant – Potential Escalation of Privilege
A potential security vulnerability has been identified in the HP Support Assistant, which allows a local attacker to escalate privileges via an arbitrary file deletion.
Problem types: cwe_id: CWE-269
description: CWE-269 Improper Privilege Management
Affected products: vendor: HP Inc.
product: HP Support Assistant
default_status: unknown
Published: 2025-07-08T15:25:34.337Z
CVE-2025-43020 Poly Clariti Manager - Multiple Security Vulnerabilities
A potential command
injection vulnerability has been identified in the Poly Clariti Manager for
versions prior to 10.12.2. The vulnerability could allow a privileged user
to submit arbitrary input. HP has addressed the issue in the latest software update.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: HP Inc.
product: Poly Clariti Manager
default_status: unknown
Published: 2025-07-22T23:01:09.020Z
CVE-2025-43021 Poly Clariti Manager - Multiple Security Vulnerabilities
A potential security vulnerability has been identified in the Poly Clariti Manager for versions prior to 10.12.1. The vulnerability could allow the use and retrieval of the default password. HP has addressed the issue in the latest software update.
Problem types: cwe_id: CWE-1393
description: CWE-1393: Use of Default Password
Affected products: vendor: HP Inc.
product: Poly Clariti Manager
default_status: unknown
Published: 2025-07-22T23:03:32.074Z
CVE-2025-43022 Poly Clariti Manager - Multiple Security Vulnerabilities
A potential SQL injection vulnerability has been identified in the Poly
Clariti Manager for versions prior to 10.12.1. The vulnerability could allow
a privileged user to execute SQL commands. HP has addressed the issue in
the latest software update.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: HP Inc.
product: Poly Clariti Manager
default_status: unknown
Published: 2025-07-22T23:05:24.070Z
CVE-2025-43023 HP Linux Imaging and Printing Software - Use of DSA Key
A potential security vulnerability has been identified in the HP Linux Imaging and Printing Software documentation. This potential vulnerability is due to the use of a weak code signing key, Digital Signature Algorithm (DSA).
Problem types: cwe_id: CWE-347
description: CWE-347 Improper Verification of Cryptographic Signature
Affected products: vendor: HP, Inc.
product: HP Linux Imaging and Printing Software
default_status: unaffected
Published: 2025-07-28T17:46:46.398Z
CVE-2025-43024 HP ThinPro 8.1 SP8 Security Updates
A GUI dialog of an application allows to view what files are in the file system without proper authorization.
Problem types: cwe_id: CWE-497
description: CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere
Affected products: vendor: HP Inc
product: ThinPro 8.1
default_status: unaffected
Published: 2025-10-27T23:11:35.638Z
CVE-2025-43025 HP Universal Print Driver – Potential Denial of Service
HP Universal Print Driver is potentially vulnerable to denial of service due to buffer overflow in versions of UPD 7.4 or older (e.g., v7.3.x, v7.2.x, v7.1.x, etc.).
Problem types: cwe_id: CWE-121
description: CWE-121: Stack-based Buffer Overflow
Affected products: vendor: HP Inc.
product: Universal Print Driver
default_status: unaffected
Published: 2025-07-02T19:43:46.888Z
CVE-2025-43026 HP Support Assistant – Potential Escalation of Privilege
A potential security vulnerability has been identified in the HP Support Assistant for versions prior to 9.44.18.0. The vulnerability could potentially allow a local attacker to escalate privileges via an arbitrary file write.
Problem types: cwe_id: CWE-281
description: CWE-281 Improper Preservation of Permissions
Affected products: vendor: HP, Inc.
product: HP Support Assistant
default_status: unaffected
Published: 2025-06-05T19:41:30.538Z
CVE-2025-43027 
A critical severity vulnerability has been identified in the ALPR Manager role of Security Center that could allow attackers to gain administrative access to the Genetec Security Center system. The Genetec engineering team discovered this issue internally. There is currently no evidence that this vulnerability has been exploited in the wild.
Problem types: cwe_id: CWE-284
description: CWE-284: Improper Access Control
Affected products: vendor: Genetec Inc.
product: Genetec Security Center
default_status: unaffected
CVSS v3.1: baseScore: 9.8
baseSeverity: CRITICAL
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2025-10-30T14:12:27.918Z
CVE-2025-43079 Local Privilege Escalation via qagent_uninstall.sh Qualys Cloud Agents
The Qualys Cloud Agent included a bundled uninstall script (qagent_uninstall.sh), specific to Mac and Linux supported versions that invoked multiple system commands without using absolute paths and without sanitizing the $PATH environment. If the uninstall script is executed with elevated privileges (e.g., via sudo) in an environment where $PATH has been manipulated, an attacker with root/sudo privileges could cause malicious executables to be run in place of the intended system binaries. This behavior can be leveraged for local privilege escalation and arbitrary command execution under elevated privileges.
Problem types: cwe_id: CWE-426
description: CWE-426 Untrusted Search Path
Affected products: vendor: Qualys Inc
product: Qualys Agent
default_status: unaffected
vendor: Qualys Inc
product: Qualys Agent
default_status: affected
vendor: Qualys Inc
product: Qualys Agent
default_status: affected
vendor: Qualys Inc
product: Qualys Agent
default_status: unaffected
vendor: Qualys Inc
product: Qualys Agent
default_status: unaffected
vendor: Qualys Inc
product: Qualys Agent
default_status: unaffected
vendor: Qualys Inc
product: Qualys Agent
default_status: unaffected
vendor: Qualys Inc
product: Qualys Agent
default_status: unaffected
vendor: Qualys Inc
product: Qualys Agent
default_status: unaffected
vendor: Qualys Inc
product: Qualys Agent
default_status: unaffected
vendor: Qualys Inc
product: Qualys Agent
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: HIGH
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: MEDIUM
baseScore: 6.3
vectorString: CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
Credits: lang: en
value: Brent Zaltsman (AfricanHipp0)
Published: 2025-11-10T17:10:31.066Z
CVE-2025-43184 
This issue was addressed by adding an additional prompt for user consent. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. A shortcut may be able to bypass sensitive Shortcuts app settings.
Problem types: description: A shortcut may be able to bypass sensitive Shortcuts app settings
Affected products: vendor: Apple
product: macOS
Published: 2025-07-29T23:28:56.224Z
CVE-2025-43185 
A downgrade issue was addressed with additional code-signing restrictions. This issue is fixed in macOS Sequoia 15.6. An app may be able to access protected user data.
Problem types: description: An app may be able to access protected user data
Affected products: vendor: Apple
product: macOS
Published: 2025-07-29T23:35:15.041Z
CVE-2025-43186 
The issue was addressed with improved memory handling. This issue is fixed in iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7, tvOS 18.6, visionOS 2.6, watchOS 11.6. Parsing a file may lead to an unexpected app termination.
Problem types: description: Parsing a file may lead to an unexpected app termination
Affected products: vendor: Apple
product: iOS and iPadOS
vendor: Apple
product: macOS
vendor: Apple
product: tvOS
vendor: Apple
product: visionOS
vendor: Apple
product: watchOS
Published: 2025-07-29T23:36:02.077Z
CVE-2025-43187 
This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. Running an hdiutil command may unexpectedly execute arbitrary code.
Problem types: description: Running an hdiutil command may unexpectedly execute arbitrary code
Affected products: vendor: Apple
product: macOS
Published: 2025-08-29T00:28:52.591Z
CVE-2025-43188 
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.6. A malicious app may be able to gain root privileges.
Problem types: description: A malicious app may be able to gain root privileges
Affected products: vendor: Apple
product: macOS
Published: 2025-07-29T23:35:02.331Z
CVE-2025-43189 
This issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7. A malicious app may be able to read kernel memory.
Problem types: description: A malicious app may be able to read kernel memory
Affected products: vendor: Apple
product: macOS
Published: 2025-07-29T23:29:09.625Z
CVE-2025-43190 
A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in iOS 26 and iPadOS 26, macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26, visionOS 26, watchOS 26. An app may be able to access sensitive user data.
Problem types: description: An app may be able to access sensitive user data
Affected products: vendor: Apple
product: iOS and iPadOS
vendor: Apple
product: macOS
vendor: Apple
product: visionOS
vendor: Apple
product: watchOS
Published: 2025-09-15T22:35:42.086Z
CVE-2025-43191 
A path handling issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app may be able to cause a denial-of-service.
Problem types: description: An app may be able to cause a denial-of-service
Affected products: vendor: Apple
product: macOS
Published: 2025-07-29T23:54:55.593Z
CVE-2025-43192 
A configuration issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7. Account-driven User Enrollment may still be possible with Lockdown Mode turned on.
Problem types: description: Account-driven User Enrollment may still be possible with Lockdown Mode turned on
Affected products: vendor: Apple
product: macOS
Published: 2025-07-29T23:28:58.246Z
CVE-2025-43193 
The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app may be able to cause a denial-of-service.
Problem types: description: An app may be able to cause a denial-of-service
Affected products: vendor: Apple
product: macOS
Published: 2025-07-29T23:29:05.220Z
CVE-2025-43194 
The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app may be able to modify protected parts of the file system.
Problem types: description: An app may be able to modify protected parts of the file system
Affected products: vendor: Apple
product: macOS
Published: 2025-07-29T23:35:24.346Z
CVE-2025-43195 
An issue existed in the handling of environment variables. This issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app may be able to access sensitive user data.
Problem types: description: An app may be able to access sensitive user data
Affected products: vendor: Apple
product: macOS
Published: 2025-07-29T23:35:37.194Z
CVE-2025-43196 
A path handling issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app may be able to gain root privileges.
Problem types: description: An app may be able to gain root privileges
Affected products: vendor: Apple
product: macOS
Published: 2025-07-29T23:54:35.368Z
CVE-2025-43197 
This issue was addressed with additional entitlement checks. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app may be able to access sensitive user data.
Problem types: description: An app may be able to access sensitive user data
Affected products: vendor: Apple
product: macOS
Published: 2025-07-29T23:54:45.867Z
CVE-2025-43198 
This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7. An app may be able to access protected user data.
Problem types: description: An app may be able to access protected user data
Affected products: vendor: Apple
product: macOS
Published: 2025-07-29T23:35:28.810Z
CVE-2025-43199 
A permissions issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. A malicious app may be able to gain root privileges.
Problem types: description: A malicious app may be able to gain root privileges
Affected products: vendor: Apple
product: macOS
Published: 2025-07-29T23:35:34.190Z
CVE-2025-43200 
This issue was addressed with improved checks. This issue is fixed in iOS 15.8.4 and iPadOS 15.8.4, iOS 16.7.11 and iPadOS 16.7.11, iOS 18.3.1 and iPadOS 18.3.1, iPadOS 17.7.5, macOS Sequoia 15.3.1, macOS Sonoma 14.7.4, macOS Ventura 13.7.4, visionOS 2.3.1, watchOS 11.3.1. A logic issue existed when processing a maliciously crafted photo or video shared via an iCloud Link. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals.
Problem types: description: A logic issue existed when processing a maliciously crafted photo or video shared via an iCloud Link. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals.
Affected products: vendor: Apple
product: iOS and iPadOS
vendor: Apple
product: iPadOS
vendor: Apple
product: macOS
vendor: Apple
product: visionOS
vendor: Apple
product: watchOS
Published: 2025-06-16T21:36:25.578Z
CVE-2025-43201 
This issue was addressed with improved checks. This issue is fixed in Apple Music Classical 2.3 for Android. An app may be able to unexpectedly leak a user's credentials.
Problem types: description: An app may be able to unexpectedly leak a user's credentials
Affected products: vendor: Apple
product: Apple Music Classical
Published: 2025-08-15T21:58:14.676Z
CVE-2025-43202 
This issue was addressed with improved memory handling. This issue is fixed in iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6. Processing a file may lead to memory corruption.
Problem types: description: Processing a file may lead to memory corruption
Affected products: vendor: Apple
product: iOS and iPadOS
vendor: Apple
product: macOS
Published: 2026-04-02T18:10:46.701Z