Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

584new WordPress flaws this week

391,288entries in the database

2,565 results · page 22 of 52

Dec 11, 2024The issue was addressed with improved checks.CVE-2024-54476 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ventura 13.7.2. An app may be able to access user-sensitive data.
Product
macOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Dec 11, 2024The issue was addressed with improved checks.CVE-2024-54474 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ventura 13.7.2. An app may be able to access user-sensitive data.
Product
macOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Dec 11, 2024This issue was addressed with additional entitlement checks.CVE-2024-54471 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
This issue was addressed with additional entitlement checks. This issue is fixed in macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1. A malicious application may be able to leak a user's credentials.
Product
macOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Dec 11, 2024An authorization issue was addressed with improved state management.CVE-2024-54466 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.3
An authorization issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ventura 13.7.2. An encrypted volume may be accessed by a different user without prompting for the password.
Product
macOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Dec 11, 2024A logic issue was addressed with improved state management.CVE-2024-54465 · Computers, phones & browsers · Apple · reported by product-security@apple.comCritical 9.8
A logic issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.2. An app may be able to elevate privileges.
Product
macOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com seclists.org
Dec 11, 2024A logic issue was addressed with improved file handling.CVE-2024-44300 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
A logic issue was addressed with improved file handling. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ventura 13.7.2. An app may be able to access protected user data.
Product
macOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Dec 11, 2024A logic issue was addressed with improved file handling.CVE-2024-44291 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.8
A logic issue was addressed with improved file handling. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ventura 13.7.2. A malicious app may be able to gain root privileges.
Product
macOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Dec 11, 2024This issue was addressed through improved state management.CVE-2024-44248 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 6.5
This issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15.1, macOS Sonoma 14.7.2, macOS Ventura 13.7.2. A user with screen sharing access may be able to view another user's screen.
Product
macOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Dec 11, 2024A configuration issue was addressed with additional restrictions.CVE-2024-44243 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
A configuration issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.3. An app may be able to modify protected parts of the file system.
Product
macOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Dec 11, 2024A permissions issue was addressed with additional restrictions.CVE-2024-44224 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.8
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ventura 13.7.2. A malicious app may be able to gain root privileges.
Product
macOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Dec 11, 2024The issue was addressed with improved memory handling.CVE-2024-44220 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.2. Parsing a maliciously crafted video file may lead to unexpected system termination.
Product
macOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Nov 25, 2024Joplin is an open source, privacy-focused note taking app with sync capabilities for Windows, macOS, Linux, Android and iOS.CVE-2024-53268 · Other software · laurent22 · reported by GitHubHigh 7.2
Joplin is an open source, privacy-focused note taking app with sync capabilities for Windows, macOS, Linux, Android and iOS. In affected versions attackers are able to abuse the fact that openExternal is used without any filtering of URI schemes to obtain remote code execution in Windows environments. This issue has been addressed in version 3.0.3 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
Product
joplin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Nov 19, 2024A buffer overflow issue was addressed with improved memory handling.CVE-2024-44307 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.8
A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Sonoma 14.6. An app may be able to execute arbitrary code with kernel privileges.
Product
macOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com
Nov 19, 2024A buffer overflow issue was addressed with improved memory handling.CVE-2024-44306 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.8
A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Sonoma 14.6. An app may be able to execute arbitrary code with kernel privileges.
Product
macOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com
Nov 12, 2024An improper verification of cryptographic signature vulnerability [CWE-347] in FortiClient MacOS version 7.4.0, version 7.2.4 and below, version 7.0.10 and beloCVE-2024-40592 · Network & remote access · Fortinet · reported by psirt@fortinet.comHigh 7.5
An improper verification of cryptographic signature vulnerability [CWE-347] in FortiClient MacOS version 7.4.0, version 7.2.4 and below, version 7.0.10 and below, version 6.4.10 and below may allow a local authenticated attacker to swap the installer with a malicious package via a race condition during the installation process.
Product
FortiClientMac
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record fortiguard.fortinet.com
Oct 28, 2024This issue was addressed with additional entitlement checks.CVE-2024-44295 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
This issue was addressed with additional entitlement checks. This issue is fixed in macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1. An app may be able to modify protected parts of the file system.
Product
macOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Oct 28, 2024An out-of-bounds read was addressed with improved bounds checking.CVE-2024-44283 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1. Parsing a maliciously crafted file may lead to an unexpected app termination.
Product
macOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Oct 28, 2024This issue was addressed by removing the vulnerable code.CVE-2024-44260 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 4.4
This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1. A malicious app with root privileges may be able to modify the contents of system files.
Product
macOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Oct 28, 2024This issue was addressed with improved redaction of sensitive information.CVE-2024-44257 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1. An app may be able to access sensitive user data.
Product
macOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Oct 28, 2024The issue was addressed with improved input sanitization.CVE-2024-44256 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 8.6
The issue was addressed with improved input sanitization. This issue is fixed in macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1. An app may be able to break out of its sandbox.
Product
macOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Oct 28, 2024An out-of-bounds access issue was addressed with improved bounds checking.CVE-2024-44237 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1. Processing a maliciously crafted file may lead to unexpected app termination.
Product
macOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Oct 28, 2024An access issue was addressed with additional sandbox restrictions.CVE-2024-44216 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1. An app may be able to access user-sensitive data.
Product
macOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Oct 28, 2024The issue was addressed with improved checks.CVE-2024-44301 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1. A malicious application may be able to modify protected parts of the file system.
Product
macOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Oct 28, 2024A path deletion vulnerability was addressed by preventing vulnerable code from running with privileges.CVE-2024-44294 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 6.5
A path deletion vulnerability was addressed by preventing vulnerable code from running with privileges. This issue is fixed in macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1. An attacker with root privileges may be able to delete protected system files.
Product
macOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Oct 28, 2024A privacy issue was addressed with improved private data redaction for log entries.CVE-2024-44289 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.5
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1. An app may be able to read sensitive location information.
Product
macOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Oct 28, 2024The issue was addressed with improved checks.CVE-2024-44287 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1. A malicious application may be able to modify protected parts of the file system.
Product
macOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Oct 28, 2024An out-of-bounds write issue was addressed with improved input validation.CVE-2024-44284 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1. Parsing a maliciously crafted file may lead to an unexpected app termination.
Product
macOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Oct 28, 2024An out-of-bounds read was addressed with improved input validation.CVE-2024-44281 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1. Parsing a file may lead to disclosure of user information.
Product
macOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Oct 28, 2024A downgrade issue affecting Intel-based Mac computers was addressed with additional code-signing restrictions.CVE-2024-44280 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
A downgrade issue affecting Intel-based Mac computers was addressed with additional code-signing restrictions. This issue is fixed in macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1. An app may be able to modify protected parts of the file system.
Product
macOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Oct 28, 2024An out-of-bounds read was addressed with improved input validation.CVE-2024-44279 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1. Parsing a file may lead to disclosure of user information.
Product
macOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Oct 28, 2024The issue was addressed with improved checks.CVE-2024-44275 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1. A malicious application may be able to modify protected parts of the file system.
Product
macOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Oct 28, 2024A logic issue was addressed with improved validation.CVE-2024-44270 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 8.6
A logic issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1. A sandboxed process may be able to circumvent sandbox restrictions.
Product
macOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Oct 28, 2024The issue was addressed with improved checks.CVE-2024-44267 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1. A malicious application may be able to modify protected parts of the file system.
Product
macOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Oct 28, 2024The issue was addressed by restricting options offered on a locked device.CVE-2024-44265 · Computers, phones & browsers · Apple · reported by product-security@apple.comLow 2.4
The issue was addressed by restricting options offered on a locked device. This issue is fixed in macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1. An attacker with physical access can input Game Controller events to apps running on a locked device.
Product
macOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Oct 28, 2024This issue was addressed with improved validation of symlinks.CVE-2024-44264 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1. A malicious app may be able to create symlinks to protected regions of the disk.
Product
macOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Oct 28, 2024The issue was addressed with improved checks.CVE-2024-44253 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1. An app may be able to modify protected parts of the file system.
Product
macOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Oct 28, 2024The issue was addressed with improved checks.CVE-2024-44247 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1. A malicious application may be able to modify protected parts of the file system.
Product
macOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Oct 28, 2024An out-of-bounds access issue was addressed with improved bounds checking.CVE-2024-44236 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1. Processing a maliciously crafted file may lead to unexpected app termination.
Product
macOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Oct 28, 2024This issue was addressed with improved redaction of sensitive information.CVE-2024-44222 · Computers, phones & browsers · Apple · reported by product-security@apple.comLow 3.3
This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1. An app may be able to read sensitive location information.
Product
macOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Oct 28, 2024An issue existed in the parsing of URLs.CVE-2024-44213 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.9
An issue existed in the parsing of URLs. This issue was addressed with improved input validation. This issue is fixed in macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1. An attacker in a privileged network position may be able to leak sensitive user information.
Product
macOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Oct 28, 2024This issue was addressed through improved state management.CVE-2024-44208 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.5
This issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15. An app may be able to bypass certain Privacy preferences.
Product
macOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com
Oct 28, 2024A permissions issue was addressed with additional restrictions.CVE-2024-44203 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.5
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15. An app may be able to access a user's Photos Library.
Product
macOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com
Oct 28, 2024The issue was addressed with improved memory handling.CVE-2024-44197 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1. An app may be able to cause unexpected system termination or corrupt kernel memory.
Product
macOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Oct 28, 2024A permissions issue was addressed with additional restrictions.CVE-2024-44196 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1. An app may be able to modify protected parts of the file system.
Product
macOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Oct 28, 2024This issue was addressed with improved validation of symlinks.CVE-2024-44175 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7.1. An app may be able to access sensitive user data.
Product
macOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Oct 28, 2024The issue was addressed with improved checks.CVE-2024-44174 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15. An attacker may be able to view restricted content from the lock screen.
Product
macOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com
Oct 28, 2024A path deletion vulnerability was addressed by preventing vulnerable code from running with privileges.CVE-2024-44159 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.1
A path deletion vulnerability was addressed by preventing vulnerable code from running with privileges. This issue is fixed in macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1. An app may be able to bypass Privacy preferences.
Product
macOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Oct 28, 2024A path deletion vulnerability was addressed by preventing vulnerable code from running with privileges.CVE-2024-44156 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.1
A path deletion vulnerability was addressed by preventing vulnerable code from running with privileges. This issue is fixed in macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1. An app may be able to bypass Privacy preferences.
Product
macOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Oct 28, 2024The issue was addressed with improved checks.CVE-2024-44137 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 4.6
The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7.1, macOS Ventura 13.7.1. An attacker with physical access may be able to share items from the lock screen.
Product
macOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Oct 28, 2024The issue was addressed with improved checks.CVE-2024-40855 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7.1, macOS Ventura 13.7.1, visionOS 2. A sandboxed app may be able to access sensitive user data.
Product
macOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.