Updated 11 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

570new WordPress flaws this week

391,310entries in the database

2,563 results · page 47 of 52

Oct 22, 2020This issue was addressed with a new entitlement.CVE-2020-9771 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.1
This issue was addressed with a new entitlement. This issue is fixed in macOS Catalina 10.15.4. A user may gain access to protected parts of the file system.
Product
macOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Oct 22, 2020A path handling issue was addressed with improved validation.CVE-2020-3915 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.8
A path handling issue was addressed with improved validation. This issue is fixed in macOS Catalina 10.15.4. A malicious application may be able to overwrite arbitrary files.
Product
macOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Oct 22, 2020A memory corruption issue was addressed with improved validation.CVE-2020-3898 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.8
A memory corruption issue was addressed with improved validation. This issue is fixed in macOS Catalina 10.15.4. An application may be able to gain elevated privileges.
Product
macOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Oct 16, 2020Apple iOS, iPadOS, and macOS Input Validation VulnerabilityCVE-2020-9934 · Computers, phones & browsers · Apple · reported by product-security@apple.comExploitedMedium 5.5
Apple iOS, iPadOS, and macOS contain an unspecified vulnerability involving input validation which can allow a local attacker to view sensitive user information.
Product
iOS, iPadOS, and macOS
On CISA’s list since
Sep 8, 2022 (federal fix deadline Sep 29, 2022)
What to do
Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.apple.com support.apple.com
Oct 16, 2020An out-of-bounds read was addressed with improved input validation.CVE-2020-9918 · Computers, phones & browsers · Apple · reported by product-security@apple.comCritical 9.8
An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Catalina 10.15.6, tvOS 13.4.8, watchOS 6.2.8. A remote attacker may be able to cause unexpected system termination or corrupt kernel memory.
Product
macOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Oct 16, 2020This issue was addressed with improved data protection.CVE-2020-9913 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
This issue was addressed with improved data protection. This issue is fixed in macOS Catalina 10.15.6. A local user may be able to leak sensitive user information.
Product
macOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Oct 16, 2020A logic issue was addressed with improved restrictions.CVE-2020-9864 · Computers, phones & browsers · Apple · reported by product-security@apple.comCritical 9.8
A logic issue was addressed with improved restrictions. This issue is fixed in macOS Catalina 10.15.6. An application may be able to execute arbitrary code with kernel privileges.
Product
macOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Oct 16, 2020An out-of-bounds read was addressed with improved bounds checking.CVE-2020-9799 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.8
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Catalina 10.15.6. A malicious application may be able to execute arbitrary code with kernel privileges.
Product
macOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Oct 2, 2020An issue was discovered in Foxit Reader and PhantomPDF before 4.1 on macOS.CVE-2020-26540 · Other software · Foxitsoftware · reported by MITREHigh 7.5
An issue was discovered in Foxit Reader and PhantomPDF before 4.1 on macOS. Because the Hardened Runtime protection mechanism is not applied to code signing, code injection (or an information leak) can occur.
Product
Foxit Reader
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record foxitsoftware.com foxitsoftware.com
Sep 18, 2020NVIDIA GeForce NOW, versions prior to 2.0.23 (Windows, macOS) and versions prior to 5.31 (Android, Shield TV), contains a vulnerability in the application softwCVE-2020-5976 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.5
NVIDIA GeForce NOW, versions prior to 2.0.23 (Windows, macOS) and versions prior to 5.31 (Android, Shield TV), contains a vulnerability in the application software where the network test component transmits sensitive information insecurely, which may lead to information disclosure.
Product
NVIDIA GeForce NOW Application
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nvidia.custhelp.com nvidia.custhelp.com
Sep 18, 2020NVIDIA GeForce NOW, versions prior to 2.0.23 on Windows and macOS, contains a vulnerability in the desktop application software that includes sensitive informatCVE-2020-5975 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.5
NVIDIA GeForce NOW, versions prior to 2.0.23 on Windows and macOS, contains a vulnerability in the desktop application software that includes sensitive information as part of a URL, which may lead to information disclosure.
Product
NVIDIA GeForce NOW Application
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nvidia.custhelp.com nvidia.custhelp.com
Sep 1, 2020A vulnerability in Trend Micro Apex One, Worry-Free Business Security 10.0 SP1 and Worry-Free Business Security Services on macOS may allow an attacker to manipCVE-2020-24559 · Other software · Trend Micro · reported by security@trendmicro.comHigh 7.8
A vulnerability in Trend Micro Apex One, Worry-Free Business Security 10.0 SP1 and Worry-Free Business Security Services on macOS may allow an attacker to manipulate a certain binary to load and run a script from a user-writable folder, which then would allow them to execute arbitrary code as root. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
Product
Trend Micro Apex One
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record success.trendmicro.com success.trendmicro.com
Jun 23, 2020An issue was discovered in F-Secure SAFE 17.7 on macOS.CVE-2020-14978 · Other software · F-secure · reported by MITREHigh 8.1
An issue was discovered in F-Secure SAFE 17.7 on macOS. Due to incorrect client version verification, an attacker can connect to a privileged XPC service, and execute privileged commands on the system. NOTE: the attacker needs to execute code on an already compromised machine.
Product
Safe
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record theevilbit.github.io f-secure.com
Jun 23, 2020An issue was discovered in F-Secure SAFE 17.7 on macOS.CVE-2020-14977 · Other software · F-secure · reported by MITREHigh 8.1
An issue was discovered in F-Secure SAFE 17.7 on macOS. The XPC services use the PID to identify the connecting client, which allows an attacker to perform a PID reuse attack and connect to a privileged XPC service, and execute privileged commands on the system. NOTE: the attacker needs to execute code on an already compromised machine.
Product
Safe
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record theevilbit.github.io f-secure.com
Jun 23, 2020GNS3 ubridge through 0.9.18 on macOS, as used in GNS3 server before 2.1.17, allows a local attacker to read arbitrary files because it handles configuration-filCVE-2020-14976 · Other software · Gns3 · reported by MITREMedium 5.5
GNS3 ubridge through 0.9.18 on macOS, as used in GNS3 server before 2.1.17, allows a local attacker to read arbitrary files because it handles configuration-file errors by printing the configuration file while executing in a setuid root context.
Product
Ubridge
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jun 19, 2020VMware Tools for macOS (11.x.x and prior before 11.1.1) contains a denial-of-service vulnerability in the Host-Guest File System (HGFS) implementation.CVE-2020-3972 · Other software · VMware · reported by security@vmware.comLow 3.3
VMware Tools for macOS (11.x.x and prior before 11.1.1) contains a denial-of-service vulnerability in the Host-Guest File System (HGFS) implementation. Successful exploitation of this issue may allow attackers with non-admin privileges on guest macOS virtual machines to create a denial-of-service condition on their own VMs.
Product
Tools
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record vmware.com vmware.com
Jun 19, 2020An issue was discovered in Mattermost Desktop App before 4.3.0 on macOS.CVE-2019-20856 · Other software · Mattermost · reported by MITRECritical 9.8
An issue was discovered in Mattermost Desktop App before 4.3.0 on macOS. It allows dylib injection.
Product
Mattermost Desktop
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com mattermost.com
Jun 17, 2020An issue was discovered in the stashcat app through 3.9.2 for macOS, Windows, Android, iOS, and possibly other platforms.CVE-2020-13637 · Other software · Heinekingmedia · reported by MITREHigh 7.5
An issue was discovered in the stashcat app through 3.9.2 for macOS, Windows, Android, iOS, and possibly other platforms. It stores the client_key, the device_id, and the public key for end-to-end encryption in cleartext, enabling an attacker (by copying or having access to the local storage database file) to login to the system from any other computer, and get unlimited access to all data in the users's context.
Product
Stashcat
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jvanlaak.de jvanlaak.de
Jun 9, 2020This issue was addressed with improved checks.CVE-2020-9856 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.3
This issue was addressed with improved checks. This issue is fixed in macOS Catalina 10.15.5. An application may be able to gain elevated privileges.
Product
macOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Jun 9, 2020A validation issue existed in the handling of symlinks.CVE-2020-9855 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.8
A validation issue existed in the handling of symlinks. This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Catalina 10.15.5. A local attacker may be able to elevate their privileges.
Product
macOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Jun 9, 2020An access issue was addressed with improved access restrictions.CVE-2020-9851 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
An access issue was addressed with improved access restrictions. This issue is fixed in macOS Catalina 10.15.5. A malicious application may be able to modify protected parts of the file system.
Product
macOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Jun 9, 2020An out-of-bounds read was addressed with improved bounds checking.CVE-2020-9847 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 8.6
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Catalina 10.15.5. A malicious application may be able to break out of its sandbox.
Product
macOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Jun 9, 2020An integer overflow was addressed through improved input validation.CVE-2020-9841 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.8
An integer overflow was addressed through improved input validation. This issue is fixed in macOS Catalina 10.15.5. An application may be able to execute arbitrary code with kernel privileges.
Product
macOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Jun 9, 2020A memory corruption issue was addressed with improved input validation.CVE-2020-9834 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.8
A memory corruption issue was addressed with improved input validation. This issue is fixed in macOS Catalina 10.15.5. An application may be able to execute arbitrary code with kernel privileges.
Product
macOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Jun 9, 2020A memory initialization issue was addressed with improved memory handling.CVE-2020-9833 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
A memory initialization issue was addressed with improved memory handling. This issue is fixed in macOS Catalina 10.15.5. A local user may be able to read kernel memory.
Product
macOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Jun 9, 2020An out-of-bounds read was addressed with improved input validation.CVE-2020-9832 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Catalina 10.15.5. A malicious application may be able to determine kernel memory layout.
Product
macOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Jun 9, 2020An out-of-bounds read was addressed with improved bounds checking.CVE-2020-9831 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Catalina 10.15.5. A malicious application may be able to determine kernel memory layout.
Product
macOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Jun 9, 2020A logic issue was addressed with improved restrictions.CVE-2020-9824 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.5
A logic issue was addressed with improved restrictions. This issue is fixed in macOS Catalina 10.15.5. A non-privileged user may be able to modify restricted network settings.
Product
macOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Jun 9, 2020An out-of-bounds write issue was addressed with improved bounds checking.CVE-2020-9822 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.8
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Catalina 10.15.5. A malicious application may be able to execute arbitrary code with kernel privileges.
Product
macOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Jun 9, 2020A permissions issue existed.CVE-2020-9817 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.8
A permissions issue existed. This issue was addressed with improved permission validation. This issue is fixed in macOS Catalina 10.15.5. A malicious application may be able to gain root privileges.
Product
macOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com tools.cisco.com
Jun 9, 2020A logic issue was addressed with improved restrictions.CVE-2020-9804 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 4.6
A logic issue was addressed with improved restrictions. This issue is fixed in macOS Catalina 10.15.5. Inserting a USB device that sends invalid messages may cause a kernel panic.
Product
macOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Jun 9, 2020A validation issue was addressed with improved input sanitization.CVE-2020-9788 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.8
A validation issue was addressed with improved input sanitization. This issue is fixed in macOS Catalina 10.15.5. A file may be incorrectly rendered to execute JavaScript.
Product
macOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Jun 9, 2020This issue was addressed with improved checks.CVE-2020-3882 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 6.5
This issue was addressed with improved checks. This issue is fixed in macOS Catalina 10.15.5. Importing a maliciously crafted calendar invitation may exfiltrate user information.
Product
macOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Jun 8, 2020A heap-based buffer overflow in the hxxx_AnnexB_to_xVC function in modules/packetizer/hxxx_nal.c in VideoLAN VLC media player before 3.0.11 for macOS/iOS allowsCVE-2020-13428 · Other software · Videolan · reported by MITREHigh 7.8
A heap-based buffer overflow in the hxxx_AnnexB_to_xVC function in modules/packetizer/hxxx_nal.c in VideoLAN VLC media player before 3.0.11 for macOS/iOS allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via a crafted H.264 Annex-B video (.avi for example) file.
Product
VLC Media Player
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.videolan.org github.com
Jun 3, 2020Use after free in payments in Google Chrome on MacOS prior to 83.0.4103.97 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML CVE-2020-6496 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 8.8
Use after free in payments in Google Chrome on MacOS prior to 83.0.4103.97 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.
Product
Chrome
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.opensuse.org lists.opensuse.org
May 18, 2020An issue was discovered in the stashcat app through 3.9.1 for macOS, Windows, Android, iOS, and possibly other platforms.CVE-2020-13129 · Other software · Heinekingmedia · reported by MITREHigh 7.2
An issue was discovered in the stashcat app through 3.9.1 for macOS, Windows, Android, iOS, and possibly other platforms. The GET method is used with client_key and device_id data in the query string, which allows attackers to obtain sensitive information by reading web-server logs.
Product
Stashcat
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jvanlaak.de jvanlaak.de
May 13, 2020The Western Digital WD Discovery application before 3.8.229 for MyCloud Home on Windows and macOS is vulnerable to CSRF, with impacts such as stealing data, modCVE-2020-12427 · Other software · Westerndigital · reported by MITREHigh 8.8
The Western Digital WD Discovery application before 3.8.229 for MyCloud Home on Windows and macOS is vulnerable to CSRF, with impacts such as stealing data, modifying disk contents, or exhausting disk space.
Product
WD Discovery
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.wdc.com westerndigital.com
May 8, 2020An issue was discovered in Maxum Rumpus before 8.2.12 on macOS.CVE-2020-12737 · Other software · Maxum · reported by MITREMedium 6.5
An issue was discovered in Maxum Rumpus before 8.2.12 on macOS. Authenticated users can perform a path traversal using double escaped characters, enabling read access to arbitrary files on the server.
Product
Rumpus
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com maxum.com
Apr 16, 2020The Aviatrix OpenVPN client through 2.5.7 on Linux, macOS, and Windows is vulnerable when OpenSSL parameters are altered from the issued value set; the parameteCVE-2020-7224 · Other software · Aviatrix · reported by MITRECritical 9.8
The Aviatrix OpenVPN client through 2.5.7 on Linux, macOS, and Windows is vulnerable when OpenSSL parameters are altered from the issued value set; the parameters could allow unauthorized third-party libraries to load.
Product
Openvpn
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.aviatrix.com docs.aviatrix.com
Apr 1, 2020Zoom Client for Meetings through 4.6.8 on macOS has the disable-library-validation entitlement, which allows a local process (with the user's privileges) to obtCVE-2020-11470 · Other software · Zoom · reported by MITRELow 3.3
Zoom Client for Meetings through 4.6.8 on macOS has the disable-library-validation entitlement, which allows a local process (with the user's privileges) to obtain unprompted microphone and camera access by loading a crafted library and thereby inheriting Zoom Client's microphone and camera access.
Product
Meetings
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.zoom.us objective-see.com
Apr 1, 2020Zoom Client for Meetings through 4.6.8 on macOS copies runwithroot to a user-writable temporary directory during installation, which allows a local process (witCVE-2020-11469 · Other software · Zoom · reported by MITREHigh 7.8
Zoom Client for Meetings through 4.6.8 on macOS copies runwithroot to a user-writable temporary directory during installation, which allows a local process (with the user's privileges) to obtain root access by replacing runwithroot.
Product
Meetings
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.zoom.us objective-see.com
Apr 1, 2020A memory corruption issue was addressed with improved input validation.CVE-2020-3850 · Computers, phones & browsers · Apple · reported by product-security@apple.comCritical 9.8
A memory corruption issue was addressed with improved input validation. This issue is fixed in macOS Catalina 10.15.3. A remote attacker may be able to cause unexpected application termination or arbitrary code execution.
Product
macOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Apr 1, 2020A memory corruption issue was addressed with improved input validation.CVE-2020-3849 · Computers, phones & browsers · Apple · reported by product-security@apple.comCritical 9.8
A memory corruption issue was addressed with improved input validation. This issue is fixed in macOS Catalina 10.15.3. A remote attacker may be able to cause unexpected application termination or arbitrary code execution.
Product
macOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Apr 1, 2020A memory corruption issue was addressed with improved input validation.CVE-2020-3848 · Computers, phones & browsers · Apple · reported by product-security@apple.comCritical 9.8
A memory corruption issue was addressed with improved input validation. This issue is fixed in macOS Catalina 10.15.3. A remote attacker may be able to cause unexpected application termination or arbitrary code execution.
Product
macOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Apr 1, 2020An out-of-bounds read was addressed with improved input validation.CVE-2020-3847 · Computers, phones & browsers · Apple · reported by product-security@apple.comCritical 9.8
An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Catalina 10.15.3. A remote attacker may be able to leak memory.
Product
macOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Apr 1, 2020This issue was addressed with a new entitlement.CVE-2020-9776 · Computers, phones & browsers · Apple · reported by product-security@apple.comLow 3.3
This issue was addressed with a new entitlement. This issue is fixed in macOS Catalina 10.15.4. A malicious application may be able to access a user's call history.
Product
macOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Apr 1, 2020Multiple issues were addressed by updating to version 8.1.1850.CVE-2020-9769 · Computers, phones & browsers · Apple · reported by product-security@apple.comCritical 9.8
Multiple issues were addressed by updating to version 8.1.1850. This issue is fixed in macOS Catalina 10.15.4. Multiple issues in Vim.
Product
macOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Apr 1, 2020An out-of-bounds read was addressed with improved input validation.CVE-2020-3912 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.1
An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Catalina 10.15.4. A local user may be able to cause unexpected system termination or read kernel memory.
Product
macOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Apr 1, 2020An out-of-bounds read was addressed with improved input validation.CVE-2020-3908 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.1
An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Catalina 10.15.4. A local user may be able to cause unexpected system termination or read kernel memory.
Product
macOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Apr 1, 2020An out-of-bounds read was addressed with improved input validation.CVE-2020-3907 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.1
An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Catalina 10.15.4. A local user may be able to cause unexpected system termination or read kernel memory.
Product
macOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.