Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

479new WordPress flaws this week

390,525entries in the database

1,350 results · page 7 of 27

Sep 23, 2022A buffer overflow issue was addressed with improved memory handling.CVE-2022-22629 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 8.8
A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.3, Safari 15.4, watchOS 8.5, iTunes 12.12.3 for Windows, iOS 15.4 and iPadOS 15.4, tvOS 15.4. Processing maliciously crafted web content may lead to arbitrary code execution.
Product
Safari
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Sep 23, 2022A logic issue was addressed with improved state management.CVE-2022-22637 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 8.8
A logic issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.3, Safari 15.4, watchOS 8.5, iOS 15.4 and iPadOS 15.4, tvOS 15.4. A malicious website may cause unexpected cross-origin behavior.
Product
Safari
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Sep 23, 2022A use after free issue was addressed with improved memory management.CVE-2022-22628 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 8.8
A use after free issue was addressed with improved memory management. This issue is fixed in macOS Monterey 12.3, Safari 15.4, watchOS 8.5, iOS 15.4 and iPadOS 15.4, tvOS 15.4. Processing maliciously crafted web content may lead to arbitrary code execution.
Product
Safari
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Sep 23, 2022A use after free issue was addressed with improved memory management.CVE-2022-22624 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 8.8
A use after free issue was addressed with improved memory management. This issue is fixed in macOS Monterey 12.3, iOS 15.4 and iPadOS 15.4, tvOS 15.4, Safari 15.4. Processing maliciously crafted web content may lead to arbitrary code execution.
Product
Safari
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Sep 23, 2022A memory corruption issue was addressed with improved state management.CVE-2022-22610 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 8.8
A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.3, Safari 15.4, watchOS 8.5, iOS 15.4 and iPadOS 15.4, tvOS 15.4. Processing maliciously crafted web content may lead to code execution.
Product
Safari
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Mar 18, 2022A user interface issue was addressed.CVE-2022-22654 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 4.3
A user interface issue was addressed. This issue is fixed in watchOS 8.5, Safari 15.4. Visiting a malicious website may lead to address bar spoofing.
Product
Safari
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Dec 30, 2021SAFARI Montage 8.7.32 is affected by a CRLF injection vulnerability which can lead to HTTP response splitting.CVE-2021-45818 · Other software · Safarimontage · reported by MITREMedium 6.1
SAFARI Montage 8.7.32 is affected by a CRLF injection vulnerability which can lead to HTTP response splitting.
Product
Safari Montage
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drive.google.com drive.google.com
Dec 28, 2021Reflected Cross Site Scripting (XSS) in SAFARI Montage versions 8.3 and 8.5 allows remote attackers to execute JavaScript codes.CVE-2021-45425 · Other software · Safarimontage · reported by MITREMedium 6.1
Reflected Cross Site Scripting (XSS) in SAFARI Montage versions 8.3 and 8.5 allows remote attackers to execute JavaScript codes.
Product
Safari Montage
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com drive.google.com
Sep 29, 2021The Safari app extension bundled with 1Password for Mac 7.7.0 through 7.8.x before 7.8.7 is vulnerable to authorization bypass.CVE-2021-41795 · Other software · 1password · reported by MITREMedium 6.5
The Safari app extension bundled with 1Password for Mac 7.7.0 through 7.8.x before 7.8.7 is vulnerable to authorization bypass. By targeting a vulnerable component of this extension, a malicious web page could read a subset of 1Password vault items that would normally be fillable by the user on that web page. These items are usernames and passwords for vault items associated with its domain, usernames and passwords without a domain association, credit cards, and contact items. (1Password must be unlocked for these items to be accessible, but no further user interaction is required.)
Product
1password
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.1password.com support.1password.com
Jun 29, 2021Machform prior to version 16 is vulnerable to an open redirect in Safari_init.php due to an improperly sanitized 'ref' parameter.CVE-2021-20105 · Other software · Machform · reported by vulnreport@tenable.comMedium 6.1
Machform prior to version 16 is vulnerable to an open redirect in Safari_init.php due to an improperly sanitized 'ref' parameter.
Product
Machform
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tenable.com tenable.com
Dec 8, 2020An inconsistent user interface issue was addressed with improved state management.CVE-2020-9987 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 4.3
An inconsistent user interface issue was addressed with improved state management. This issue is fixed in Safari 14.0. Visiting a malicious website may lead to address bar spoofing.
Product
Safari
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Dec 8, 2020An inconsistent user interface issue was addressed with improved state management.CVE-2020-9942 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 4.3
An inconsistent user interface issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.0.1, Safari 13.1.2. Visiting a malicious website may lead to address bar spoofing.
Product
Safari
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org support.apple.com
Oct 27, 2020A custom URL scheme handling issue was addressed with improved input validation.CVE-2020-9860 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.4
A custom URL scheme handling issue was addressed with improved input validation. This issue is fixed in Safari 13.0.5. Processing a maliciously crafted URL may lead to arbitrary javascript code execution.
Product
Safari
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Oct 27, 2020A logic issue was addressed with improved validation.CVE-2020-3852 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.3
A logic issue was addressed with improved validation. This issue is fixed in Safari 13.0.5. A URL scheme may be incorrectly ignored when determining multimedia permission for a website.
Product
Safari
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Oct 27, 2020This issue was addressed with improved iframe sandbox enforcement.CVE-2019-8771 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 6.1
This issue was addressed with improved iframe sandbox enforcement. This issue is fixed in Safari 13.0.1, iOS 13. Maliciously crafted web content may violate iframe sandboxing policy.
Product
Safari
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Oct 16, 2020An out-of-bounds write issue was addressed with improved bounds checking.CVE-2020-9983 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 8.8
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in Safari 14.0. Processing maliciously crafted web content may lead to code execution.
Product
Safari
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org seclists.org
Oct 16, 2020A use after free issue was addressed with improved memory management.CVE-2020-9951 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 8.8
A use after free issue was addressed with improved memory management. This issue is fixed in Safari 14.0. Processing maliciously crafted web content may lead to arbitrary code execution.
Product
Safari
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org seclists.org
Oct 16, 2020A type confusion issue was addressed with improved memory handling.CVE-2020-9948 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 8.8
A type confusion issue was addressed with improved memory handling. This issue is fixed in Safari 14.0. Processing maliciously crafted web content may lead to arbitrary code execution.
Product
Safari
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org openwall.com
Oct 16, 2020A logic issue was addressed with improved restrictions.CVE-2020-9912 · Computers, phones & browsers · Apple · reported by product-security@apple.comLow 3.3
A logic issue was addressed with improved restrictions. This issue is fixed in Safari 13.1.2. A malicious attacker may be able to change the origin of a frame for a download in Safari Reader mode.
Product
Safari
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Jun 9, 2020A logic issue was addressed with improved restrictions.CVE-2020-9801 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.3
A logic issue was addressed with improved restrictions. This issue is fixed in Safari 13.1.1. A malicious process may cause Safari to launch an application.
Product
Safari
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Apr 1, 2020A logic issue was addressed with improved restrictions.CVE-2020-9784 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 4.3
A logic issue was addressed with improved restrictions. This issue is fixed in Safari 13.1. A malicious iframe may use another website’s download settings.
Product
Safari
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Feb 27, 2020An inconsistent user interface issue was addressed with improved state management.CVE-2020-3833 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 4.3
An inconsistent user interface issue was addressed with improved state management. This issue is fixed in Safari 13.0.5. Visiting a malicious website may lead to address bar spoofing.
Product
Safari
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Feb 3, 2020A Cross-origin vulnerability exists in WebKit in Apple Safari before 10.0.1 when processing location attributes, which could let a remote malicious user obtain CVE-2016-4676 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.5
A Cross-origin vulnerability exists in WebKit in Apple Safari before 10.0.1 when processing location attributes, which could let a remote malicious user obtain sensitive information.
Product
Safari
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org securityfocus.com
Dec 18, 2019The issue was addressed with improved handling of service worker lifetime.CVE-2019-8725 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.3
The issue was addressed with improved handling of service worker lifetime. This issue is fixed in Safari 13.0.1. Service workers may leak private browsing history.
Product
Safari
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Dec 18, 2019An inconsistent user interface issue was addressed with improved state management.CVE-2019-8654 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 6.5
An inconsistent user interface issue was addressed with improved state management. This issue is fixed in Safari 13.0.1. Visiting a malicious website may lead to user interface spoofing.
Product
Safari
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Sep 24, 2019DOMPurify before 2.0.1 allows XSS because of innerHTML mutation XSS (mXSS) for an SVG element or a MATH element, as demonstrated by Chrome and Safari.CVE-2019-16728 · Other software · Cure53 · reported by MITREMedium 6.1
DOMPurify before 2.0.1 allows XSS because of innerHTML mutation XSS (mXSS) for an SVG element or a MATH element, as demonstrated by Chrome and Safari.
Product
Dompurify
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.debian.org research.securitum.com
Aug 23, 2019CodiMD 1.3.1, when Safari is used, allows XSS via an IFRAME element with allow-top-navigation in the sandbox attribute, in conjunction with a data: URL.CVE-2019-15499 · Other software · Hackmd · reported by MITREMedium 6.1
CodiMD 1.3.1, when Safari is used, allows XSS via an IFRAME element with allow-top-navigation in the sandbox attribute, in conjunction with a data: URL.
Product
Codimd
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Apr 3, 2019Multiple memory corruption issues were addressed with improved memory handling.CVE-2018-4464 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 8.8
Multiple memory corruption issues were addressed with improved memory handling. This issue affected versions prior to iOS 12.1.1, tvOS 12.1.1, watchOS 5.1.2, Safari 12.0.2, iTunes 12.9.2 for Windows, iCloud for Windows 7.9.
Product
Safari
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Apr 3, 2019"Clear History and Website Data" did not clear the history.CVE-2018-4445 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 4.3
"Clear History and Website Data" did not clear the history. The issue was addressed with improved data deletion. This issue affected versions prior to iOS 12.1.1, Safari 12.0.2.
Product
Safari
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Apr 3, 2019A memory corruption issue was addressed with improved memory handling.CVE-2018-4443 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 8.8
A memory corruption issue was addressed with improved memory handling. This issue affected versions prior to iOS 12.1.1, tvOS 12.1.1, watchOS 5.1.2, Safari 12.0.2, iTunes 12.9.2 for Windows, iCloud for Windows 7.9.
Product
Safari
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Apr 3, 2019A memory corruption issue was addressed with improved memory handling.CVE-2018-4442 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 8.8
A memory corruption issue was addressed with improved memory handling. This issue affected versions prior to iOS 12.1.1, tvOS 12.1.1, watchOS 5.1.2, Safari 12.0.2, iTunes 12.9.2 for Windows, iCloud for Windows 7.9.
Product
Safari
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Apr 3, 2019A memory corruption issue was addressed with improved memory handling.CVE-2018-4441 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 8.8
A memory corruption issue was addressed with improved memory handling. This issue affected versions prior to iOS 12.1.1, tvOS 12.1.1, watchOS 5.1.2, Safari 12.0.2, iTunes 12.9.2 for Windows, iCloud for Windows 7.9.
Product
Safari
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Apr 3, 2019A logic issue was addressed with improved state management.CVE-2018-4440 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 4.3
A logic issue was addressed with improved state management. This issue affected versions prior to iOS 12.1.1, Safari 12.0.2, iTunes 12.9.2 for Windows, iCloud for Windows 7.9.
Product
Safari
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Apr 3, 2019A logic issue was addressed with improved validation.CVE-2018-4439 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 6.5
A logic issue was addressed with improved validation. This issue affected versions prior to iOS 12.1.1, Safari 12.0.2, iTunes 12.9.2 for Windows, iCloud for Windows 7.9.
Product
Safari
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Apr 3, 2019A logic issue existed resulting in memory corruption.CVE-2018-4438 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 8.8
A logic issue existed resulting in memory corruption. This was addressed with improved state management. This issue affected versions prior to iOS 12.1.1, tvOS 12.1.1, watchOS 5.1.2, Safari 12.0.2, iTunes 12.9.2 for Windows, iCloud for Windows 7.9.
Product
Safari
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Apr 3, 2019Multiple memory corruption issues were addressed with improved memory handling.CVE-2018-4437 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 8.8
Multiple memory corruption issues were addressed with improved memory handling. This issue affected versions prior to iOS 12.1.1, tvOS 12.1.1, watchOS 5.1.2, Safari 12.0.2, iTunes 12.9.2 for Windows, iCloud for Windows 7.9.
Product
Safari
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Apr 3, 2019Multiple memory corruption issues were addressed with improved memory handling.CVE-2018-4416 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 8.8
Multiple memory corruption issues were addressed with improved memory handling. This issue affected versions prior to iOS 12.1, tvOS 12.1, watchOS 5.1, Safari 12.0.1, iTunes 12.9.1, iCloud for Windows 7.8.
Product
Safari
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Apr 3, 2019A resource exhaustion issue was addressed with improved input validation.CVE-2018-4409 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 6.5
A resource exhaustion issue was addressed with improved input validation. This issue affected versions prior to iOS 12.1, tvOS 12.1, Safari 12.0.1, iTunes 12.9.1, iCloud for Windows 7.8.
Product
Safari
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Apr 3, 2019Multiple memory corruption issues were addressed with improved memory handling.CVE-2018-4392 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 8.8
Multiple memory corruption issues were addressed with improved memory handling. This issue affected versions prior to iOS 12.1, tvOS 12.1, watchOS 5.1, Safari 12.0.1, iTunes 12.9.1, iCloud for Windows 7.8.
Product
Safari
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Apr 3, 2019Multiple memory corruption issues were addressed with improved memory handling.CVE-2018-4386 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 8.8
Multiple memory corruption issues were addressed with improved memory handling. This issue affected versions prior to iOS 12.1, tvOS 12.1, watchOS 5.1, Safari 12.0.1, iTunes 12.9.1, iCloud for Windows 7.8.
Product
Safari
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com support.apple.com
Apr 3, 2019Multiple memory corruption issues were addressed with improved memory handling.CVE-2018-4382 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 8.8
Multiple memory corruption issues were addressed with improved memory handling. This issue affected versions prior to iOS 12.1, tvOS 12.1, watchOS 5.1, Safari 12.0.1, iTunes 12.9.1, iCloud for Windows 7.8.
Product
Safari
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Apr 3, 2019A memory corruption issue was addressed with improved validation.CVE-2018-4378 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 8.8
A memory corruption issue was addressed with improved validation. This issue affected versions prior to iOS 12.1, tvOS 12.1, watchOS 5.1, Safari 12.0.1, iTunes 12.9.1, iCloud for Windows 7.8.
Product
Safari
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Apr 3, 2019A cross-site scripting issue existed in Safari.CVE-2018-4377 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 6.1
A cross-site scripting issue existed in Safari. This issue was addressed with improved URL validation. This issue affected versions prior to iOS 12.1, watchOS 5.1, Safari 12.0.1, iTunes 12.9.1, iCloud for Windows 7.8.
Product
Safari
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Apr 3, 2019Multiple memory corruption issues were addressed with improved memory handling.CVE-2018-4376 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 8.8
Multiple memory corruption issues were addressed with improved memory handling. This issue affected versions prior to iOS 12.1, watchOS 5.1, Safari 12.0.1, iTunes 12.9.1, iCloud for Windows 7.8.
Product
Safari
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Apr 3, 2019Multiple memory corruption issues were addressed with improved memory handling.CVE-2018-4375 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 8.8
Multiple memory corruption issues were addressed with improved memory handling. This issue affected versions prior to iOS 12.1, watchOS 5.1, Safari 12.0.1, iTunes 12.9.1, iCloud for Windows 7.8.
Product
Safari
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Apr 3, 2019A logic issue was addressed with improved validation.CVE-2018-4374 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 6.1
A logic issue was addressed with improved validation. This issue affected versions prior to iOS 12.1, watchOS 5.1, Safari 12.0.1, iTunes 12.9.1, iCloud for Windows 7.8.
Product
Safari
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Apr 3, 2019Multiple memory corruption issues were addressed with improved memory handling.CVE-2018-4373 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 8.8
Multiple memory corruption issues were addressed with improved memory handling. This issue affected versions prior to iOS 12.1, watchOS 5.1, Safari 12.0.1, iTunes 12.9.1, iCloud for Windows 7.8.
Product
Safari
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Apr 3, 2019Multiple memory corruption issues were addressed with improved memory handling.CVE-2018-4372 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 8.8
Multiple memory corruption issues were addressed with improved memory handling. This issue affected versions prior to iOS 12.1, tvOS 12.1, watchOS 5.1, Safari 12.0.1, iTunes 12.9.1, iCloud for Windows 7.8.
Product
Safari
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Apr 3, 2019An inconsistent user interface issue was addressed with improved state management.CVE-2018-4362 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 6.5
An inconsistent user interface issue was addressed with improved state management. This issue affected versions prior to Safari 11.1.2, iOS 12.
Product
Safari
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Apr 3, 2019A memory consumption issue was addressed with improved memory handling.CVE-2018-4361 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 8.8
A memory consumption issue was addressed with improved memory handling. This issue affected versions prior to iOS 12, tvOS 12, watchOS 5, Safari 12, iTunes 12.9 for Windows, iCloud for Windows 7.7.
Product
Safari
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.