apple
118 records · 9 with a public proof-of-concept
Disclosed vulnerabilities where the NVD names apple as an affected vendor, highest CVSS first.
- CRITICAL 9.9CVE-2026-75682
Adobe Connect is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vu…
connect · macos · windows · connect for mobile
- CRITICAL 9.6CVE-2026-106414
Improper input validation in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium…
chrome · iphone os
- CRITICAL 9.6CVE-2026-106323
Missing authorization in Chrome for iOS in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Hi…
chrome · iphone os
- CRITICAL 9.6CVE-2026-106298
Use after free in Chrome Tabs in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
chrome · macos
- CRITICAL 9.6CVE-2026-95347
Use after free in Updater in Google Chrome on on Mac prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Medium)
chrome · macos
- CRITICAL 9.3CVE-2026-75698
Adobe Connect is affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or session. Ex…
connect · macos · windows · connect for mobile
- CRITICAL 9.3CVE-2026-75697
Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page …
connect · macos · windows · connect for mobile
- CRITICAL 9.3CVE-2026-75689
Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page …
connect · macos · windows · connect for mobile
- CRITICAL 9.3CVE-2026-75686
Adobe Connect is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue require…
connect · macos · windows · connect for mobile
- CRITICAL 9.3CVE-2026-75684
Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page …
connect · macos · windows · connect for mobile
- CRITICAL 9.1CVE-2026-106195
Incorrect authorization in Chromoting in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker to bypass system access restrictions via crafted network traffic. (Chromium security severity: Low)
chrome · macos
- HIGH 8.8CVE-2026-121050
Race condition in Mobile in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)
chrome · iphone os
- HIGH 8.8CVE-2026-118335
Improper input validation in Metrics in Google Chrome on on Mac prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
chrome · macos
- HIGH 8.8CVE-2026-118329
Improper input validation in ANGLE in Google Chrome on on Mac prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
chrome · macos
- HIGH 8.8CVE-2026-86929
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. Processing a maliciously crafted file may lead to arbitrary code execution.
macos
- HIGH 8.8CVE-2026-113947
This issue was addressed with improved access restrictions. This issue is fixed in macOS Golden Gate 27.2. Unpacking a maliciously crafted archive may lead to unexpected app termination or arbitrary code execution.
macos
- HIGH 8.8CVE-2026-112438
A logic issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An unprivileged attacker may be able to execute arbitrary code as root.
macos
- HIGH 8.8CVE-2026-113323
Use after free in Chrome for iOS in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
chrome · iphone os
- HIGH 8.8CVE-2026-113320public PoC
Memory corruption in Navigation in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
chrome · iphone os
- HIGH 8.8CVE-2026-113317
Memory corruption in Accessibility in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
chrome · macos
- HIGH 8.8CVE-2026-113312
Memory corruption in Autofill in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
chrome · macos
- HIGH 8.8CVE-2026-113282
Use after free in Views in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
chrome · macos
- HIGH 8.8CVE-2026-113268
Memory corruption in Navigation in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
chrome · iphone os
- HIGH 8.8CVE-2026-113249public PoC
Improper input validation in Mobile in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
chrome · iphone os
- HIGH 8.8CVE-2026-113236
Use after free in Navigation in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
chrome · iphone os
- HIGH 8.8CVE-2026-113191
Use after free in Internals in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
chrome · macos
- HIGH 8.8CVE-2026-113165
Use after free in Core in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
chrome · macos
- HIGH 8.8CVE-2026-113117
Improper input validation in ANGLE in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
chrome · macos
- HIGH 8.8CVE-2026-113043public PoC
Use after free in iOSWeb in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
chrome · iphone os
- HIGH 8.8CVE-2026-96957
Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network.
.net · macos · linux kernel · windows · visual studio 2022 · visual studio 2026
- HIGH 8.8CVE-2026-106387
Missing authorization in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
chrome · iphone os
- HIGH 8.8CVE-2026-106309
Incorrect authorization in Selection in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)
chrome · iphone os
- HIGH 8.8CVE-2026-106274
Incorrect reference resolution in Browser in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
chrome · macos
- HIGH 8.8CVE-2026-106203
Incomplete cleanup in Autofill in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: High)
chrome · iphone os
- HIGH 8.8CVE-2026-86950public PoC
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.1 and iPadOS 26.7.1, macOS Sequoia 15.8.1, macOS Tahoe 26.7.1. Processing a maliciously crafted file may lead to arbitrary code execution. Apple is aware …
ipados · iphone os · macos
- HIGH 8.6CVE-2026-34689
Adobe Connect is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories o…
connect · macos · windows · connect for mobile
- HIGH 8.4CVE-2026-65327
A logic issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. A local attacker may be able to elevate their privileges.
macos
- HIGH 8.3CVE-2026-121090
Improper privilege management in Navigation in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium securi…
chrome · iphone os
- HIGH 8.3CVE-2026-110156
Incorrect reference resolution in Extensions in Google Chrome on on Mac prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security s…
chrome · macos
- HIGH 8.3CVE-2026-106412
Race condition in Core in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chr…
chrome · macos
- HIGH 8.3CVE-2026-106409
Incorrect reference resolution in WebAppInstalls in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security …
chrome · macos
- HIGH 8.3CVE-2026-106378
Privilege elevation in Sandbox in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
chrome · macos
- HIGH 8.3CVE-2026-95355
Incorrect authorization in Navigation in Google Chrome on on iOS prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security sev…
chrome · iphone os
- HIGH 8.3CVE-2026-91748
Race condition in Extensions in Google Chrome on on Mac prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially execute arbitrary code outside the sandbox via UI Interaction. (Ch…
chrome · macos
- HIGH 8.3CVE-2026-91712
Race condition in Extensions in Google Chrome on on Mac prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Hi…
chrome · macos
- HIGH 8.1CVE-2026-121224
Security issue in Desktop in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: H…
chrome · macos
- HIGH 8.1CVE-2026-121133
Incorrect reference resolution in Images in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity…
chrome · macos
- HIGH 8.1CVE-2026-112427
An authentication issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27.2. A remote attacker may be able to cause arbitrary code execution.
macos
- HIGH 8.1CVE-2026-91727
Incorrect reference resolution in Extensions in Google Chrome on on Mac prior to 153.0.8010.47 allowed a local attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a local program. (Chromium security severity: Hig…
chrome · macos
- HIGH 7.8CVE-2026-112484
This issue was addressed with improved file handling. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. A malicious application may be able to execute arbitrary code with system privileges.
macos
- HIGH 7.8CVE-2026-97312
Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
photoshop · macos · windows
- HIGH 7.8CVE-2026-96523
Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
photoshop · macos · windows
- HIGH 7.8CVE-2026-96522
Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
photoshop · macos · windows
- HIGH 7.8CVE-2026-104348
Photoshop Desktop is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
photoshop · macos · windows
- HIGH 7.8CVE-2026-104347
Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
photoshop · macos · windows
- HIGH 7.8CVE-2026-104346
Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
photoshop · macos · windows
- HIGH 7.8CVE-2026-103821
Substance3D - Designer is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
substance 3d designer · macos · windows
- HIGH 7.8CVE-2026-100112
Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
photoshop · macos · windows
- HIGH 7.8CVE-2026-100111
Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
photoshop · macos · windows
- HIGH 7.8CVE-2026-75649
Bridge is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
bridge · macos · windows
- HIGH 7.6CVE-2026-106196
Missing authorization in Navigation in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy into a privileged page via a crafted HTML page. (Chromium security severity: Medium)
chrome · iphone os
- HIGH 7.5CVE-2026-96960
Asymmetric resource consumption (amplification) in .NET allows an unauthorized attacker to deny service over a network.
.net · macos · linux kernel · windows · .net framework · windows 11 26h1
- HIGH 7.5CVE-2026-96959
Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.
.net · macos · linux kernel · windows · .net framework · windows 11 26h1
- HIGH 7.5CVE-2026-96958
Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
.net · macos · linux kernel · windows · .net framework · windows 11 26h1
- HIGH 7.4CVE-2026-96222
Improper certificate validation in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.
windows 10 1607 · windows 10 1809 · windows server 2012 · windows server 2016 · windows server 2019 · windows server 2022
- HIGH 7.4CVE-2026-106279
Incorrect reference resolution in Passwords in Google Chrome on on iOS prior to 155.0.8059.39 allowed a local attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a local program. (Chromium security se…
chrome · iphone os
- HIGH 7.3CVE-2026-106189
Code injection in ReaderMode in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
chrome · iphone os
- HIGH 7.1CVE-2026-112457
A double free issue was addressed with improved memory management. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An attacker on the local network may be able to cause unexpected system termination or corrupt process m…
macos
- MEDIUM 6.5CVE-2026-84496
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS Tahoe 26.7.2. Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory.
macos
- MEDIUM 6.5CVE-2026-113943
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2. Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory.
macos
- MEDIUM 6.5CVE-2026-113939
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2. Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory.
macos
- MEDIUM 6.5CVE-2026-112544
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2. Mounting a malicious disk image may cause unexpected system termination.
macos
- MEDIUM 6.5CVE-2026-113329public PoC
Out of bounds read in Installer in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
chrome · macos
- MEDIUM 6.5CVE-2026-113325
Memory corruption in SignIn in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
chrome · iphone os
- MEDIUM 6.5CVE-2026-113246
Memory corruption in iOSWebView in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
chrome · iphone os
- MEDIUM 6.5CVE-2026-113209public PoC
Memory corruption in Navigation in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
chrome · iphone os
- MEDIUM 6.5CVE-2026-113178
Memory corruption in Views in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
chrome · macos
- MEDIUM 6.5CVE-2026-113077public PoC
Memory corruption in Core in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
chrome · macos
- MEDIUM 6.5CVE-2026-106408
Protection mechanism failure in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
chrome · iphone os
- MEDIUM 6.2CVE-2026-83964
Adobe Connect is affected by an Improper Certificate Validation vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue does not require user i…
connect · macos · windows · connect for mobile
- MEDIUM 6.1CVE-2026-106397
Incorrect authorization in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)
chrome · iphone os
- MEDIUM 6.1CVE-2026-48361
Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page …
connect · macos · windows · connect for mobile
- MEDIUM 5.9CVE-2026-106206
Improper input validation in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via crafted network traffic. (Chromium security severity: Medium)
chrome · iphone os
- MEDIUM 5.5CVE-2026-121199
Missing authorization in Chromoting in Google Chrome on on Mac prior to 157.0.8103.38 allowed a local attacker to obtain sensitive information via a local program. (Chromium security severity: Medium)
chrome · macos
- MEDIUM 5.5CVE-2026-86987
An authorization issue was addressed with improved entitlement checks. This issue is fixed in iOS 27.2 and iPadOS 27.2. A remote attacker may be able to access sensitive user data.
ipados · iphone os
- MEDIUM 5.5CVE-2026-105896
Photoshop Desktop is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of th…
photoshop · macos · windows
- MEDIUM 5.5CVE-2026-103829
Substance3D - Designer is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation …
substance 3d designer · macos · windows
- MEDIUM 5.5CVE-2026-103828
Substance3D - Designer is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation …
substance 3d designer · macos · windows
- MEDIUM 5.5CVE-2026-103827
Substance3D - Designer is affected by a Stack-based Buffer Overflow vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitati…
substance 3d designer · macos · windows
- MEDIUM 5.5CVE-2026-103826
Substance3D - Designer is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation …
substance 3d designer · macos · windows
- MEDIUM 5.5CVE-2026-103825
Substance3D - Designer is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction i…
substance 3d designer · macos · windows
- MEDIUM 5.5CVE-2026-103824
Substance3D - Designer is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation …
substance 3d designer · macos · windows
- MEDIUM 5.5CVE-2026-103823
Substance3D - Designer is affected by a Stack-based Buffer Overflow vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitati…
substance 3d designer · macos · windows
- MEDIUM 5.5CVE-2026-103822
Substance3D - Designer is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction i…
substance 3d designer · macos · windows
- MEDIUM 5.4CVE-2026-121186
UI misrepresentation in Passwords in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)
chrome · iphone os
- MEDIUM 5.4CVE-2026-121177
UI misrepresentation in PageInfo in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)
chrome · iphone os
- MEDIUM 5.4CVE-2026-121045
UI misrepresentation in Browser in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)
chrome · macos
- MEDIUM 5.4CVE-2026-106427
Confused deputy in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to bypass system access restrictions into a privileged page via a crafted HTML page. (Chromium security severity: Low)
chrome · iphone os
- MEDIUM 5.4CVE-2026-106406
Missing authorization in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)
chrome · iphone os
- MEDIUM 5.4CVE-2026-106316
UI misrepresentation in Chromoting in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via crafted network traffic. (Chromium security severity: Low)
chrome · macos
- MEDIUM 5.4CVE-2026-106296
Improper privilege management in UI in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)
chrome · macos
- MEDIUM 5.4CVE-2026-106251
UI misrepresentation in Chromoting in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via crafted network traffic. (Chromium security severity: Low)
chrome · macos
- MEDIUM 5.4CVE-2026-106209
UI misrepresentation in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof address bar via a crafted HTML page. (Chromium security severity: Medium)
chrome · iphone os
- MEDIUM 5.4CVE-2026-102305
UI misrepresentation in SignIn in Google Chrome on on iOS prior to 154.0.8037.92 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)
chrome · iphone os
- MEDIUM 5.4CVE-2026-95371public PoC
Missing authorization in Views in Google Chrome on on Mac prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medi…
chrome · macos
- MEDIUM 5.4CVE-2026-95323
UI misrepresentation in Chromium in Google Chrome on on iOS prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to spoof address bar via a crafted HTML page. (Chromium security severity: Medium)
chrome · iphone os
- MEDIUM 5.4CVE-2026-95309
UI misrepresentation in Mobile in Google Chrome on on iOS prior to 154.0.8037.57 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)
chrome · iphone os
- MEDIUM 5.4CVE-2026-95291
UI misrepresentation in SecurityIndicators in Google Chrome on on iOS prior to 154.0.8037.57 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: High)
chrome · iphone os
- MEDIUM 5.4CVE-2026-95288
UI misrepresentation in Mobile in Google Chrome on on iOS prior to 154.0.8037.57 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)
chrome · iphone os
- MEDIUM 5.3CVE-2026-112708
A race condition was addressed with improved locking. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to cause unexpected system termination or corrupt process memory.
macos
- MEDIUM 5.3CVE-2026-91744
Race condition in PlatformIntegration in Google Chrome on on Mac prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to obtain sensitive information via a crafted HTML page. (Chromium secur…
chrome · macos
- MEDIUM 4.8CVE-2026-112556
A race condition was addressed with additional validation. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An attacker may tamper with code-signed applications to execute arbitrary code in the application's context.
macos
- MEDIUM 4.8CVE-2026-91742
Confused deputy in PriceTracking in Google Chrome on on iOS prior to 153.0.8010.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions into a privileged page via crafted network traffic. (Chromium security severity: Med…
chrome · iphone os
- MEDIUM 4.7CVE-2026-106231
Uninitialized resource in Dawn in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)
chrome · macos
- MEDIUM 4.6CVE-2026-106192
Information leak in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a local attacker to obtain sensitive information via physical access. (Chromium security severity: Low)
chrome · iphone os
- MEDIUM 4.6CVE-2026-95295public PoC
Information leak in Mobile in Google Chrome on on iOS prior to 154.0.8037.57 allowed a local attacker to leak sensitive information via physical access. (Chromium security severity: Medium)
chrome · iphone os
- MEDIUM 4.3CVE-2026-112471
A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. Processing a maliciously crafted image may lead to unexpected process termination.
macos
- MEDIUM 4.3CVE-2026-95296
Missing authorization in Core in Google Chrome on on Mac prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Low)
chrome · macos