MA
Operating System
macOS
On CISA KEVExploited in the wildRansomware-linked
3,583
CVEs
79
On KEV
10.0
Max CVSS
336
New 30D
Severity mix
Critical 229High 260Medium 11Low 0
Watch
Add macOS to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-37434 | 9.8 | Aug 5 | zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field Affected: 11.0 before 11.7.1; 12.0.0 before 12.6.1 |
| CVE-2022-32207 | 9.8 | Jul 7 | When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporary name to the final… Affected: before 13.0 |
| CVE-2022-26776 | 9.8 | May 26 | This issue was addressed with improved checks Affected: 11.0 before 11.6.6; 12.0.0 before 12.4 |
| CVE-2022-26775 | 9.8 | May 26 | An integer overflow was addressed with improved input validation Affected: 12.0.0 before 12.4 |
| CVE-2022-26723 | 9.8 | May 26 | A memory corruption issue was addressed with improved input validation Affected: 11.0 before 11.6.6; 12.0 before 12.4 |
| CVE-2022-26711 | 9.8 | May 26 | An integer overflow issue was addressed with improved input validation Affected: 12.0.0 before 12.4 |
| CVE-2022-26708 | 9.8 | May 26 | This issue was addressed with improved checks Affected: 12.0.0 before 12.4 |
| CVE-2022-22641 | 9.8 | Mar 18 | A use after free issue was addressed with improved memory management Affected: 12.0 before 12.3 |
| CVE-2022-22632 | 9.8 | Mar 18 | A logic issue was addressed with improved state management Affected: 11.6 before 11.6.5; 12.0 before 12.3 |
| CVE-2022-22586 | 9.8 | Mar 18 | An out-of-bounds write issue was addressed with improved bounds checking Affected: before 12.2 |
| CVE-2022-22720 | 9.8 | Mar 14 | Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing the server to HTTP Request Smuggling Affected: before 10.15.7; 11.0 before 11.6.6; 12.0 through 12.4 |
| CVE-2022-0318 | 9.8 | Jan 21 | Heap-based Buffer Overflow in vim/vim prior to 8.2 Affected: before 13.0 |
| CVE-2021-44790 | 9.8 | Dec 20 | A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts) Affected: before 10.15.7; 11.0 before 11.6.6; 12.0 before 12.4 |
| CVE-2021-30678 | 9.8 | Sep 8 | A logic issue was addressed with improved state management Affected: 11.0 before 11.4 |
| CVE-2021-30655 | 9.8 | Sep 8 | An application may be able to execute arbitrary code with system privileges Affected: 11.0 before 11.3 |
| CVE-2021-1882 | 9.8 | Sep 8 | A memory corruption issue was addressed with improved validation Affected: 11.0 before 11.3 |
| CVE-2021-1834 | 9.8 | Sep 8 | An out-of-bounds write issue was addressed with improved bounds checking Affected: 11.0 before 11.3 |
| CVE-2021-1829 | 9.8 | Sep 8 | A type confusion issue was addressed with improved state handling Affected: 11.0 before 11.3 |
| CVE-2021-1770 | 9.8 | Sep 8 | A buffer overflow may result in arbitrary code execution Affected: 11.0 before 11.3 |
| CVE-2021-30805 | 9.8 | Sep 8 | A memory corruption issue was addressed with improved input validation Affected: 11.0 before 11.5 |
| CVE-2021-30793 | 9.8 | Sep 8 | A logic issue was addressed with improved state management Affected: 11.0 before 11.5 |
| CVE-2021-31009 | 9.8 | Aug 24 | Multiple issues were addressed by removing HDF5 Affected: 12.0.0 before 12.1 |
| CVE-2021-1818 | 9.8 | Apr 2 | A logic issue was addressed with improved state management Affected: 11.0 before 11.2 |
| CVE-2024-4558 | 9.6 | May 7 | Use after free in ANGLE in Google Chrome prior to 124.0.6367.155 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page Affected: before 14.6 |
| CVE-2026-64740 | 9.3 | Jul 27 | A parsing issue in the handling of directory paths was addressed with improved path validation Affected: before 14.8.8; before 15.7.8; before 26.6 |
| CVE-2026-28827 | 9.3 | Mar 25 | A parsing issue in the handling of directory paths was addressed with improved path validation Affected: before 14.8.5; before 15.7.5; before 26.4 |
| CVE-2026-20688 | 9.3 | Mar 25 | A path handling issue was addressed with improved validation Affected: before 14.8.5; before 15.7.5; before 26.4 |
| CVE-2024-44206 | 9.3 | Oct 24 | An issue in the handling of URL protocols was addressed with improved logic Affected: before 14.6 |
| CVE-2026-43790 | 9.1 | Sep 14 | The issue was addressed with improved memory handling Affected: before 15.8; before 26.7; before 27 |
| CVE-2026-84625 | 9.1 | Sep 14 | A permissions issue was addressed with additional sandbox restrictions Affected: before 27 |
| CVE-2026-86881 | 9.1 | Sep 14 | A certificate validation issue was addressed with improved certificate validation Affected: before 15.8; before 26.7; before 27 |
| CVE-2026-39868 | 9.1 | Jun 29 | This issue was addressed with improved input validation Affected: before 14.8.8; before 15.7.8; before 26.5.2 |
| CVE-2025-43273 | 9.1 | Jul 29 | A permissions issue was addressed with additional sandbox restrictions Affected: before 14.8; before 15.6 |
| CVE-2025-31281 | 9.1 | Jul 29 | An input validation issue was addressed with improved memory handling Affected: before 15.6 |
| CVE-2025-31263 | 9.1 | May 29 | The issue was addressed with improved memory handling Affected: before 15.4 |
| CVE-2025-30448 | 9.1 | May 12 | This issue was addressed with additional entitlement checks Affected: before 13.7.6; 14.0 before 14.7.6; 15.0 before 15.4 |
| CVE-2025-24154 | 9.1 | Jan 27 | An out-of-bounds write was addressed with improved input validation Affected: before 13.7.3; 14.0 before 14.7.3; 15.0 before 15.3 |
| CVE-2024-54542 | 9.1 | Jan 27 | An authentication issue was addressed with improved state management Affected: before 15.2 |
| CVE-2024-54530 | 9.1 | Jan 27 | The issue was addressed with improved checks Affected: before 15.2 |
| CVE-2023-40436 | 9.1 | Sep 27 | The issue was addressed with improved bounds checks Affected: before 14.0 |
| CVE-2023-27958 | 9.1 | May 8 | The issue was addressed with improved memory handling Affected: 11.0 before 11.7.5; 12.0 before 12.6.4; 13.0 before 13.3 |
| CVE-2022-32847 | 9.1 | Sep 23 | This issue was addressed with improved checks Affected: before 10.15.7; 11.0 before 11.6.8; 12.0 before 12.5; 10.15.7; 10.15.7 |
| CVE-2022-26694 | 9.1 | May 26 | This issue was addressed with improved checks Affected: 12.0.0 before 12.4 |
| CVE-2022-26693 | 9.1 | May 26 | This issue was addressed with improved checks Affected: 12.0.0 before 12.4 |
| CVE-2022-22721 | 9.1 | Mar 14 | If LimitXMLRequestBody is set to allow request bodies larger than 350MB (defaults to 1M) on 32 bit systems an integer overflow happens which later causes out of bounds writes Affected: 11.0 before 11.6.6; 12.0 before 12.4 |
| CVE-2021-22945 | 9.1 | Sep 23 | When sending data to an MQTT server, libcurl <= 7.73.0 and 7.78.0 could in some circumstances erroneously keep a pointer to an already freed memory area and both use that again in… Affected: 12.0.0 before 12.3 |
| CVE-2021-30925 | 9.1 | Aug 24 | The issue was addressed with improved permissions logic Affected: before 11.6 |
| CVE-2021-30856 | 9.1 | Aug 24 | This issue was addressed by adding a new Remote Login option for opting into Full Disk Access for Secure Shell sessions Affected: 11.0 before 11.3 |
| CVE-2026-20677 | 9.0 | Feb 11 | A race condition was addressed with improved handling of symbolic links Affected: before 14.8.4; before 15.7.4; before 26.3 |
| CVE-2026-86929 New | 8.8 | Oct 26 | An out-of-bounds write issue was addressed with improved bounds checking Affected: before 15.8.2; before 26.7.2; before 27 |
The 500 most important CVEs for this product (exploited first, then by severity)