XC
Product
Xcode
On CISA KEVExploited in the wild
99
CVEs
1
On KEV
9.8
Max CVSS
4
New 30D
Severity mix
Critical 4High 47Medium 21Low 2
Watch
Add Xcode to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-43263 | 7.1 | Sep 15 | The issue was addressed with improved checks Affected: before 26.0 |
| CVE-2023-27945 | 6.3 | May 8 | This issue was addressed with improved entitlements Affected: before 14.3 |
| CVE-2026-28889 | 6.2 | Mar 25 | A permissions issue was addressed with additional restrictions Affected: before 26.4 |
| CVE-2018-16845 | 6.1 | Nov 7 | nginx before versions 1.15.6, 1.14.1 has a vulnerability in the ngx_http_mp4_module, which might allow an attacker to cause infinite loop in a worker process, cause a worker… Affected: before 13.0 |
| CVE-2026-65393 | 5.5 | Sep 14 | A permissions issue was addressed with improved validation Affected: before 27 |
| CVE-2026-28890 | 5.5 | Mar 25 | An out-of-bounds read was addressed with improved bounds checking Affected: before 26.4 |
| CVE-2025-43375 | 5.5 | Sep 15 | The issue was addressed with improved checks Affected: before 26.0 |
| CVE-2025-30441 | 5.5 | Mar 31 | This issue was addressed through improved state management Affected: before 16.3 |
| CVE-2025-24226 | 5.5 | Mar 31 | The issue was addressed with improved checks Affected: before 16.3 |
| CVE-2024-44191 | 5.5 | Sep 17 | This issue was addressed through improved state management Affected: before 16.0 |
| CVE-2024-23298 | 5.5 | Mar 15 | A logic issue was addressed with improved state management Affected: before 15.3 |
| CVE-2023-40435 | 5.5 | Sep 27 | This issue was addressed by enabling hardened runtime Affected: before 15.0 |
| CVE-2023-40391 | 5.5 | Sep 27 | The issue was addressed with improved memory handling Affected: before 15.0 |
| CVE-2022-32920 | 5.5 | Sep 6 | The issue was addressed with improved checks Affected: before 14.0 |
| CVE-2022-39253 | 5.5 | Oct 19 | Git subject to exposure of sensitive information via local clone of symbolic links Affected: before 14.1 |
| CVE-2021-1800 | 5.5 | Apr 2 | A path handling issue was addressed with improved validation Affected: before 12.4 |
| CVE-2024-40862 | 5.3 | Sep 17 | A privacy issue was addressed by removing sensitive data Affected: before 16.0 |
| CVE-2019-20372 | 5.3 | Jan 9 | NGINX before 1.17.7, with certain error_page configurations, allows HTTP request smuggling, as demonstrated by the ability of an attacker to read unauthorized web pages in… Affected: before 13.0 |
| CVE-2016-0747 | 5.3 | Feb 15 | The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 does not properly limit CNAME resolution, which allows remote attackers to cause a denial of service (worker process… Affected: before 13.0 |
| CVE-2025-43504 | 4.9 | Nov 4 | A buffer overflow was addressed with improved bounds checking Affected: before 26.1 |
| CVE-2026-86875 | 4.3 | Oct 20 | An input validation issue was addressed with improved input validation Affected: before 27 |
| CVE-2025-43370 | 4.0 | Sep 15 | A path handling issue was addressed with improved validation Affected: before 26.0 |
| CVE-2026-86874 | 3.3 | Oct 20 | An out-of-bounds read was addressed with improved input validation Affected: before 27 |
| CVE-2025-31186 | 3.3 | Jan 16 | A permissions issue was addressed with additional restrictions Affected: before 16.3 |
| CVE-2026-86948 | – | Oct 20 | This issue was addressed by enforcing library validation on the affected binaries Affected: before 27 |
| CVE-2015-7057 | – | Dec 11 | otools in Apple Xcode before 7.2 allows local users to gain privileges or cause a denial of service (memory corruption) via a crafted mach-o file, a different vulnerability than… Affected: through 7.1.1 |
| CVE-2015-7056 | – | Dec 11 | IDE SCM in Apple Xcode before 7.2 does not recognize .gitignore files, which allows remote attackers to obtain sensitive information in opportunistic circumstances by leveraging… Affected: through 7.1.1 |
| CVE-2015-7049 | – | Dec 11 | otools in Apple Xcode before 7.2 allows local users to gain privileges or cause a denial of service (memory corruption) via a crafted mach-o file, a different vulnerability than… Affected: through 7.1.1 |
| CVE-2015-7030 | – | Oct 23 | The Swift implementation in Apple Xcode before 7.1 mishandles type conversion, which has unspecified impact and attack vectors Affected: through 7.0 |
| CVE-2015-5910 | – | Sep 18 | IDE Xcode Server in Apple Xcode before 7.0 does not ensure that server traffic is encrypted, which allows remote attackers to obtain sensitive information by sniffing the network Affected: through 6.4 |
| CVE-2015-5909 | – | Sep 18 | IDE Xcode Server in Apple Xcode before 7.0 does not properly restrict access to repository e-mail lists, which allows remote attackers to obtain potentially sensitive build… Affected: through 6.4 |
| CVE-2015-3187 | – | Aug 12 | The svn_repos_trace_node_locations function in Apache Subversion before 1.7.21 and 1.8.x before 1.8.14, when path-based authorization is used, allows remote authenticated users to… Affected: through 7.2.1 |
| CVE-2015-3184 | – | Aug 12 | mod_authz_svn in Apache Subversion 1.7.x before 1.7.21 and 1.8.x before 1.8.14, when using Apache httpd 2.4.x, does not properly restrict anonymous access, which allows remote… Affected: through 7.2.1 |
| CVE-2015-3185 | – | Jul 20 | The ap_some_auth_required function in server/request.c in the Apache HTTP Server 2.4.x before 2.4.14 does not consider that a Require directive may be associated with an… Affected: 7.0 |
| CVE-2015-3027 | – | Apr 10 | Clang in LLVM, as used in Apple Xcode before 6.3, performs incorrect register allocation in a way that triggers stack storage for stack cookie pointers, which might allow… Affected: through 6.2 |
| CVE-2015-1149 | – | Apr 10 | Integer overflow in the simulator in Swift in Apple Xcode before 6.3 allows context-dependent attackers to cause a denial of service or possibly have unspecified other impact by… Affected: through 6.2 |
| CVE-2015-0251 | – | Apr 8 | The mod_dav_svn server in Subversion 1.5.0 through 1.7.19 and 1.8.0 through 1.8.11 allows remote authenticated users to spoof the svn:author property via a crafted v1 HTTP… Affected: 7.0 |
| CVE-2015-0248 | – | Apr 8 | The (1) mod_dav_svn and (2) svnserve servers in Subversion 1.6.0 through 1.7.19 and 1.8.0 through 1.8.11 allow remote attackers to cause a denial of service (assertion failure and… Affected: 7.0 |
| CVE-2014-8108 | – | Dec 18 | The mod_dav_svn Apache HTTPD server module in Apache Subversion 1.7.x before 1.7.19 and 1.8.x before 1.8.11 allows remote attackers to cause a denial of service (NULL pointer… Affected: 6.1.1 |
| CVE-2014-3580 | – | Dec 18 | The mod_dav_svn Apache HTTPD server module in Apache Subversion 1.x before 1.7.19 and 1.8.x before 1.8.11 allows remote attackers to cause a denial of service (NULL pointer… Affected: 6.1.1 |
| CVE-2014-6394 | – | Oct 8 | visionmedia send before 0.8.4 for Node.js uses a partial comparison for verifying whether a directory is within the document root, which allows remote attackers to access… Affected: 7.0 |
| CVE-2014-3528 | – | Aug 19 | Apache Subversion 1.0.0 through 1.7.x before 1.7.17 and 1.8.x before 1.8.10 uses an MD5 hash of the URL and authentication realm to store cached credentials, which makes it easier… Affected: 6.1.1 |
| CVE-2014-3522 | – | Aug 19 | The Serf RA layer in Apache Subversion 1.4.0 through 1.7.x before 1.7.18 and 1.8.x before 1.8.10 does not properly handle wildcards in the Common Name (CN) or subjectAltName field… Affected: 6.1.1 |
| CVE-2012-3698 | – | Jul 26 | Apple Xcode before 4.4 does not properly compose a designated requirement (DR) during signing of programs that lack bundle identifiers, which allows remote attackers to read… Affected: through 4.3.3; 1.5.0; 2.0.0; 2.1.0; 2.2.0; 2.3.0; +21 more |
| CVE-2008-2318 | – | Jul 14 | The WOHyperlink implementation in WebObjects in Apple Xcode tools before 3.1 appends local session IDs to generated non-local URLs, which allows remote attackers to obtain… Affected: 1.5; 2.2 |
| CVE-2006-5327 | – | Oct 17 | Untrusted search path vulnerability in OpenBase SQL 10.0 and earlier, as used in Apple Xcode 2.2 2.2 and earlier and possibly other products, allows local users to execute… Affected: through 2.2 |
| CVE-2006-5328 | – | Oct 17 | OpenBase SQL 10.0 and earlier, as used in Apple Xcode 2.2 2.2 and earlier and possibly other products, allows local users to create arbitrary files via a symlink attack on the… Affected: through 2.2 |
| CVE-2006-1466 | – | May 24 | Xcode Tools before 2.3 for Mac OS X 10.4, when running the WebObjects plugin, allows remote attackers to access or modify WebObjects projects through a network service Affected: through 2.2 |
| CVE-2004-2687 | – | Dec 31 | distcc 2.x, as used in XCode 1.5 and others, when not configured to restrict access to the server port, allows remote attackers to execute arbitrary commands via compilation jobs,… Affected: 1.5 |