XC
Product
Xcode
On CISA KEVExploited in the wild
99
CVEs
1
On KEV
9.8
Max CVSS
4
New 30D
Severity mix
Critical 4High 47Medium 21Low 2
Watch
Add Xcode to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-27945 | 6.3 | May 8 | This issue was addressed with improved entitlements Affected: before 14.3 |
| CVE-2026-28889 | 6.2 | Mar 25 | A permissions issue was addressed with additional restrictions Affected: before 26.4 |
| CVE-2018-16845 | 6.1 | Nov 7 | nginx before versions 1.15.6, 1.14.1 has a vulnerability in the ngx_http_mp4_module, which might allow an attacker to cause infinite loop in a worker process, cause a worker… Affected: before 13.0 |
| CVE-2026-65393 | 5.5 | Sep 14 | A permissions issue was addressed with improved validation Affected: before 27 |
| CVE-2026-28890 | 5.5 | Mar 25 | An out-of-bounds read was addressed with improved bounds checking Affected: before 26.4 |
| CVE-2025-43375 | 5.5 | Sep 15 | The issue was addressed with improved checks Affected: before 26.0 |
| CVE-2025-30441 | 5.5 | Mar 31 | This issue was addressed through improved state management Affected: before 16.3 |
| CVE-2025-24226 | 5.5 | Mar 31 | The issue was addressed with improved checks Affected: before 16.3 |
| CVE-2024-44191 | 5.5 | Sep 17 | This issue was addressed through improved state management Affected: before 16.0 |
| CVE-2024-23298 | 5.5 | Mar 15 | A logic issue was addressed with improved state management Affected: before 15.3 |
| CVE-2023-40435 | 5.5 | Sep 27 | This issue was addressed by enabling hardened runtime Affected: before 15.0 |
| CVE-2023-40391 | 5.5 | Sep 27 | The issue was addressed with improved memory handling Affected: before 15.0 |
| CVE-2022-32920 | 5.5 | Sep 6 | The issue was addressed with improved checks Affected: before 14.0 |
| CVE-2022-39253 | 5.5 | Oct 19 | Git subject to exposure of sensitive information via local clone of symbolic links Affected: before 14.1 |
| CVE-2021-1800 | 5.5 | Apr 2 | A path handling issue was addressed with improved validation Affected: before 12.4 |
| CVE-2024-40862 | 5.3 | Sep 17 | A privacy issue was addressed by removing sensitive data Affected: before 16.0 |
| CVE-2019-20372 | 5.3 | Jan 9 | NGINX before 1.17.7, with certain error_page configurations, allows HTTP request smuggling, as demonstrated by the ability of an attacker to read unauthorized web pages in… Affected: before 13.0 |
| CVE-2016-0747 | 5.3 | Feb 15 | The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 does not properly limit CNAME resolution, which allows remote attackers to cause a denial of service (worker process… Affected: before 13.0 |
| CVE-2025-43504 | 4.9 | Nov 4 | A buffer overflow was addressed with improved bounds checking Affected: before 26.1 |
| CVE-2026-86875 | 4.3 | Oct 20 | An input validation issue was addressed with improved input validation Affected: before 27 |
| CVE-2025-43370 | 4.0 | Sep 15 | A path handling issue was addressed with improved validation Affected: before 26.0 |
Showing 21