Every advisory below is enriched with the Vulnetix VDB exploit-intelligence chip (hover a CVE ID in the interactive page to see CVSS, EPSS, KEV status, and PoC maturity). 1 is already weaponised in the wild — see the Exploited section.
The advisories below are ordered by the Vulnetix risk prioritization strategy: exploitation evidence first, scores second. On the interactive page you can switch to three other lenses.
A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authe...
CVEs:CVE-2024-6387
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| macos | affected | apple | — | — |
A logic issue was addressed with improved file handling. This issue is fixed in visionOS 1.2. Processing web content may lead to a denial-of-service.
CVEs:CVE-2024-27812
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| visionos | affected | apple | — | — |
An authentication issue was addressed with improved state management. This issue is fixed in AirPods Firmware Update 6A326, AirPods Firmware Update 6F8, and Beats Firmware Update 6F8. When your headphones are seeking a connection request to one of your...
CVEs:CVE-2024-27867
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| airpods_firmware | affected | apple | — | — |
| airpods_max_firmware | affected | apple | — | — |
| airpods_pro_firmware | affected | apple | — | — |
| beats_fit_pro_firmware | affected | apple | — | — |
| powerbeats_firmware | affected | apple | — | — |
A memory corruption issue was addressed with improved validation. This issue is fixed in macOS Monterey 12.5. Processing a maliciously crafted tiff file may lead to arbitrary code execution.
CVEs:CVE-2022-32897
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| macos | affected | apple | — | — |
The issue was addressed with improved restriction of data container access. This issue is fixed in macOS Ventura 13.6.5, macOS Monterey 12.7.4. An app may be able to access sensitive user data.
CVEs:CVE-2023-40389
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| macos | affected | apple | — | — |
This issue was addressed by adding an additional prompt for user consent. This issue is fixed in macOS Sonoma 14.4. An app may be able to access user-sensitive data.
CVEs:CVE-2024-27792
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| macos | affected | apple | — | — |
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Monterey 12.5. Processing an AppleScript may result in unexpected termination or disclosure of process memory.
CVEs:CVE-2022-48578
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| macos | affected | apple | — | — |
This issue was addressed through improved state management. This issue is fixed in watchOS 10.5. A person with physical access to a device may be able to view contact information from the lock screen.
CVEs:CVE-2024-27814
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| watchos | affected | apple | — | — |
Every CVE above is indexed in the Vulnetix VDB with KEV, EPSS, and PoC maturity. The interactive page surfaces that on hover.