CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Free accounts get a daily email of the CVEs that match up to 3 of their products on My program; subscribers get each one the moment it is published. Where the data comes from: sources.

Updated under an hour ago (Oct 30, 2026, 12:20 AM ET)

What this means for you

This week: 3,357 CVEs published, 233 critical, and 2 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stackFree account, 3 products This week's critical CVEs Exploited in the last 30 days

Published in the last 7 days: 3,357; Show in the list
Critical, last 7 days: 233; Show in the list
Healthcare-tagged, last 7 days: 5; Show in the list
Known exploited (CISA KEV): 1,762; Show in the list

Showing CVEs that name the product apple:mac_os_x. Show all products

55 CVEs

Showing 1 to 10.

CVE	Severity	Title	Published
CVE-2012-1823 Known exploited	Critical 9.8	sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which al… Assigned by certcc	May 11, 2012
CVE-2014-4404 Known exploited	High 7.8	Heap-based buffer overflow in IOHIDFamily in Apple iOS before 8 and Apple TV before 7 allows attackers to execute arbitrary code in a privileged context via an application that provides crafted key-m… Assigned by apple	Sep 18, 2014
CVE-2014-6271 Known exploited	Critical 9.8	GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, a… Assigned by debian	Sep 24, 2014
CVE-2014-7169 Known exploited	Critical 9.8	GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or poss… Assigned by mitre	Sep 24, 2014
CVE-2015-1130 Known exploited	High 7.8	The XPC implementation in Admin Framework in Apple OS X before 10.10.3 allows local users to bypass authentication and obtain admin privileges via unspecified vectors. Assigned by apple	Apr 10, 2015
CVE-2015-8126	High 7.5	Multiple buffer overflows in the (1) png_set_PLTE and (2) png_get_PLTE functions in libpng before 1.0.64, 1.1.x and 1.2.x before 1.2.54, 1.3.x and 1.4.x before 1.4.17, 1.5.x before 1.5.24, and 1.6.x… Assigned by mitre	Nov 12, 2015
CVE-2016-0718	Critical 9.8	Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a malformed input document, which triggers a buffer overflow. Assigned by redhat	May 26, 2016
CVE-2016-5131	High 8.8	Use-after-free vulnerability in libxml2 through 2.9.4, as used in Google Chrome before 52.0.2743.82, allows remote attackers to cause a denial of service or possibly have unspecified other impact via… Assigned by Chrome	Jul 23, 2016
CVE-2016-4658	Critical 9.8	xpointer.c in libxml2 before 2.9.5 (as used in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3, and other products) does not forbid namespace nodes in XPointer ranges, wh… Assigned by apple	Sep 25, 2016
CVE-2016-9841	Critical 9.8	inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic. Assigned by microfocus	May 22, 2017

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.