CVE-2025-24229

Sandboxed App May Access Sensitive User Data Due to Logic Issue in macOS

A logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. A sandboxed app may be able to access sensitive user data.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Macos

CVE-2025-24205

Authorization flaw enabling unauthorized access to user sensitive data on Apple iOS, iPadOS, macOS systems

An authorization issue was addressed with improved state management. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An app may be able to access user-sensitive data.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Ipados Iphone Os Macos

CVE-2025-24182

Out‑of‑Bounds Read in Font Processing Allows Process Memory Disclosure

An out-of-bounds read issue was addressed with improved input validation. This issue is fixed in iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, tvOS 18.4, visionOS 2.4, watchOS 11.4. Processing a maliciously crafted font may result in the disclosure of process memory.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Ipados Iphone Os Macos and 1 more

CVE-2025-30430

Authentication bypass allowing password autofill after failed login

This issue was addressed through improved state management. This issue is fixed in iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, visionOS 2.4, watchOS 11.4. Password autofill may fill in passwords after failing authentication.

CVSS 3.1 · 9.8 Critical EPSS 1.2% KEV · Not listed

Vendors

Apple

Products

Ipados Iphone Os Macos and 1 more

CVE-2025-30426

Application Install Enumeration via Missing Entitlement Checks

This issue was addressed with additional entitlement checks. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, tvOS 18.4, visionOS 2.4, watchOS 11.4. An app may be able to enumerate a user's installed apps.

CVSS 3.1 · 9.8 Critical EPSS 1.2% KEV · Not listed

Vendors

Apple

Products

Ipados Iphone Os Macos and 2 more

CVE-2025-24263

Apple macOS Sequoia Potential Data Observation Vulnerability

A privacy issue was addressed by moving sensitive data to a protected location. This issue is fixed in macOS Sequoia 15.4. An app may be able to observe unprotected user data.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Macos

CVE-2025-24097

Apple OS Permission Flaw Allows Arbitrary File Metadata Disclosure

A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.7, macOS Sequoia 15.4, macOS Sonoma 14.7.5, tvOS 18.4, watchOS 11.4. An app may be able to read arbitrary file metadata.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Ipados Iphone Os Macos and 1 more

CVE-2025-24214

Potential Access to Sensitive User Data via Text Field Logging on Apple Devices

A privacy issue was addressed by not logging contents of text fields. This issue is fixed in iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, tvOS 18.4, visionOS 2.4, watchOS 11.4. An app may be able to access sensitive user data.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Ipados Iphone Os Macos and 2 more

CVE-2025-24202

Sensitive Data Exposure via Improper Logging in Apple Operating Systems

A logging issue was addressed with improved data redaction. This issue is fixed in iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4. An app may be able to access sensitive user data.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Ipados Iphone Os Macos

CVE-2025-24279

macOS File Handling Vulnerability Allows Unprivileged App to Read User Contacts

This issue was addressed with improved file handling. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An app may be able to access contacts.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Macos

CVE-2025-30447

Logging Sanitization Flaw Allowing Access to Sensitive User Data

The issue was resolved by sanitizing logging. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.4, visionOS 2.4, watchOS 11.4. An app may be able to access sensitive user data.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Ipados Iphone Os Macos and 2 more

CVE-2025-24239

App Access to Protected User Data via Downgrade Issue

A downgrade issue was addressed with additional code-signing restrictions. This issue is fixed in macOS Sequoia 15.4. An app may be able to access protected user data.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Macos

CVE-2025-24215

Potential Private Information Disclosure in iPadOS and macOS

The issue was addressed with improved checks. This issue is fixed in iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. A malicious app may be able to access private information.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Ipados Macos

CVE-2025-24242

Symlink Handling Exploit Allowing Root Application to Access Private Information on macOS

This issue was addressed with improved handling of symlinks. This issue is fixed in macOS Sequoia 15.4. An app with root privileges may be able to access private information.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Macos

CVE-2025-24262

Sandboxed App Can Access Sensitive User Data in System Logs on macOS

A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sequoia 15.4. A sandboxed app may be able to access sensitive user data in system logs.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Macos

CVE-2026-34615

Adobe Connect | Deserialization of Untrusted Data (CWE-502)

Adobe Connect versions 2025.3, 12.10 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Adobe Apple Microsoft

Products

Adobe Connect Connect Connect Desktop Application and 2 more

CVE-2026-27303

Adobe Connect | Deserialization of Untrusted Data (CWE-502)

Adobe Connect versions 2025.3, 12.10 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Adobe Apple Microsoft

Products

Adobe Connect Connect Connect Desktop Application and 2 more

CVE-2026-27246

Adobe Connect | Cross-site Scripting (DOM-based XSS) (CWE-79)

Adobe Connect versions 2025.3, 12.10 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Adobe Apple Microsoft

Products

Adobe Connect Connect Connect Desktop Application and 2 more

CVE-2026-27245

Adobe Connect | Cross-site Scripting (Reflected XSS) (CWE-79)

Adobe Connect versions 2025.3, 12.10 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Adobe Apple Microsoft

Products

Adobe Connect Connect Connect Desktop Application and 2 more

CVE-2026-27243

Adobe Connect | Cross-site Scripting (Reflected XSS) (CWE-79)

Adobe Connect versions 2025.3, 12.10 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Adobe Apple Microsoft

Products

Adobe Connect Connect Connect Desktop Application and 2 more