Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 7,575

Export CSV
CVE-2015-5123

flash-plugin: two code execution issues in APSA15-04 / APSB15-18

Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.302 on Windows and OS X, 14.x through 18.0.0.203 on Windows and OS X, 11.x through 11.2.202.481 on Linux, and 12.x through 18.0.0.204 on Linux Chrome installations allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content that overrides a valueOf function, as exploited in the wild in July 2015.

CVSS 3.1 · 7.8 High EPSS 18.8% KEV · Listed
Vendors
Adobe Apple Linux and 4 more
Products
Flash Player Flash Player Desktop Runtime Macos and 10 more
CVE-2016-4171

flash-plugin: multiple code execution issues fixed in APSB16-18

Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier allows remote attackers to execute arbitrary code via unknown vectors, as exploited in the wild in June 2016.

CVSS 3.1 · 7.8 High EPSS 20.2% KEV · Listed
Vendors
Adobe Apple Google and 5 more
Products
Flash Player Mac Os X Macos and 12 more
CVE-2010-2883

Acroread: Stack-based buffer overflow by processing certain fonts (APSA10-02)

Stack-based buffer overflow in CoolType.dll in Adobe Reader and Acrobat 9.x before 9.4, and 8.x before 8.2.5 on Windows and Mac OS X, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a PDF document with a long field in a Smart INdependent Glyphlets (SING) table in a TTF font, as exploited in the wild in September 2010. NOTE: some of these details are obtained from third party information.

CVSS 3.1 · 7.3 High EPSS 81.4% KEV · Listed
Vendors
Adobe Apple Microsoft and 1 more
Products
Acrobat Acrobat Reader Macos and 2 more
CVE-2011-0609

flash-plugin: crash and potential arbitrary code execution (APSB11-05)

Unspecified vulnerability in Adobe Flash Player 10.2.154.13 and earlier on Windows, Mac OS X, Linux, and Solaris; 10.1.106.16 and earlier on Android; Adobe AIR 2.5.1 and earlier; and Authplay.dll (aka AuthPlayLib.bundle) in Adobe Reader and Acrobat 9.x through 9.4.2 and 10.x through 10.0.1 on Windows and Mac OS X, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted Flash content, as demonstrated by a .swf file embedded in an Excel spreadsheet, and as exploited in the wild in March 2011.

CVSS 3.1 · 7.8 High EPSS 63.5% KEV · Listed
Vendors
Adobe Apple Google and 6 more
Products
Acrobat Acrobat Reader Air and 12 more
CVE-2012-2034

flash-plugin: multiple code execution flaws (APSB12-14)

Adobe Flash Player before 10.3.183.20 and 11.x before 11.3.300.257 on Windows and Mac OS X; before 10.3.183.20 and 11.x before 11.2.202.236 on Linux; before 11.1.111.10 on Android 2.x and 3.x; and before 11.1.115.9 on Android 4.x, and Adobe AIR before 3.3.0.3610, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2012-2037.

CVSS 3.1 · 7.5 High EPSS 7.7% KEV · Listed
Vendors
Adobe Apple Google and 5 more
Products
Air Flash Player Macos and 11 more
CVE-2026-33874

Authenticator vulnerable to Remote Code Execution

Gematik Authenticator securely authenticates users for login to digital health applications. Starting in version 4.12.0 and prior to version 4.16.0, the Mac OS version of the Authenticator is vulnerable to remote code execution, triggered when victims open a malicious file. Update the gematik Authenticator to version 4.16.0 or greater to receive a patch. There are no known workarounds.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Apple Gematik
Products
Macos App-authenticator Authenticator
CVE-2016-5198

chromium-browser: out of bounds memory access in v8

V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac included incorrect optimisation assumptions, which allowed a remote attacker to perform arbitrary read/write operations, leading to code execution, via a crafted HTML page.

CVSS 3.1 · 8.8 High EPSS 34.2% KEV · Listed
Vendors
Apple Google Linux and 2 more
Products
Macos Android Chrome and 6 more
CVE-2017-5030

chromium-browser: memory corruption in v8

Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.2987.108 for Android allowed a remote attacker to execute arbitrary code via a crafted HTML page.

CVSS 3.1 · 8.8 High EPSS 40.6% KEV · Listed
Vendors
Apple Debian Google and 3 more
Products
Macos Debian Linux Android and 7 more
CVE-2017-5070

chromium-browser: type confusion in v8

Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.

CVSS 3.1 · 8.8 High EPSS 32.1% KEV · Listed
Vendors
Apple Google Linux and 2 more
Products
Macos Android Chrome and 6 more
CVE-2025-6426

No warning when opening executable terminal files on macOS

The executable file warning did not warn users before opening files with the `terminal` extension. *This bug only affects Firefox for macOS. Other versions of Firefox are unaffected.*. This vulnerability was fixed in Firefox 140, Firefox ESR 128.12, Thunderbird 140, and Thunderbird 128.12.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Apple Mozilla
Products
Macos Firefox Firefox Esr
CVE-2025-7779

Local Privilege Escalation via Insecure XPC Service Configuration in Acronis True Image for macOS

Local privilege escalation due to insecure XPC service configuration. The following products are affected: Acronis True Image (macOS) before build 42389, Acronis True Image for SanDisk (macOS) before build 42198, Acronis True Image for Western Digital (macOS) before build 42197, Acronis True Image OEM (macOS) before build 42571.

CVSS 3.0 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Acronis Apple
Products
True Image True Image Agent Macos
CVE-2026-21342

Substance3D - Stager | Out-of-bounds Write (CWE-787)

Substance3D - Stager versions 3.1.6 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Adobe Apple Microsoft
Products
Substance 3d Stager Macos Windows
CVE-2026-21322

After Effects | Out-of-bounds Read (CWE-125)

After Effects versions 25.6 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Adobe Apple Microsoft
Products
After Effects Macos Windows
CVE-2026-21346

Bridge | Out-of-bounds Write (CWE-787)

Bridge versions 15.1.3, 16.0.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Adobe Apple Microsoft
Products
Bridge Macos Windows
CVE-2026-2313

chromium-browser: Use after free in CSS

Use after free in CSS in Google Chrome prior to 145.0.7632.45 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 8.8 High EPSS 4.5% KEV · Not listed
Vendors
Apple Google Linux and 1 more
Products
Macos Chrome Linux Kernel and 1 more
CVE-2026-2320

chromium-browser: Inappropriate implementation in File input

Inappropriate implementation in File input in Google Chrome prior to 145.0.7632.45 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Apple Google Linux and 1 more
Products
Macos Chrome Linux Kernel and 1 more
CVE-2026-5280

chromium-browser: Use after free in WebCodecs

Use after free in WebCodecs in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Apple Google Linux and 1 more
Products
Macos Chrome Linux Kernel and 1 more
CVE-2026-21274

Dreamweaver Desktop | Incorrect Authorization (CWE-863)

Dreamweaver Desktop versions 21.6 and earlier are affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could leverage this vulnerability to bypass security measures and execute unauthorized code. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Adobe Apple Microsoft
Products
Dreamweaver Macos Windows
CVE-2026-21278

InDesign Desktop | Out-of-bounds Read (CWE-125)

InDesign Desktop versions 21.0, 19.5.5 and earlier are affected by an Out-of-bounds Read vulnerability that could lead to memory exposure. An attacker could leverage this vulnerability to access sensitive information stored in memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Adobe Apple Microsoft
Products
Indesign Macos Windows
CVE-2026-21283

Bridge | Heap-based Buffer Overflow (CWE-122)

Bridge versions 15.1.2, 16.0 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Adobe Apple Microsoft
Products
Bridge Macos Windows