CVE-2025-31216

Physical Access Allows Overriding Managed Wi‑Fi Profiles on iOS and iPadOS

The issue was addressed with improved checks. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7. An attacker with physical access to a device may be able to override managed Wi-Fi profiles.

CVSS 3.1 · 2.4 Low EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Ios Ipados Iphone Os

CVE-2025-43513

Local Application May Read Sensitive Location Data Due to Permissions Flaw

A permissions issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, macOS Tahoe 26.2. An app may be able to read sensitive location information.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Macos Macos Sequoia Macos Sonoma

CVE-2026-7134

code-projects Online Lot Reservation System edithousepic.php unrestricted upload

A vulnerability was identified in code-projects Online Lot Reservation System 1.0. Affected is an unknown function of the file /edithousepic.php. Such manipulation of the argument image leads to unrestricted upload. The attack can be launched remotely. The exploit is publicly available and might be used.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Code-projects

Products

Online Lot Reservation System

CVE-2026-35235

mysql: GIS unspecified vulnerability (CPU Apr 2026)

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: GIS). Supported versions that are affected are 9.0.0-9.6.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Oracle

Products

Mysql Server

CVE-2026-35237

mysql: InnoDB unspecified vulnerability (CPU Apr 2026)

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Oracle

Products

Mysql Server

CVE-2026-35238

mysql: InnoDB unspecified vulnerability (CPU Apr 2026)

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Oracle

Products

Mysql Server

CVE-2025-59308

Privilege Escalation via Masquerading in Multi‑Tenant Mahara

In Mahara before 24.04.10 and 25 before 25.04.1, an institution administrator or institution support administrator on a multi-tenanted site can masquerade as an institution member in an institution for which they are not an administrator, if they also have the 'Site staff' role.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Mahara

Products

Mahara

CVE-2025-67259

Student Accounts Can Retrieve Unauthorized Course Information by Modifying API Requests

A Broken Access Control vulnerability exists in ClassroomIO v0.1.13 where an authenticated low-privileged "student" user can access unauthorized course-level information by modifying intercepted API requests. Changing a captured POST request to a GET request against the /rest/v1/course PostgREST endpoint results in disclosure of sensitive information including other students details, tutor/admin profiles, and internal course metadata.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Classroomio

Products

Classroomio

CVE-2025-24241

Pasteboard Data Leakage Vulnerability

A configuration issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An app may be able to trick a user into copying sensitive data to the pasteboard.

CVSS 3.1 · 9.8 Critical EPSS 1.1% KEV · Not listed

Vendors

Apple

Products

Macos

CVE-2025-24173

Sandbox Escape via Missing Entitlement Checks

This issue was addressed with additional entitlement checks. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.4, visionOS 2.4, watchOS 11.4. An app may be able to break out of its sandbox.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Ipados Iphone Os Macos and 2 more

CVE-2025-24272

macOS Protected File System Modification Vulnerability

The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An app may be able to modify protected parts of the file system.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Macos

CVE-2025-24198

Siri Authorization Bypass on Locked Devices with Physical Access

This issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An attacker with physical access may be able to use Siri to access sensitive user data.

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Ipados Iphone Os Macos

CVE-2025-30460

Application may access protected user data due to permissions flaw

A permissions issue was addressed by removing vulnerable code and adding additional checks. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An app may be able to access protected user data.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Macos

CVE-2025-24248

macOS Permissions Issue Allows Enumeration of Apple Account Devices

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.4. An app may be able to enumerate devices that have signed into the user's Apple Account.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Macos

CVE-2025-24229

Sandboxed App May Access Sensitive User Data Due to Logic Issue in macOS

A logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. A sandboxed app may be able to access sensitive user data.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Macos

CVE-2025-24205

Authorization flaw enabling unauthorized access to user sensitive data on Apple iOS, iPadOS, macOS systems

An authorization issue was addressed with improved state management. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An app may be able to access user-sensitive data.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Ipados Iphone Os Macos

CVE-2025-24214

Potential Access to Sensitive User Data via Text Field Logging on Apple Devices

A privacy issue was addressed by not logging contents of text fields. This issue is fixed in iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, tvOS 18.4, visionOS 2.4, watchOS 11.4. An app may be able to access sensitive user data.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Ipados Iphone Os Macos and 2 more

CVE-2025-24202

Sensitive Data Exposure via Improper Logging in Apple Operating Systems

A logging issue was addressed with improved data redaction. This issue is fixed in iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4. An app may be able to access sensitive user data.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Ipados Iphone Os Macos

CVE-2025-24193

Limited Access to Photos via USB‑C on Unlocked Devices in iOS/iPadOS

This issue was addressed with improved authentication. This issue is fixed in iOS 18.4 and iPadOS 18.4. An attacker with a USB-C connection to an unlocked device may be able to programmatically access photos.

CVSS 3.1 · 2.4 Low EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Ipados Iphone Os

CVE-2025-24215

Potential Private Information Disclosure in iPadOS and macOS

The issue was addressed with improved checks. This issue is fixed in iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. A malicious app may be able to access private information.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Ipados Macos