ByteOS

Product

Safari

Versions

Affected

From 0 before 26.4 (custom)

Vendor

Product

iOS and iPadOS

Versions

Affected

From 0 before 18.7.7 (custom)
From 0 before 26.4 (custom)

Vendor

Product

macOS

Versions

Affected

From 0 before 26.4 (custom)

Vendor

Product

visionOS

Versions

Affected

From 0 before 26.4 (custom)

Problem Types

Type	CWE ID	Description
N/A	N/A	A malicious website may be able to access script message handlers intended for other origins

Type: N/A

CWE ID: N/A

Description: A malicious website may be able to access script message handlers intended for other origins

References

Hyperlink	Resource
https://support.apple.com/en-us/126792	N/A
https://support.apple.com/en-us/126793	N/A
https://support.apple.com/en-us/126794	N/A
https://support.apple.com/en-us/126799	N/A
https://support.apple.com/en-us/126800	N/A

Hyperlink: https://support.apple.com/en-us/126792

Resource: N/A

Hyperlink: https://support.apple.com/en-us/126793

Resource: N/A

Hyperlink: https://support.apple.com/en-us/126794

Resource: N/A

Hyperlink: https://support.apple.com/en-us/126799

Resource: N/A

Hyperlink: https://support.apple.com/en-us/126800

Resource: N/A

▼Authorized Data Publishers (ADP)

1. CISA ADP Vulnrichment

Problem Types

Type	CWE ID	Description
CWE	CWE-79	CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Type: CWE

CWE ID: CWE-79

Description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Metrics

Version	Base score	Base severity	Vector
3.1	4.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Version: 3.1

Base score: 4.3

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Metrics Other Info

2. webkitgtk: A malicious website may be able to access script message handlers intended for other origins

A flaw was found in WebKitGTK. A maliciously crafted web page can cause a logic issue due to improper state management and may be able to access script message handlers intended for other origins.

Affected Products

Vendor

Red Hat Enterprise Linux 6

Product

Collection URL

https://access.redhat.com/downloads/content/package-browser/

Package Name

webkitgtk

CPEs

cpe:/o:redhat:enterprise_linux:6

Default Status

unaffected

Vendor

Red Hat Enterprise Linux 7

Product

Collection URL

https://access.redhat.com/downloads/content/package-browser/

Package Name

webkitgtk3

CPEs

cpe:/o:redhat:enterprise_linux:7

Default Status

unaffected

Vendor

Red Hat Enterprise Linux 7

Product

Collection URL

https://access.redhat.com/downloads/content/package-browser/

Package Name

webkitgtk4

CPEs

cpe:/o:redhat:enterprise_linux:7

Default Status

unaffected

Vendor

Red Hat Enterprise Linux 8

Product

Collection URL

https://access.redhat.com/downloads/content/package-browser/

Package Name

webkit2gtk3

CPEs

cpe:/o:redhat:enterprise_linux:8

Default Status

unaffected

Vendor

Red Hat Enterprise Linux 9

Product

Collection URL

https://access.redhat.com/downloads/content/package-browser/

Package Name

webkit2gtk3

CPEs

cpe:/o:redhat:enterprise_linux:9

Default Status

unaffected

Problem Types

Type	CWE ID	Description
CWE	CWE-346	Origin Validation Error

Type: CWE

CWE ID: CWE-346

Description: Origin Validation Error

Metrics

Version	Base score	Base severity	Vector
3.1	4.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Version: 3.1

Base score: 4.3

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Metrics Other Info

Red Hat severity rating

value:

Important

namespace:

https://access.redhat.com/security/updates/classification/

Timeline

Event	Date
Reported to Red Hat.	2026-03-30 12:37:40
Made public.	2026-03-28 20:00:00

Event: Reported to Red Hat.

Date: 2026-03-30 12:37:40

Event: Made public.

Date: 2026-03-28 20:00:00

References

Hyperlink	Resource
https://access.redhat.com/security/cve/CVE-2026-28861	vdb-entry x_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2453007	issue-tracking x_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28861.json	x_sadp-csaf-vex

Hyperlink: https://access.redhat.com/security/cve/CVE-2026-28861

Resource:

vdb-entry

x_refsource_REDHAT

Hyperlink: https://bugzilla.redhat.com/show_bug.cgi?id=2453007

Resource:

issue-tracking

x_refsource_REDHAT

Hyperlink: https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28861.json

Resource:

x_sadp-csaf-vex

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:product-security@apple.com

Published At:25 Mar, 2026 | 01:17

Updated At:15 Jul, 2026 | 02:19

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	3.1	4.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Secondary	3.1	4.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
			N/A

Type: Secondary

Version: 3.1

Base score: 4.3

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Type: Secondary

Version: 3.1

Base score: 4.3

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Type: N/A

Version:

Base score:

Base severity: N/A

Vector:

CPE Matches

cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*

>>safari>>Versions before 26.4(exclusive)

cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*

>>ipados>>Versions before 18.7.7(exclusive)

cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*

>>ipados>>Versions from 26.0(inclusive) to 26.4(exclusive)

cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*

>>iphone_os>>Versions before 18.7.7(exclusive)

cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*

>>iphone_os>>Versions from 26.0(inclusive) to 26.4(exclusive)

cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*

>>macos>>Versions before 26.4(exclusive)

cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*

>>visionos>>Versions before 26.4(exclusive)

Weaknesses

CWE ID	Type	Source
NVD-CWE-noinfo	Primary	nvd@nist.gov
CWE-79	Secondary	134c704f-9b21-4f2e-91b3-4a467353bcc0
CWE-346	Secondary	0b0ca135-0b70-47e7-9f44-1890c2a1c46c

CWE ID: NVD-CWE-noinfo

Type: Primary

Source: nvd@nist.gov

CWE ID: CWE-79

Type: Secondary

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

CWE ID: CWE-346

Type: Secondary

Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c

References

Hyperlink	Source	Resource
https://support.apple.com/en-us/126792	product-security@apple.com	Release Notes Vendor Advisory
https://support.apple.com/en-us/126793	product-security@apple.com	Release Notes Vendor Advisory
https://support.apple.com/en-us/126794	product-security@apple.com	Release Notes Vendor Advisory
https://support.apple.com/en-us/126799	product-security@apple.com	Release Notes Vendor Advisory
https://support.apple.com/en-us/126800	product-security@apple.com	Release Notes Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-28861	0b0ca135-0b70-47e7-9f44-1890c2a1c46c	N/A
https://bugzilla.redhat.com/show_bug.cgi?id=2453007	0b0ca135-0b70-47e7-9f44-1890c2a1c46c	N/A
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28861.json	0b0ca135-0b70-47e7-9f44-1890c2a1c46c	N/A

Hyperlink: https://support.apple.com/en-us/126792

Source: product-security@apple.com

Resource:

Release Notes

Vendor Advisory

Hyperlink: https://support.apple.com/en-us/126793

Source: product-security@apple.com

Resource:

Release Notes

Vendor Advisory

Hyperlink: https://support.apple.com/en-us/126794

Source: product-security@apple.com

Resource:

Release Notes

Vendor Advisory

Hyperlink: https://support.apple.com/en-us/126799

Source: product-security@apple.com

Resource:

Release Notes

Vendor Advisory

Hyperlink: https://support.apple.com/en-us/126800

Source: product-security@apple.com

Resource:

Release Notes

Vendor Advisory

Hyperlink: https://access.redhat.com/security/cve/CVE-2026-28861

Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c

Resource: N/A

Hyperlink: https://bugzilla.redhat.com/show_bug.cgi?id=2453007

Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c

Resource: N/A

Hyperlink: https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28861.json

Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c

Resource: N/A

Similar CVEs

527Records found

CVE-2020-3781

Matching Score-8

Matching Score-8

CVSS Score-4.3||MEDIUM

EPSS-2.16% / 80.30%

7 Day CHG~0.00%

Published-25 Mar, 2020 | 20:32

Updated-04 Aug, 2024 | 07:44

Adobe Photoshop CC 2019 versions 20.0.8 and earlier, and Photoshop 2020 versions 21.1 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.

Product-photoshop_2020 windows photoshop_cc macos Adobe Photoshop

CWE ID-CWE-125

Out-of-bounds Read

CVE-2020-3782

Matching Score-8

Matching Score-8

CVSS Score-4.3||MEDIUM

EPSS-2.16% / 80.30%

7 Day CHG~0.00%

Published-25 Mar, 2020 | 20:31

Updated-04 Aug, 2024 | 07:44

Product-photoshop_2020 windows photoshop_cc macos Adobe Photoshop

CWE ID-CWE-125

Out-of-bounds Read

CVE-2025-46286

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.17% / 6.54%

7 Day CHG~0.00%

Published-09 Jan, 2026 | 21:14

Updated-02 Apr, 2026 | 18:18

A logic issue was addressed with improved validation. This issue is fixed in iOS 26.2 and iPadOS 26.2. Restoring from a backup may prevent passcode from being required immediately after Face ID enrollment.

Vendor-Apple Inc.

Product-iphone_os ipados iOS and iPadOS

CWE ID-CWE-288

Authentication Bypass Using an Alternate Path or Channel

CVE-2019-8242

Matching Score-8

Matching Score-8

CVSS Score-4.3||MEDIUM

EPSS-3.27% / 87.12%

7 Day CHG~0.00%

Published-14 Nov, 2019 | 15:29

Updated-05 May, 2025 | 17:15

Adobe Media Encoder versions 13.1 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.

Product-media_encoder macos windows Adobe Media Encoder

CWE ID-CWE-125

Out-of-bounds Read

CVE-2019-8898

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.77% / 51.72%

7 Day CHG+0.01%

Published-27 Oct, 2020 | 20:09

Updated-04 Aug, 2024 | 21:31

An information disclosure issue existed in the handling of the Storage Access API. This issue was addressed with improved logic. This issue is fixed in iOS 13.3 and iPadOS 13.3, tvOS 13.3, Safari 13.0.4, iTunes 12.10.3 for Windows. Visiting a maliciously crafted website may reveal sites a user has visited.

Vendor-Apple Inc.

Product-itunes iphone_os ipados tvos safari tvOS iTunes for Windows Safari iOS and iPadOS

CVE-2019-8769

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-4.3||MEDIUM

EPSS-1.24% / 66.05%

7 Day CHG~0.00%

Published-18 Dec, 2019 | 17:33

Updated-04 Aug, 2024 | 21:31

An issue existed in the drawing of web page elements. The issue was addressed with improved logic. This issue is fixed in iOS 13.1 and iPadOS 13.1, macOS Catalina 10.15. Visiting a maliciously crafted website may reveal browsing history.

Vendor-Apple Inc.

Product-iphone_os mac_os_x ipados macOS iOS

CVE-2019-8243

Matching Score-8

Matching Score-8

CVSS Score-4.3||MEDIUM

EPSS-3.27% / 87.12%

7 Day CHG~0.00%

Published-14 Nov, 2019 | 15:31

Updated-05 May, 2025 | 17:15

Adobe Media Encoder versions 13.1 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.

Product-media_encoder macos windows Adobe Media Encoder

CWE ID-CWE-125

Out-of-bounds Read

CVE-2019-8827

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-4.3||MEDIUM

EPSS-1.05% / 60.78%

7 Day CHG+0.01%

Published-27 Oct, 2020 | 19:53

Updated-04 Aug, 2024 | 21:31

The HTTP referrer header may be used to leak browsing history. The issue was resolved by downgrading all third party referrers to their origin. This issue is fixed in Safari 13.0.3, iTunes 12.10.2 for Windows, iCloud for Windows 10.9.2, tvOS 13.2, iOS 13.2 and iPadOS 13.2, iCloud for Windows 7.15. Visiting a maliciously crafted website may reveal the sites a user has visited.

Vendor-Apple Inc.

Product-itunes iphone_os ipados tvos safari icloud iTunes for Windows iCloud for Windows Safari tvOS iOS and iPadOS

CVE-2019-8244

Matching Score-8

Matching Score-8

CVSS Score-4.3||MEDIUM

EPSS-3.27% / 87.12%

7 Day CHG~0.00%

Published-14 Nov, 2019 | 15:32

Updated-05 May, 2025 | 17:15

Adobe Media Encoder versions 13.1 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.

Product-media_encoder macos windows Adobe Media Encoder

CWE ID-CWE-125

Out-of-bounds Read

CVE-2019-8187

Matching Score-8

Matching Score-8

CVSS Score-4.3||MEDIUM

EPSS-2.82% / 85.07%

7 Day CHG~0.00%

Published-17 Oct, 2019 | 20:19

Updated-04 Aug, 2024 | 21:10

Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and earlier, and 2015.006.30503 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-416

Use After Free

CVE-2019-8059

Matching Score-8

Matching Score-8

CVSS Score-4.3||MEDIUM

EPSS-3.16% / 86.65%

7 Day CHG~0.00%

Published-20 Aug, 2019 | 20:07

Updated-04 Aug, 2024 | 21:10

Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-416

Use After Free

CVE-2019-8190

Matching Score-8

Matching Score-8

CVSS Score-4.3||MEDIUM

EPSS-1.99% / 78.61%

7 Day CHG~0.00%

Published-17 Oct, 2019 | 20:19

Updated-04 Aug, 2024 | 21:10

Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and earlier, and 2015.006.30503 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure .

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-125

Out-of-bounds Read

CVE-2019-8052

Matching Score-8

Matching Score-8

CVSS Score-4.3||MEDIUM

EPSS-2.24% / 81.00%

7 Day CHG~0.00%

Published-20 Aug, 2019 | 20:03

Updated-04 Aug, 2024 | 21:10

Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure .

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-125

Out-of-bounds Read

CVE-2019-8173

Matching Score-8

Matching Score-8

CVSS Score-4.3||MEDIUM

EPSS-1.99% / 78.61%

7 Day CHG~0.00%

Published-17 Oct, 2019 | 20:15

Updated-04 Aug, 2024 | 21:10

Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and earlier, and 2015.006.30503 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure .

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-125

Out-of-bounds Read

CVE-2019-8056

Matching Score-8

Matching Score-8

CVSS Score-4.3||MEDIUM

EPSS-3.16% / 86.65%

7 Day CHG~0.00%

Published-20 Aug, 2019 | 20:05

Updated-04 Aug, 2024 | 21:10

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-416

Use After Free

CVE-2019-8051

Matching Score-8

Matching Score-8

CVSS Score-4.3||MEDIUM

EPSS-3.16% / 86.65%

7 Day CHG~0.00%

Published-20 Aug, 2019 | 20:02

Updated-04 Aug, 2024 | 21:10

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-416

Use After Free

CVE-2019-8064

Matching Score-8

Matching Score-8

CVSS Score-4.3||MEDIUM

EPSS-1.96% / 78.25%

7 Day CHG~0.00%

Published-17 Oct, 2019 | 20:08

Updated-04 Aug, 2024 | 21:10

Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and earlier, and 2015.006.30503 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure .

Product-mac_os_x acrobat_dc windows acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-125

Out-of-bounds Read

CVE-2019-8053

Matching Score-8

Matching Score-8

CVSS Score-4.3||MEDIUM

EPSS-3.56% / 88.13%

7 Day CHG~0.00%

Published-20 Aug, 2019 | 20:03

Updated-04 Aug, 2024 | 21:10

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-416

Use After Free

CVE-2019-8172

Matching Score-8

Matching Score-8

CVSS Score-4.3||MEDIUM

EPSS-1.99% / 78.61%

7 Day CHG~0.00%

Published-17 Oct, 2019 | 20:15

Updated-04 Aug, 2024 | 21:10

Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and earlier, and 2015.006.30503 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure .

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-125

Out-of-bounds Read

CVE-2019-8037

Matching Score-8

Matching Score-8

CVSS Score-4.3||MEDIUM

EPSS-2.16% / 80.30%

7 Day CHG~0.00%

Published-20 Aug, 2019 | 19:54

Updated-04 Aug, 2024 | 21:10

Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure .

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-125

Out-of-bounds Read

CVE-2019-8035

Matching Score-8

Matching Score-8

CVSS Score-4.3||MEDIUM

EPSS-2.63% / 83.91%

7 Day CHG~0.00%

Published-20 Aug, 2019 | 19:53

Updated-04 Aug, 2024 | 21:10

Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure .

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-125

Out-of-bounds Read

CVE-2019-8163

Matching Score-8

Matching Score-8

CVSS Score-4.3||MEDIUM

EPSS-1.99% / 78.61%

7 Day CHG~0.00%

Published-17 Oct, 2019 | 20:13

Updated-04 Aug, 2024 | 21:10

Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and earlier, and 2015.006.30503 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure .

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-125

Out-of-bounds Read

CVE-2019-8188

Matching Score-8

Matching Score-8

CVSS Score-4.3||MEDIUM

EPSS-2.82% / 85.07%

7 Day CHG~0.00%

Published-17 Oct, 2019 | 20:19

Updated-04 Aug, 2024 | 21:10

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-416

Use After Free

CVE-2019-8054

Matching Score-8

Matching Score-8

CVSS Score-4.3||MEDIUM

EPSS-3.56% / 88.13%

7 Day CHG~0.00%

Published-20 Aug, 2019 | 20:04

Updated-04 Aug, 2024 | 21:10

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-416

Use After Free

CVE-2026-9086

Matching Score-6

Assigner-Red Hat, Inc.

Product-build_of_keycloak Red Hat build of Keycloak 26.4 Red Hat build of Keycloak 26.6.4 Red Hat build of Keycloak 26.4.13 Red Hat build of Keycloak 26.6 Red Hat build of Keycloak 26.4 Red Hat build of Keycloak 26.6.4 Red Hat build of Keycloak 26.4.13 Red Hat build of Keycloak 26.6

Matching Score-6

Assigner-Red Hat, Inc.

CVSS Score-7.3||HIGH

EPSS-0.42% / 34.38%

7 Day CHG~0.00%

Published-25 Jun, 2026 | 16:16

Updated-15 Jul, 2026 | 01:17

Keycloak: keycloak: cross-site scripting (xss) via case-insensitive uri validation bypass

A flaw was found in Keycloak. A remote attacker with administrative privileges, specifically those with `manage-client` permission or access to client registration endpoints, could bypass client Uniform Resource Identifier (URI) validation. This is achieved by registering a malicious client with a specially crafted redirect URI using a case-insensitive `javascript:` or `data:` scheme. This Cross-Site Scripting (XSS) vulnerability allows for arbitrary code execution in the Keycloak origin when a victim clicks the crafted link, such as in the logout flow or the Admin Console.

Vendor-Red Hat, Inc.

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2026-8948

Matching Score-6

Assigner-Mozilla Corporation

Product-thunderbird firefox Thunderbird Firefox Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 7 Red Hat Enterprise Linux 6 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 10

Matching Score-6

Assigner-Mozilla Corporation

CVSS Score-9.1||CRITICAL

EPSS-0.42% / 34.43%

7 Day CHG~0.00%

Published-19 May, 2026 | 12:29

Updated-15 Jul, 2026 | 02:48

Same-origin policy bypass in the DOM: Networking component

Same-origin policy bypass in the DOM: Networking component. This vulnerability was fixed in Firefox 151 and Thunderbird 151.

Vendor-Red Hat, Inc.Mozilla Corporation

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE ID-CWE-942

Permissive Cross-domain Policy with Untrusted Domains

CVE-2026-7958

Matching Score-6

Assigner-Chrome

Matching Score-6

Assigner-Chrome

CVSS Score-5.4||MEDIUM

EPSS-0.14% / 3.92%

7 Day CHG~0.00%

Published-06 May, 2026 | 18:12

Updated-07 May, 2026 | 02:05

Inappropriate implementation in ServiceWorker in Google Chrome prior to 148.0.7778.96 allowed an attacker who convinced a user to install a malicious extension to inject arbitrary scripts or HTML (UXSS) via a crafted Chrome Extension. (Chromium security severity: Medium)

Vendor-Apple Inc.Microsoft Corporation Google LLC Linux Kernel Organization, Inc

Product-chrome windows linux_kernel macos Chrome

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2026-8012

Matching Score-6

Assigner-Chrome

Matching Score-6

Assigner-Chrome

CVSS Score-5.4||MEDIUM

EPSS-0.14% / 3.71%

7 Day CHG~0.00%

Published-06 May, 2026 | 18:13

Updated-07 May, 2026 | 15:19

Inappropriate implementation in MHTML in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Low)

Vendor-Apple Inc.Microsoft Corporation Google LLC Linux Kernel Organization, Inc

Product-chrome windows linux_kernel macos Chrome

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2023-32445

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-6.1||MEDIUM

EPSS-0.47% / 38.42%

7 Day CHG~0.00%

Published-28 Jul, 2023 | 04:30

Updated-22 Oct, 2024 | 18:17

This issue was addressed with improved checks. This issue is fixed in Safari 16.6, watchOS 9.6, iOS 15.7.8 and iPadOS 15.7.8, tvOS 16.6, iOS 16.6 and iPadOS 16.6, macOS Ventura 13.5. Processing a document may lead to a cross site scripting attack.

Vendor-Apple Inc.

Product-iphone_os watchos ipados tvos safari macos watchOS Safari macOS tvOS iOS and iPadOS

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2026-7939

Matching Score-6

Assigner-Chrome

Matching Score-6

Assigner-Chrome

CVSS Score-5.4||MEDIUM

EPSS-0.17% / 6.08%

7 Day CHG~0.00%

Published-06 May, 2026 | 18:12

Updated-06 May, 2026 | 23:33

Inappropriate implementation in SanitizerAPI in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Medium)

Vendor-Apple Inc.Microsoft Corporation Google LLC Linux Kernel Organization, Inc

Product-chrome windows linux_kernel macos Chrome

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2017-13819

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-6.1||MEDIUM

EPSS-1.03% / 60.23%

7 Day CHG~0.00%

Published-13 Nov, 2017 | 03:00

Updated-13 May, 2026 | 00:24

An issue was discovered in certain Apple products. macOS before 10.13.1 is affected. The issue involves the "HelpViewer" component. A cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script or HTML by bypassing the Same Origin Policy for quarantined HTML documents.

Vendor-n/a Apple Inc.

Product-mac_os_x n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2019-6229

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-6.1||MEDIUM

EPSS-1.09% / 61.81%

7 Day CHG~0.00%

Published-05 Mar, 2019 | 16:00

Updated-04 Aug, 2024 | 20:16

A logic issue was addressed with improved validation. This issue is fixed in iOS 12.1.3, tvOS 12.1.2, Safari 12.0.3, iTunes 12.9.3 for Windows, iCloud for Windows 7.10. Processing maliciously crafted web content may lead to universal cross site scripting.

Vendor-Apple Inc.Microsoft Corporation

Product-itunes iphone_os tvos safari windows icloud iTunes for Windows iCloud for Windows Safari iOS tvOS

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2019-6228

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-6.1||MEDIUM

EPSS-0.85% / 54.34%

7 Day CHG~0.00%

Published-05 Mar, 2019 | 16:00

Updated-04 Aug, 2024 | 20:16

A cross-site scripting issue existed in Safari. This issue was addressed with improved URL validation. This issue is fixed in iOS 12.1.3, Safari 12.0.3. Processing maliciously crafted web content may lead to a cross site scripting attack.

Vendor-Apple Inc.

Product-iphone_os safari Safari iOS

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2026-6734

Matching Score-6

Assigner-ce714d77-add3-4f53-aff5-83d477b104bb

Product-undici undici Self-service automation portal 2 Red Hat OpenShift Dev Spaces Red Hat Openshift Data Foundation 4 Red Hat Enterprise Linux 10 OpenShift Pipelines Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Build of Podman Desktop Cryostat 4 Red Hat Developer Hub 1.9 Red Hat Developer Hub 1.10 Cluster Observability Operator 1.5.0 Red Hat OpenShift Dev Spaces 3.29 Red Hat AMQ Broker 7 Red Hat Hardened Images Red Hat OpenShift AI (RHOAI)Red Hat OpenShift Container Platform 4

Matching Score-6

Assigner-ce714d77-add3-4f53-aff5-83d477b104bb

CVSS Score-7.5||HIGH

EPSS-0.34% / 27.03%

7 Day CHG-0.01%

Published-17 Jun, 2026 | 16:36

Updated-21 Jul, 2026 | 12:19

undici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse

Impact: When using Socks5ProxyAgent, undici reuses a single connection pool across different origins without verifying that the pool's origin matches the requested origin. All requests are dispatched through the pool connected to the first origin, regardless of the intended destination. This causes cross-origin request routing: credentials and request data intended for origin B are sent to origin A, responses from the wrong origin are trusted, and HTTPS requests may be silently downgraded to HTTP. Impacted users are applications that use Socks5ProxyAgent (directly or via setGlobalDispatcher) and make requests to more than one origin. This was introduced in undici 7.23.0 via PR #4385 and affects all versions through 8.1.0. Patches: Upgrade to undici v7.26.0 or v8.2.0. Workarounds: Use a separate Socks5ProxyAgent instance per origin, or avoid using Socks5ProxyAgent with multiple origins.

Vendor-undici Red Hat, Inc.Node.js (OpenJS Foundation)

CWE ID-CWE-346

Origin Validation Error

CWE ID-CWE-940

Improper Verification of Source of a Communication Channel

CVE-2010-1390

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-4.3||MEDIUM

EPSS-2.93% / 85.64%

7 Day CHG~0.00%

Published-11 Jun, 2010 | 17:28

Updated-29 Apr, 2026 | 01:13

Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, allows remote attackers to inject arbitrary web script or HTML via vectors related to improper UTF-7 canonicalization, and lack of termination of a quoted string in an HTML document.

Vendor-n/a Microsoft Corporation Apple Inc.

Product-webkit windows_7 mac_os_x windows_vista windows_xp safari mac_os_x_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2023-27932

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-5.5||MEDIUM

EPSS-0.20% / 10.31%

7 Day CHG~0.00%

Published-08 May, 2023 | 00:00

Updated-29 Jan, 2025 | 21:15

This issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.3, Safari 16.4, iOS 16.4 and iPadOS 16.4, tvOS 16.4, watchOS 9.4. Processing maliciously crafted web content may bypass Same Origin Policy.

Vendor-Debian GNU/Linux Apple Inc.

Product-ipados tvos iphone_os safari watchos macos debian_linux watchOS macOS iOS and iPadOS Safari tvOS

CWE ID-CWE-346

Origin Validation Error

CVE-2014-0531

Matching Score-6

Matching Score-6

CVSS Score-4.3||MEDIUM

EPSS-3.73% / 88.66%

7 Day CHG~0.00%

Published-11 Jun, 2014 | 10:00

Updated-06 May, 2026 | 22:30

Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 13.0.0.223 and 14.x before 14.0.0.125 on Windows and OS X and before 11.2.202.378 on Linux, Adobe AIR before 14.0.0.110, Adobe AIR SDK before 14.0.0.110, and Adobe AIR SDK & Compiler before 14.0.0.110 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2014-0532 and CVE-2014-0533.

Vendor-n/a Apple Inc.Linux Kernel Organization, Inc Microsoft Corporation Adobe Inc.

Product-adobe_air mac_os_x adobe_air_sdk windows flash_player linux_kernel n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2017-12175

Matching Score-6

Assigner-Red Hat, Inc.

Matching Score-6

Assigner-Red Hat, Inc.

CVSS Score-3.5||LOW

EPSS-1.10% / 62.22%

7 Day CHG~0.00%

Published-26 Jul, 2018 | 17:00

Updated-05 Aug, 2024 | 18:28

Red Hat Satellite before 6.5 is vulnerable to a XSS in discovery rule when you are entering filter and you use autocomplete functionality.

Vendor-Red Hat, Inc.

Product-satellite Satellite

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2023-28191

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-5.5||MEDIUM

EPSS-0.17% / 6.25%

7 Day CHG~0.00%

Published-23 Jun, 2023 | 00:00

Updated-05 Dec, 2024 | 17:15

This issue was addressed with improved redaction of sensitive information. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, macOS Big Sur 11.7.7, macOS Monterey 12.6.6, iOS 16.5 and iPadOS 16.5. An app may be able to bypass Privacy preferences.

Vendor-Apple Inc.

Product-iphone_os watchos tvos ipados macos watchOS tvOS macOS iOS and iPadOS

CWE ID-CWE-346

Origin Validation Error

CVE-2023-27944

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-8.6||HIGH

EPSS-0.18% / 7.56%

7 Day CHG~0.00%

Published-08 May, 2023 | 00:00

Updated-29 Jan, 2025 | 20:15

This issue was addressed with a new entitlement. This issue is fixed in macOS Ventura 13.3, macOS Monterey 12.6.4, macOS Big Sur 11.7.5. An app may be able to break out of its sandbox.

Vendor-Apple Inc.

Product-macos macOS

CWE ID-CWE-346

Origin Validation Error

CVE-2026-5899

Matching Score-6

Assigner-Chrome

Matching Score-6

Assigner-Chrome

CVSS Score-6.1||MEDIUM

EPSS-0.13% / 3.32%

7 Day CHG~0.00%

Published-08 Apr, 2026 | 21:20

Updated-24 Jul, 2026 | 08:10

Insufficient policy enforcement in History Navigation in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who convinced a user to engage in specific UI gestures to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Low)

Vendor-Apple Inc.Google LLC Microsoft Corporation Linux Kernel Organization, Inc

Product-chrome windows macos linux_kernel Chrome

CWE ID-CWE-346

Origin Validation Error

CVE-2019-6204

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-6.1||MEDIUM

EPSS-0.68% / 48.60%

7 Day CHG~0.00%

Published-18 Dec, 2019 | 17:33

Updated-04 Aug, 2024 | 20:16

A logic issue was addressed with improved validation. This issue is fixed in iOS 12.2, Safari 12.1. Enabling the Safari Reader feature on a maliciously crafted webpage may lead to universal cross site scripting.

Vendor-Apple Inc.

Product-iphone_os safari Safari iOS

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-27838

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-6.5||MEDIUM

EPSS-0.73% / 50.59%

7 Day CHG~0.00%

Published-10 Jun, 2024 | 20:56

Updated-02 Apr, 2026 | 19:17

The issue was addressed by adding additional logic. This issue is fixed in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, visionOS 1.2, watchOS 10.5. A maliciously crafted webpage may be able to fingerprint the user.

Vendor-Apple Inc.

Product-tvos visionos watchos safari macos iphone_os ipados Safari visionOS macOS tvOS iOS and iPadOS watchOS

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2014-0509

Matching Score-6

Matching Score-6

CVSS Score-4.3||MEDIUM

EPSS-2.81% / 85.02%

7 Day CHG~0.00%

Published-08 Apr, 2014 | 21:00

Updated-06 May, 2026 | 22:30

Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 11.7.700.275 and 11.8.x through 13.0.x before 13.0.0.182 on Windows and OS X and before 11.2.202.350 on Linux, Adobe AIR before 13.0.0.83 on Android, Adobe AIR SDK before 13.0.0.83, and Adobe AIR SDK & Compiler before 13.0.0.83 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Vendor-n/a Apple Inc.Linux Kernel Organization, Inc Microsoft Corporation Adobe Inc.

Product-adobe_air mac_os_x adobe_air_sdk windows flash_player linux_kernel n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2014-0532

Matching Score-6

Matching Score-6

CVSS Score-4.3||MEDIUM

EPSS-3.79% / 88.85%

7 Day CHG~0.00%

Published-11 Jun, 2014 | 10:00

Updated-06 May, 2026 | 22:30

Vendor-n/a Apple Inc.Linux Kernel Organization, Inc Microsoft Corporation Adobe Inc.

Product-adobe_air mac_os_x adobe_air_sdk windows flash_player linux_kernel n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2016-8608

Matching Score-6

Assigner-Red Hat, Inc.

Matching Score-6

Assigner-Red Hat, Inc.

CVSS Score-5.4||MEDIUM

EPSS-1.26% / 66.53%

7 Day CHG~0.00%

Published-01 Aug, 2018 | 14:00

Updated-06 Aug, 2024 | 02:27

JBoss BRMS 6 and BPM Suite 6 are vulnerable to a stored XSS via business process editor. The flaw is due to an incomplete fix for CVE-2016-5398. Remote, authenticated attackers that have privileges to create business processes can store scripts in them, which are not properly sanitized before showing to other users, including admins.

Vendor-Red Hat, Inc.

Product-jboss_bpm_suite jboss_business_rules_management_system BRMS

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2019-3872

Matching Score-6

Assigner-Red Hat, Inc.

Matching Score-6

Assigner-Red Hat, Inc.

CVSS Score-5.4||MEDIUM

EPSS-0.70% / 49.28%

7 Day CHG~0.00%

Published-12 Jun, 2019 | 13:45

Updated-04 Aug, 2024 | 19:19

It was found that a SAMLRequest containing a script could be processed by Picketlink versions shipped in Jboss Application Platform 7.2.x and 7.1.x. An attacker could use this to send a malicious script to achieve cross-site scripting and obtain unauthorized information or conduct further attacks.

Vendor-Red Hat, Inc.

Product-jboss_enterprise_application_platform single_sign-on enterprise_linux picketlink

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2014-0533

Matching Score-6

Matching Score-6

CVSS Score-4.3||MEDIUM

EPSS-3.73% / 88.66%

7 Day CHG~0.00%

Published-11 Jun, 2014 | 10:00

Updated-06 May, 2026 | 22:30

Vendor-n/a Apple Inc.Linux Kernel Organization, Inc Microsoft Corporation Adobe Inc.

Product-adobe_air mac_os_x adobe_air_sdk windows flash_player linux_kernel n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2016-7762

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-6.1||MEDIUM

EPSS-0.72% / 50.17%

7 Day CHG~0.00%

Published-20 Feb, 2017 | 08:35

Updated-13 May, 2026 | 00:24

An issue was discovered in certain Apple products. iOS before 10.2 is affected. The issue involves the "WebKit" component, which allows XSS attacks against Safari.

Vendor-n/a Apple Inc.

Product-iphone_os n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2016-7650

Matching Score-6

Assigner-Apple Inc.