Total
147 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2024-27881 | 1 Apple | 1 Macos | 2025-11-04 | N/A | 5.3 MEDIUM |
| A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sonoma 14.6, macOS Monterey 12.7.6, macOS Ventura 13.6.8. An app may be able to access information about a user’s contacts. | |||||
| CVE-2024-27850 | 1 Apple | 5 Ipados, Iphone Os, Macos and 2 more | 2025-11-04 | N/A | 6.5 MEDIUM |
| This issue was addressed with improvements to the noise injection algorithm. This issue is fixed in visionOS 1.2, macOS Sonoma 14.5, Safari 17.5, iOS 17.5 and iPadOS 17.5. A maliciously crafted webpage may be able to fingerprint the user. | |||||
| CVE-2025-43357 | 1 Apple | 3 Ipados, Iphone Os, Macos | 2025-11-04 | N/A | 3.3 LOW |
| This issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 26 and iPadOS 26. An app may be able to fingerprint the user. | |||||
| CVE-2025-43310 | 1 Apple | 1 Macos | 2025-11-04 | N/A | 4.4 MEDIUM |
| A configuration issue was addressed with additional restrictions. This issue is fixed in macOS Sonoma 14.8, macOS Sequoia 15.7. An app may be able to trick a user into copying sensitive data to the pasteboard. | |||||
| CVE-2025-43301 | 1 Apple | 1 Macos | 2025-11-04 | N/A | 3.3 LOW |
| A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sonoma 14.8, macOS Sequoia 15.7. An app may be able to access contact info related to notifications in Notification Center. | |||||
| CVE-2023-45721 | 1 Hcltech | 1 Domino Leap | 2025-11-04 | N/A | 5.3 MEDIUM |
| Insufficient default configuration in HCL Leap allows anonymous access to directory information. | |||||
| CVE-2025-43259 | 1 Apple | 1 Macos | 2025-11-03 | N/A | 4.6 MEDIUM |
| This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An attacker with physical access to a locked device may be able to view sensitive user information. | |||||
| CVE-2025-43217 | 1 Apple | 2 Ipados, Iphone Os | 2025-11-03 | N/A | 4.0 MEDIUM |
| The issue was addressed by adding additional logic. This issue is fixed in iPadOS 17.7.9, iOS 18.6 and iPadOS 18.6. Privacy Indicators for microphone or camera access may not be correctly displayed. | |||||
| CVE-2025-31276 | 1 Apple | 2 Ipados, Iphone Os | 2025-11-03 | N/A | 5.3 MEDIUM |
| This issue was addressed through improved state management. This issue is fixed in iOS 18.6 and iPadOS 18.6, iPadOS 17.7.9. Remote content may be loaded even when the 'Load Remote Images' setting is turned off. | |||||
| CVE-2024-42325 | 1 Zabbix | 1 Zabbix | 2025-11-03 | N/A | 3.5 LOW |
| Zabbix API user.get returns all users that share common group with the calling user. This includes media and other information, such as login attempts, etc. | |||||
| CVE-2025-43279 | 1 Apple | 1 Macos | 2025-11-03 | N/A | 6.2 MEDIUM |
| A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Tahoe 26. An app may be able to access user-sensitive data. | |||||
| CVE-2025-62644 | 1 Rbi | 1 Restaurant Brands International Assistant | 2025-10-31 | N/A | 5.0 MEDIUM |
| The Restaurant Brands International (RBI) assistant platform through 2025-09-06 has a Global Store Directory that shares personal information among authenticated users. | |||||
| CVE-2025-35981 | 2025-10-27 | N/A | 5.5 MEDIUM | ||
| Exposure of Private Personal Information to an Unauthorized Actor (CWE-359) in the Command Centre Server allows a privileged Operator to view limited personal data about a Cardholder they would not normally have permissions to view. This issue affects Command Centre Server: 9.30.1874 (MR1), 9.20.2337 (MR3), 9.10.3194 (MR6). | |||||
| CVE-2025-11145 | 2025-10-27 | N/A | 7.5 HIGH | ||
| Observable Discrepancy, Exposure of Sensitive Information to an Unauthorized Actor, Exposure of Private Personal Information to an Unauthorized Actor vulnerability in CBK Soft Software Hardware Electronic Computer Systems Industry and Trade Inc. EnVision allows Account Footprinting.This issue affects enVision: before 250566. | |||||
| CVE-2025-53950 | 3 Apple, Fortinet, Microsoft | 3 Macos, Fortidlp Agent, Windows | 2025-10-16 | N/A | 5.5 MEDIUM |
| An Exposure of Private Personal Information ('Privacy Violation') vulnerability [CWE-359] in Fortinet FortiDLP Agent's Outlookproxy plugin for MacOS and Windows 11.5.1 and 11.4.2 through 11.4.6 and 11.3.2 through 11.3.4 and 11.2.0 through 11.2.3 and 11.1.1. through 11.1.2 and 11.0.1 and 10.5.1 and 10.4.0, and 10.3.1 may allow an authenticated administrator to collect current user's email information. | |||||
| CVE-2025-62362 | 2025-10-14 | N/A | N/A | ||
| gpp-burgerportaal is a Dutch government citizen portal application. In versions before 2.0.3, 3.0.2, and 4.0.1, the name and email address of employees who publish content are exposed in network responses and can be discovered by viewing the browser's developer tools network tab. This information disclosure may violate employee privacy expectations and could be used for targeted attacks or unwanted contact. This issue has been patched in versions 2.0.3, 3.0.2, and 4.0.1. No known workarounds exist. | |||||
| CVE-2025-5009 | 2025-10-08 | N/A | N/A | ||
| In Gemini iOS, when a user shared a snippet of a conversation, it would share the entire conversation via a sharable public link that contained the entire conversation history and not just the snippet. | |||||
| CVE-2025-59843 | 1 Flagforge | 1 Flagforge | 2025-10-08 | N/A | 5.3 MEDIUM |
| Flag Forge is a Capture The Flag (CTF) platform. From versions 2.0.0 to before 2.3.1, the public endpoint /api/user/[username] returns user email addresses in its JSON response. The problem has been patched in FlagForge version 2.3.1. The fix removes email addresses from public API responses while keeping the endpoint publicly accessible. Users should upgrade to version 2.3.1 or later to eliminate exposure. There are no workarounds for this vulnerability. | |||||
| CVE-2025-10859 | 1 Mozilla | 1 Firefox | 2025-10-03 | N/A | 4.0 MEDIUM |
| Cookie storage for non-HTML temporary documents was being shared incorrectly with normal browsing content, allowing information from private tabs to escape Incognito mode even after the user closed all tabs This vulnerability affects Firefox for iOS < 143.1. | |||||
| CVE-2025-1939 | 1 Mozilla | 1 Firefox | 2025-09-29 | N/A | 3.9 LOW |
| Android apps can load web pages using the Custom Tabs feature. This feature supports a transition animation that could have been used to trick a user into granting sensitive permissions by hiding what the user was actually clicking. This vulnerability affects Firefox < 136. | |||||