Where
-Infinity
0

Trending

Last week
Last month
Last year

Vendor Risk Score

See how wpewebkit compares to other vendors in security performance

View Risk Score →

Apple tvOSApple Multiple Products Buffer Overflow Vulnerability

Risk 95
Severity
8.8
Exploited
Input Validation, Double Free, SQL Injection, Race Condition, Use After Free, Buffer Overflow
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Accessibility. A logic issue was addressed with improved checks.

1 / 81
Source: Apple
First published (updated )
CVE-2025-31277

Apple macOS MontereyWebRTC Heap Buffer Overflow Vulnerability

Risk 95
Severity
8.8
Exploited
Input Validation, Integer Overflow, Null Pointer Dereference, Buffer Overflow
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AMD. A memory corruption issue was addressed with improved input validation.

1 / 62
Source: Apple
First published (updated )
CVE-2022-2294

Microsoft Edge (Chromium-based)Google Chromium ANGLE and GPU Improper Input Validation Vulnerability

Risk 75
Severity
8.8
Exploited
EPSS
0.08%
Input Validation, Use After Free, Race Condition, Double Free, SQL Injection
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Accessibility. A logic issue was addressed with improved checks.

1 / 89
Source: Apple
First published (updated )
CVE-2025-6558

debian/webkit2gtkApple iOS and macOS Out-of-Bounds Write Vulnerability

Risk 95
Severity
8.8
Exploited
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.6.1 and iPadOS 15.6.1, macOS Monterey 12.5.1, Safari 15.6.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.

1 / 4
First published (updated )
CVE-2022-32893

debian/webkit2gtkApple Multiple Products Integer Overflow or Wraparound Vulnerability

Risk 93
Severity
8.8
Exploited
Input Validation, Integer Overflow
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

A flaw was found in WebKitGTK. An integer overflow was addressed with improved input validation.

Reference: https://webkitgtk.org/security/WSA-2022-0001.html

1 / 4
Source: Red Hat
First published (updated )
CVE-2021-30952

redhat/webkitgtkWebKitGTK Memory Corruption Vulnerability

Risk 91
Severity
8.8
Exploited
Buffer Overflow
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

A vulnerability was found in WebKit. The flaw is triggered when processing maliciously crafted web content that may lead to arbitrary code execution. Improved memory handling addresses the multiple memory corruption issues.

1 / 3
First published (updated )
CVE-2019-8720

Apple iOSInput Validation, SQL Injection, Buffer Overflow, Race Condition

Risk 91
Severity
9.8
Input Validation, SQL Injection, Buffer Overflow, Race Condition
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AirPort. A permissions issue was addressed with additional restrictions.

1 / 96
Source: Apple
First published (updated )
CVE-2025-43343

Apple iOSInput Validation, SQL Injection, Buffer Overflow, Race Condition

Risk 91
Severity
9.8
Input Validation, SQL Injection, Buffer Overflow, Race Condition
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

A correctness issue was addressed with improved checks. This issue is fixed in Safari 26, iOS 18.7 and iPadOS 18.7, iOS 26 and iPadOS 26, macOS Tahoe 26, tvOS 26, visionOS 26, watchOS 26. Processing maliciously crafted web content may lead to an unexpected process crash.

1 / 95
Source: MITRE
First published (updated )
CVE-2025-43342

ubuntu/webkit2gtkInput Validation, Race Condition, Integer Overflow

Risk 75
Severity
8.1
Input Validation, Race Condition, Integer Overflow
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

An attacker with arbitrary read and write capability may be able to bypass Pointer Authentication. Description: The issue was addressed with improved checks. WebKit Bugzilla: 272750

Versions affected: WebKitGTK and WPE WebKit before 2.44.2.

1 / 66
Source: Red Hat
First published (updated )
CVE-2024-27834

ubuntu/webkit2gtkRace Condition, Buffer Overflow, Input Validation

Risk 39
Severity
6.5
Race Condition, Buffer Overflow, Input Validation
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

A logic issue was addressed with improved state management. This issue is fixed in tvOS 17.4, macOS Sonoma 14.4, visionOS 1.1, iOS 17.4 and iPadOS 17.4, watchOS 10.4, iOS 16.7.6 and iPadOS 16.7.6, Safari 17.4. Processing maliciously crafted web content may prevent Content Security Policy from being enforced.

1 / 85
Source: Ubuntu
First published (updated )
CVE-2024-23284

ubuntu/webkit2gtkBuffer Overflow, Race Condition, Input Validation

Risk 72
Severity
7.5
Buffer Overflow, Race Condition, Input Validation
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

A maliciously crafted webpage may be able to fingerprint the user. WebKit Bugzilla: 266703

1 / 80
Source: Red Hat
First published (updated )
CVE-2024-23280

ubuntu/webkit2gtkInput Validation, Race Condition, Buffer Overflow

Risk 62
Severity
8.1
Input Validation, Race Condition, Buffer Overflow
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

A logic issue was addressed with improved validation. This issue is fixed in tvOS 17.4, macOS Sonoma 14.4, visionOS 1.1, iOS 17.4 and iPadOS 17.4, watchOS 10.4, iOS 16.7.6 and iPadOS 16.7.6, Safari 17.4. Processing maliciously crafted web content may prevent Content Security Policy from being enforced.

1 / 84
Source: Ubuntu
First published (updated )
CVE-2024-23263

ubuntu/webkit2gtkBuffer Overflow, Race Condition, Input Validation

Risk 39
Severity
6.5
Buffer Overflow, Race Condition, Input Validation
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

A malicious website may exfiltrate audio data cross-origin WebKit Bugzilla: 263795

1 / 79
Source: Red Hat
First published (updated )
CVE-2024-23254

Apple macOS VenturaBuffer Overflow, Use After Free, Input Validation, Integer Overflow, Race Condition

Risk 91
Severity
9.8
Buffer Overflow, Use After Free, Input Validation, Integer Overflow, Race Condition
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Accessibility. A privacy issue was addressed with improved private data redaction for log entries.

1 / 55
Source: Apple
First published (updated )
CVE-2023-40397

ubuntu/webkit2gtkUse After Free

Risk 73
Severity
7.5
Use After Free
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

An inconsistent user interface issue was addressed with improved state management. This issue is fixed in iOS 16.7.2 and iPadOS 16.7.2, iOS 17.1 and iPadOS 17.1, Safari 17.1, macOS Sonoma 14.1. Visiting a malicious website may lead to address bar spoofing.

1 / 37
Source: Ubuntu
First published (updated )
CVE-2023-42843

debian/webkit2gtkBubblewrapLauncher.cpp in WebKitGTK and WPE WebKit before 2.34.1 allows a limited sandbox bypass tha…

Risk 39
Severity
5.3
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

BubblewrapLauncher.cpp in WebKitGTK and WPE WebKit before 2.34.1 allows a limited sandbox bypass that allows a sandboxed process to trick host processes into thinking the sandboxed process is not confined by the sandbox, by abusing VFS syscalls that manipulate its filesystem namespace. The impact is limited to host services that create UNIX sockets that WebKit mounts inside its sandbox, and the sandboxed process remains otherwise confined. NOTE: this is similar to CVE-2021-41133.

1 / 2
First published (updated )
CVE-2021-42762

Apple macOS VenturaBuffer Overflow, Input Validation, Integer Overflow, Use After Free, Race Condition

Risk 29
Severity
5.3
Buffer Overflow, Input Validation, Integer Overflow, Use After Free, Race Condition
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

A logic issue was addressed with improved validation. This issue is fixed in macOS Ventura 13.3. Content Security Policy to block domains with wildcards may fail.

1 / 71
Source: MITRE
First published (updated )
CVE-2023-32370

Apple macOS VenturaUse After Free, Buffer Overflow, Input Validation, Integer Overflow, Race Condition

Risk 82
Severity
8.8
Use After Free, Buffer Overflow, Input Validation, Integer Overflow, Race Condition
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 16.4 and iPadOS 16.4, macOS Ventura 13.3. Processing web content may lead to arbitrary code execution.

1 / 72
Source: MITRE
First published (updated )
CVE-2023-28198

debian/webkit2gtkInput Validation

Risk 89
Severity
10
Input Validation
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Last updated 24 July 2024

1 / 3
Source: Ubuntu
First published (updated )
CVE-2020-13753

redhat/webkitgtkUse After Free

Risk 81
Severity
8.8
Use After Free
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

A use-after-free issue exists in WebKitGTK before 2.28.1 and WPE WebKit before 2.28.1 via crafted web content that allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash).

1 / 3
Source: MITRE
First published (updated )
CVE-2020-11793

redhat/webkitgtkUse After Free

Risk 90
Severity
9.8
Use After Free
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

accessibility/AXObjectCache.cpp in WebKit, as used in WebKitGTK through 2.26.4 and WPE WebKit through 2.26.4, allows a denial of service (application crash) because maintenance of the mdeferredFocusedNodeChange data structure mishandles removal.

Upstream patch:

https://trac.webkit.org/changeset/257292/webkit

1 / 3
Source: Red Hat
First published (updated )
CVE-2020-10018

redhat/webkitgtkLast updated 24 July 2024

Risk 61
Severity
8.1
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

embed/ephy-web-view.c in GNOME Web (aka Epiphany) through 3.31.4 allows address bar spoofing because a page load triggered by JavaScript leads to updating an address as if it were triggered by a safer visit type (e.g., VISITLINK, VISITTYPED, VISITBOOKMARK, or VISITHOMEPAGE).

Upstream issue: https://gitlab.gnome.org/GNOME/epiphany/issues/532

1 / 3
Source: Red Hat
First published (updated )
CVE-2019-6251

redhat/webkitgtkLast updated 24 July 2024

Risk 28
Severity
5.3
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Last updated 24 July 2024

1 / 3
Source: Ubuntu
First published (updated )
CVE-2019-11070

Canonical Ubuntu LinuxInteger Overflow, Buffer Overflow

Risk 80
Severity
8.8
Integer Overflow, Buffer Overflow
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Last updated 25 August 2025

1 / 2
Source: Ubuntu
First published (updated )
CVE-2018-12293

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203