Apple Xcode vulnerabilities

96 CVEs affecting Apple Xcode, 2 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-65393, published 2026-09-14.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-44228: Apache Log4j2 Remote Code Execution Vulnerability, published 2021-12-10. Critical severity, CVSS 10.0. Actively exploited: in CISA KEV since 2021-12-10. EPSS: 100% chance of exploitation in the next 30 days. Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker…
CVE-2025-48384: Git Link Following Vulnerability, published 2025-07-08. High severity, CVSS 8.0. Actively exploited: in CISA KEV since 2025-08-25. EPSS: 4.4% chance of exploitation in the next 30 days. Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When reading a config value, Git…
CVE-2021-21300, published 2021-03-09. High severity, CVSS 7.5. EPSS: 88.5% chance of exploitation in the next 30 days. Git is an open-source distributed revision control system. In affected versions of Git a specially crafted repository that contains symbolic links as well as files using a clean/smudge filter such as…
CVE-2004-2687, published 2004-12-31. High severity, CVSS 9.3. EPSS: 88.2% chance of exploitation in the next 30 days. distcc 2.x, as used in XCode 1.5 and others, when not configured to restrict access to the server port, allows remote attackers to execute arbitrary commands via compilation jobs, which are executed…
CVE-2016-0742, published 2016-02-15. High severity, CVSS 7.5. EPSS: 82.4% chance of exploitation in the next 30 days. The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 allows remote attackers to cause a denial of service (invalid pointer dereference and worker process crash) via a crafted UDP DNS response.
CVE-2014-9390, published 2020-02-12. Critical severity, CVSS 9.8. EPSS: 75.6% chance of exploitation in the next 30 days. Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Apple Xcode before 6.2 beta 3;…
CVE-2017-7529, published 2017-07-13. High severity, CVSS 7.5. EPSS: 62.6% chance of exploitation in the next 30 days. Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in nginx range filter module resulting into leak of potentially sensitive information triggered…
CVE-2018-16843, published 2018-11-07. High severity, CVSS 7.5. EPSS: 48% chance of exploitation in the next 30 days. nginx before versions 1.15.6 and 1.14.1 has a vulnerability in the implementation of HTTP/2 that can allow for excessive memory consumption. This issue affects nginx compiled with the…
CVE-2015-3185, published 2015-07-20. Medium severity, CVSS 4.3. EPSS: 16.3% chance of exploitation in the next 30 days. The ap_some_auth_required function in server/request.c in the Apache HTTP Server 2.4.x before 2.4.14 does not consider that a Require directive may be associated with an authorization setting rather…
CVE-2019-20372, published 2020-01-09. Medium severity, CVSS 5.3. EPSS: 15% chance of exploitation in the next 30 days. NGINX before 1.17.7, with certain error_page configurations, allows HTTP request smuggling, as demonstrated by the ability of an attacker to read unauthorized web pages in environments where NGINX is…

Latest

CVE-2026-65393, published 2026-09-14. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. A permissions issue was addressed with improved validation. This issue is fixed in Xcode 27, macOS Golden Gate 27. An app may be able to access user-sensitive data.
CVE-2026-28890, published 2026-03-25. Medium severity, CVSS 5.5. EPSS: 0.1% chance of exploitation in the next 30 days. An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in Xcode 26.4. An app may be able to cause unexpected system termination.
CVE-2026-28889, published 2026-03-25. Medium severity, CVSS 6.2. EPSS: 0.1% chance of exploitation in the next 30 days. A permissions issue was addressed with additional restrictions. This issue is fixed in Xcode 26.4. An app may be able to read arbitrary files as root.
CVE-2025-31186, published 2026-01-16. Low severity, CVSS 3.3. EPSS: 0.2% chance of exploitation in the next 30 days. A permissions issue was addressed with additional restrictions. This issue is fixed in Xcode 16.3. An app may be able to bypass Privacy preferences.
CVE-2025-43505, published 2025-11-04. High severity, CVSS 8.8. EPSS: 0.3% chance of exploitation in the next 30 days. An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in Xcode 26.1. Processing a maliciously crafted file may lead to heap corruption.
CVE-2025-43504, published 2025-11-04. Medium severity, CVSS 4.9. EPSS: 0.4% chance of exploitation in the next 30 days. A buffer overflow was addressed with improved bounds checking. This issue is fixed in Xcode 26.1. A user in a privileged network position may be able to cause a denial-of-service.
CVE-2025-43375, published 2025-09-15. Medium severity, CVSS 5.5. EPSS: 0.3% chance of exploitation in the next 30 days. The issue was addressed with improved checks. This issue is fixed in Xcode 26. Processing an overly large path value may crash a process.
CVE-2025-43371, published 2025-09-15. High severity, CVSS 8.2. EPSS: 0.2% chance of exploitation in the next 30 days. This issue was addressed with improved checks. This issue is fixed in Xcode 26. An app may be able to break out of its sandbox.
CVE-2025-43370, published 2025-09-15. Medium severity, CVSS 4.0. EPSS: 0.3% chance of exploitation in the next 30 days. A path handling issue was addressed with improved validation. This issue is fixed in Xcode 26. Processing an overly large path value may crash a process.
CVE-2025-43263, published 2025-09-15. High severity, CVSS 7.1. EPSS: 0.2% chance of exploitation in the next 30 days. The issue was addressed with improved checks. This issue is fixed in Xcode 26. An app may be able to read and write files outside of its sandbox.