← Back

Safari

safari

Vendor: Apple • 1,629 CVEs

CVEs (1,629)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2016-4618
1Apple
2Iphone Os
Safari
May 6, 2026
Sep 25, 2016
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Cross-site scripting (XSS) vulnerability in Safari Reader in Apple iOS before 10 and Safari before 10 allows remote attackers to inject arbitrary web script or HTML via a crafted web site, aka "Universal XSS (UXSS)."
CVE-2016-4611
1Apple
3Iphone Os
SafariTvos
May 6, 2026
Sep 25, 2016
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
WebKit in Apple iOS before 10, Safari before 10, and tvOS before 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability tha...Show more
WebKit in Apple iOS before 10, Safari before 10, and tvOS before 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-4730, CVE-2016-4733, CVE-2016-4734, and CVE-2016-4735.Show less
CVE-2016-7153
5Apple
GoogleMicrosoft+2 more
6Chrome
EdgeFirefox+3 more
May 6, 2026
Sep 6, 2016
N/A· v4
5.3 MEDIUM· v3
5.0 MEDIUM· v2
The HTTP/2 protocol does not consider the role of the TCP congestion window in providing information about content length, which makes it easier for remote attackers to obtain cleartext data by leveraging a web-browser c...Show more
The HTTP/2 protocol does not consider the role of the TCP congestion window in providing information about content length, which makes it easier for remote attackers to obtain cleartext data by leveraging a web-browser configuration in which third-party cookies are sent, aka a "HEIST" attack.Show less
CVE-2016-7152
5Apple
GoogleMicrosoft+2 more
6Chrome
EdgeFirefox+3 more
May 6, 2026
Sep 6, 2016
N/A· v4
5.3 MEDIUM· v3
5.0 MEDIUM· v2
The HTTPS protocol does not consider the role of the TCP congestion window in providing information about content length, which makes it easier for remote attackers to obtain cleartext data by leveraging a web-browser co...Show more
The HTTPS protocol does not consider the role of the TCP congestion window in providing information about content length, which makes it easier for remote attackers to obtain cleartext data by leveraging a web-browser configuration in which third-party cookies are sent, aka a "HEIST" attack.Show less
CVE-2016-4651
1Apple
2Iphone Os
Safari
May 6, 2026
Jul 22, 2016
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Cross-site scripting (XSS) vulnerability in the WebKit JavaScript bindings in Apple iOS before 9.3.3 and Safari before 9.1.2 allows remote attackers to inject arbitrary web script or HTML via a crafted HTTP/0.9 response,...Show more
Cross-site scripting (XSS) vulnerability in the WebKit JavaScript bindings in Apple iOS before 9.3.3 and Safari before 9.1.2 allows remote attackers to inject arbitrary web script or HTML via a crafted HTTP/0.9 response, related to a "cross-protocol cross-site scripting (XPXSS)" vulnerability.Show less
CVE-2016-4624
1Apple
3Iphone Os
SafariTvos
May 6, 2026
Jul 22, 2016
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerab...Show more
WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-4589, CVE-2016-4622, and CVE-2016-4623.Show less
CVE-2016-4623
1Apple
3Iphone Os
SafariTvos
May 6, 2026
Jul 22, 2016
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerab...Show more
WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-4589, CVE-2016-4622, and CVE-2016-4624.Show less
CVE-2016-4622
1Apple
3Iphone Os
SafariTvos
May 6, 2026
Jul 22, 2016
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerab...Show more
WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-4589, CVE-2016-4623, and CVE-2016-4624.Show less
CVE-2016-4604
1Apple
1Safari
May 6, 2026
Jul 22, 2016
N/A· v4
5.4 MEDIUM· v3
5.8 MEDIUM· v2
Safari in Apple iOS before 9.3.3 allows remote attackers to spoof the displayed URL via an HTTP response specifying redirection to an invalid TCP port number.
CVE-2016-4590
1Apple
2Safari
Webkit
May 6, 2026
Jul 22, 2016
N/A· v4
5.4 MEDIUM· v3
4.3 MEDIUM· v2
WebKit in Apple iOS before 9.3.3 and Safari before 9.1.2 mishandles about: URLs, which allows remote attackers to bypass the Same Origin Policy via a crafted web site.
CVE-2016-4586
1Apple
2Safari
Tvos
May 6, 2026
Jul 22, 2016
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
WebKit in Apple Safari before 9.1.2 and tvOS before 9.2.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.
CVE-2016-4584
1Apple
3Iphone Os
SafariTvos
May 6, 2026
Jul 22, 2016
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
The WebKit Page Loading implementation in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafte...Show more
The WebKit Page Loading implementation in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.Show less
CVE-2016-1864
1Apple
2Iphone Os
Safari
May 6, 2026
Jun 19, 2016
N/A· v4
4.3 MEDIUM· v3
5.0 MEDIUM· v2
The XSS auditor in WebKit, as used in Apple iOS before 9.3 and Safari before 9.1, does not properly handle redirects in block mode, which allows remote attackers to obtain sensitive information via a crafted URL.
CVE-2016-1859
2Apple
Webkitgtk
4Iphone Os
SafariTvos+1 more
May 6, 2026
May 20, 2016
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
The WebKit Canvas implementation in Apple iOS before 9.3.2, Safari before 9.1.1, and tvOS before 9.2.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web...Show more
The WebKit Canvas implementation in Apple iOS before 9.3.2, Safari before 9.1.1, and tvOS before 9.2.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.Show less
CVE-2016-1858
2Apple
Webkitgtk
4Iphone Os
SafariTvos+1 more
May 6, 2026
May 20, 2016
N/A· v4
6.5 MEDIUM· v3
4.3 MEDIUM· v2
WebKit, as used in Apple iOS before 9.3.2, Safari before 9.1.1, and tvOS before 9.2.1, improperly tracks taint attributes, which allows remote attackers to obtain sensitive information via a crafted web site.
CVE-2016-1857
2Apple
Webkitgtk
4Iphone Os
SafariTvos+1 more
May 6, 2026
May 20, 2016
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
WebKit, as used in Apple iOS before 9.3.2, Safari before 9.1.1, and tvOS before 9.2.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a differen...Show more
WebKit, as used in Apple iOS before 9.3.2, Safari before 9.1.1, and tvOS before 9.2.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-1854, CVE-2016-1855, and CVE-2016-1856.Show less
CVE-2016-1856
2Apple
Webkitgtk
4Iphone Os
SafariTvos+1 more
May 6, 2026
May 20, 2016
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
WebKit, as used in Apple iOS before 9.3.2, Safari before 9.1.1, and tvOS before 9.2.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a differen...Show more
WebKit, as used in Apple iOS before 9.3.2, Safari before 9.1.1, and tvOS before 9.2.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-1854, CVE-2016-1855, and CVE-2016-1857.Show less
CVE-2016-1855
1Apple
3Iphone Os
SafariTvos
May 6, 2026
May 20, 2016
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
WebKit, as used in Apple iOS before 9.3.2, Safari before 9.1.1, and tvOS before 9.2.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a differen...Show more
WebKit, as used in Apple iOS before 9.3.2, Safari before 9.1.1, and tvOS before 9.2.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-1854, CVE-2016-1856, and CVE-2016-1857.Show less
CVE-2016-1854
2Apple
Webkitgtk
4Iphone Os
SafariTvos+1 more
May 6, 2026
May 20, 2016
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
WebKit, as used in Apple iOS before 9.3.2, Safari before 9.1.1, and tvOS before 9.2.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a differen...Show more
WebKit, as used in Apple iOS before 9.3.2, Safari before 9.1.1, and tvOS before 9.2.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-1855, CVE-2016-1856, and CVE-2016-1857.Show less
CVE-2016-1849
1Apple
2Iphone Os
Safari
May 6, 2026
May 20, 2016
N/A· v4
3.3 LOW· v3
2.1 LOW· v2
The "Clear History and Website Data" feature in Apple Safari before 9.1.1, as used in iOS before 9.3.2 and other products, mishandles the deletion of browsing history, which might allow local users to obtain sensitive in...Show more
The "Clear History and Website Data" feature in Apple Safari before 9.1.1, as used in iOS before 9.3.2 and other products, mishandles the deletion of browsing history, which might allow local users to obtain sensitive information by leveraging read access to a Safari directory.Show less