This page lists publicly disclosed CVE vulnerabilities affecting apple xcode (linked via NVD CPE). Each row includes severity scores, summaries, and publication dates to help identify and analyze security issues.
| CVE | Summary | Source | Max CVSS | EPSS % | Published | Updated |
|---|---|---|---|---|---|---|
| CVE-2019-8840 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in Xcode 11.3. Compiling with untrusted sources may lead to arbitrary code execution with user privileges. | [email protected] | 8.8 | 1.27% | 2020-10-27 | 2026-06-16 |
| CVE-2020-9992 | This issue was addressed by encrypting communications over the network to devices running iOS 14, iPadOS 14, tvOS 14, and watchOS 7. This issue is fixed in iOS 14.0 and iPadOS 14.0, Xcode 12.0. An attacker in a privileged network position may be able to execute arbitrary code on a paired device during a debug session over the network. | [email protected] | 7.8 | 2.99% | 2020-10-16 | 2026-06-16 |
| CVE-2014-9390 | Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Apple Xcode before 6.2 beta 3; mine all versions before 08-12-2014; libgit2 all versions up to 0.21.2; Egit all versions before 08-12-2014; and JGit all versions before 08-12-2014 allow remote Git servers to execute arbitrary commands via a tree containing a crafted .git/config file with (1) an ignorable Unicode codepoint, (2) a g | [email protected] | 9.8 | 63.18% | 2020-02-11 | 2026-06-16 |
| CVE-2019-20372 | NGINX before 1.17.7, with certain error_page configurations, allows HTTP request smuggling, as demonstrated by the ability of an attacker to read unauthorized web pages in environments where NGINX is being fronted by a load balancer. | [email protected] | 5.3 | 14.96% | 2020-01-09 | 2026-06-16 |
| CVE-2019-8806 | A memory corruption issue was addressed with improved validation. This issue is fixed in Xcode 11.2. Processing a maliciously crafted file may lead to arbitrary code execution. | [email protected] | 7.8 | 0.98% | 2019-12-18 | 2026-06-16 |
| CVE-2019-8800 | A memory corruption issue was addressed with improved validation. This issue is fixed in Xcode 11.2. Processing a maliciously crafted file may lead to arbitrary code execution. | [email protected] | 7.8 | 0.98% | 2019-12-18 | 2026-06-16 |
| CVE-2019-8739 | A memory corruption issue was addressed with improved state management. This issue is fixed in Xcode 11.0. Processing a maliciously crafted file may lead to arbitrary code execution. | [email protected] | 7.8 | 0.98% | 2019-12-18 | 2026-06-16 |
| CVE-2019-8738 | A memory corruption issue was addressed with improved state management. This issue is fixed in Xcode 11.0. Processing a maliciously crafted file may lead to arbitrary code execution. | [email protected] | 7.8 | 0.98% | 2019-12-18 | 2026-06-16 |
| CVE-2019-8724 | Multiple issues in ld64 in the Xcode toolchains were addressed by updating to version ld64-507.4. This issue is fixed in Xcode 11.0. Compiling code without proper input validation could lead to arbitrary code execution with user privilege. | [email protected] | 8.8 | 1.88% | 2019-12-18 | 2026-06-16 |
| CVE-2019-8723 | Multiple issues in ld64 in the Xcode toolchains were addressed by updating to version ld64-507.4. This issue is fixed in Xcode 11.0. Compiling code without proper input validation could lead to arbitrary code execution with user privilege. | [email protected] | 8.8 | 1.88% | 2019-12-18 | 2026-06-16 |
| CVE-2019-8722 | Multiple issues in ld64 in the Xcode toolchains were addressed by updating to version ld64-507.4. This issue is fixed in Xcode 11.0. Compiling code without proper input validation could lead to arbitrary code execution with user privilege. | [email protected] | 8.8 | 1.79% | 2019-12-18 | 2026-06-16 |
| CVE-2019-8721 | Multiple issues in ld64 in the Xcode toolchains were addressed by updating to version ld64-507.4. This issue is fixed in Xcode 11.0. Compiling code without proper input validation could lead to arbitrary code execution with user privilege. | [email protected] | 8.8 | 1.79% | 2019-12-18 | 2026-06-16 |
| CVE-2019-14379 | SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup), leading to remote code execution. | [email protected] | 9.8 | 8.04% | 2019-07-29 | 2026-06-16 |
| CVE-2018-4357 | A memory corruption issue was addressed with improved input validation. This issue affected versions prior to Xcode 10. | [email protected] | 7.8 | 0.93% | 2019-04-03 | 2026-06-16 |
| CVE-2019-3855 | An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way packets are read from the server. A remote attacker who compromises a SSH server may be able to execute code on the client system when a user connects to the server. | [email protected] | 8.8 | 9.22% | 2019-03-21 | 2026-06-16 |
| CVE-2018-16845 | nginx before versions 1.15.6, 1.14.1 has a vulnerability in the ngx_http_mp4_module, which might allow an attacker to cause infinite loop in a worker process, cause a worker process crash, or might result in worker process memory disclosure by using a specially crafted mp4 file. The issue only affects nginx if it is built with the ngx_http_mp4_module (the module is not built by default) and the .mp4. directive is used in the configuration file. Further, the attack is only possible if an attacker | [email protected] | 6.1 | 9.80% | 2018-11-07 | 2026-06-16 |
| CVE-2018-16844 | nginx before versions 1.15.6 and 1.14.1 has a vulnerability in the implementation of HTTP/2 that can allow for excessive CPU usage. This issue affects nginx compiled with the ngx_http_v2_module (not compiled by default) if the 'http2' option of the 'listen' directive is used in a configuration file. | [email protected] | 7.5 | 12.40% | 2018-11-07 | 2026-06-16 |
| CVE-2018-16843 | nginx before versions 1.15.6 and 1.14.1 has a vulnerability in the implementation of HTTP/2 that can allow for excessive memory consumption. This issue affects nginx compiled with the ngx_http_v2_module (not compiled by default) if the 'http2' option of the 'listen' directive is used in a configuration file. | [email protected] | 7.5 | 47.06% | 2018-11-07 | 2026-06-16 |
| CVE-2018-4164 | An issue was discovered in certain Apple products. Xcode before 9.3 is affected. The issue, which is unspecified, involves the "LLVM" component. | [email protected] | 9.8 | 2.50% | 2018-04-03 | 2026-06-16 |
| CVE-2017-7167 | An issue was discovered in certain Apple products. Xcode before 9.2 is affected. The issue involves the "ld64" component. A buffer overflow allows remote attackers to execute arbitrary code via crafted source code. | [email protected] | 7.8 | 1.36% | 2018-04-03 | 2026-06-16 |