Webkit - vulnerabilities (CVEs)
14 CVEs in 3 products, 0 in the last 30 days, newest from 2026-08-31.
Products
- Webkit - 5 CVEs
- Webkitgtk+ - 5 CVEs
- Javascriptcore - 1 CVEs
Newest CVEs of Webkit
- CVE-2026-83596 - CVSS 8.8 (high), 2026-08-31: A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling.
- CVE-2026-78376 - CVSS 8.8 (high), 2026-08-24: A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory handling and result in memory…
- CVE-2023-39928 - CVSS 8.8 (high), 2023-10-06: A use-after-free vulnerability exists in the MediaRecorder API of Webkit WebKitGTK 2.40.5. A specially crafted web page can abuse this vulnerability to cause…
- CVE-2020-9948 - CVSS 8.8 (high), 2020-10-16: A type confusion issue was addressed with improved memory handling. This issue is fixed in Safari 14.0. Processing maliciously crafted web content may lead to…
- CVE-2020-9952 - CVSS 7.1 (high), 2020-10-16: An input validation issue was addressed with improved input validation. This issue is fixed in iOS 14.0 and iPadOS 14.0, tvOS 14.0, watchOS 7.0, Safari 14.0,…
- CVE-2020-9951 - CVSS 8.8 (high), 2020-10-16: A use after free issue was addressed with improved memory management. This issue is fixed in Safari 14.0. Processing maliciously crafted web content may lead…
- CVE-2018-4209 - CVSS 8.8 (high), 2019-01-11: In iOS before 11.3, Safari before 11.1, iCloud for Windows before 7.4, tvOS before 11.3, watchOS before 4.3, iTunes before 12.7.4 for Windows, unexpected…
- CVE-2018-12294 - CVSS 8.8 (high), 2018-06-19: WebCore/platform/graphics/texmap/TextureMapperLayer.cpp in WebKit, as used in WebKitGTK+ prior to version 2.20.2, is vulnerable to a use after free for a…
- CVE-2016-9643 - CVSS 7.5 (high), 2017-03-07: The regex code in Webkit 2.4.11 allows remote attackers to cause a denial of service (memory consumption) as demonstrated in a large number of ($ (open…
- CVE-2016-9642 - CVSS 5.5 (medium), 2017-02-03: JavaScriptCore in WebKit allows attackers to cause a denial of service (out-of-bounds heap read) via a crafted Javascript file.
- CVE-2010-1766 - CVSS 7.5 (high), 2010-07-22: Off-by-one error in the WebSocketHandshake::readServerHandshake function in websockets/WebSocketHandshake.cpp in WebCore in WebKit before r56380, as used in…
- CVE-2009-3933 - CVSS 5 (medium), 2009-11-12: WebKit before r50173, as used in Google Chrome before 3.0.195.32, allows remote attackers to cause a denial of service (CPU consumption) via a web page that…
- CVE-2008-6059 - CVSS 5 (medium), 2009-02-05: xml/XMLHttpRequest.cpp in WebCore in WebKit before r38566 does not properly restrict access from web pages to the (1) Set-Cookie and (2) Set-Cookie2 HTTP…
- CVE-2008-1590 - CVSS 6.8 (medium), 2008-07-14: JavaScriptCore in WebKit on Apple iPhone before 2.0 and iPod touch before 2.0 does not properly perform runtime garbage collection, which allows remote…
