CVE-2023-37450

HighCVSS 8.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

The issue was addressed with improved checks. This issue is fixed in iOS 16.6 and iPadOS 16.6, Safari 16.5.2, tvOS 16.6, macOS Ventura 13.5, watchOS 9.6. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected software

No affected versions have been published.

Timeline

Published: Jul 27, 2023
Last modified: Jun 17, 2026
Added to CISA KEV: Jul 13, 2023
NVD status: Analyzed

Related CVEs from 2023

CVE-2023-374534.6An issue was discovered in the USB subsystem in the Linux kernel through 6.4.2. There is an out-of-bounds and crash in read_descriptors in d CVE-2023-374545.5An issue was discovered in the Linux kernel through 6.4.2. A crafted UDF filesystem image causes a use-after-free write operation in the udf CVE-2023-374555.4The permission request prompt from the site in the background tab was overlaid on top of the site in the foreground tab. This vulnerability CVE-2023-374566.5The session restore helper crashed whenever there was no parameter sent to the message handler. This vulnerability affects Firefox for iOS <CVE-2023-374578.2Asterisk is an open source private branch exchange and telephony toolkit. In Asterisk versions 18.20.0 and prior, 20.5.0 and prior, and 21.0 CVE-2023-374595.3Contiki-NG is an operating system for internet-of-things devices. In versions 4.9 and prior, when a packet is received, the Contiki-NG netwo CVE-2023-37465.4The ActivityPub WordPress plugin before 1.0.0 does not sanitize and escape some data from post content, which could allow contributor and ab CVE-2023-374609.8Plexis Archiver is a collection of Plexus components to create archives or extract archives to a directory with a unified `Archiver`/`UnArch CVE-2023-374619.8Metersphere is an opensource testing framework. Files uploaded to Metersphere may define a `belongType` value with a relative path like `../CVE-2023-374628.8XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Improper escaping in the document `CVE-2023-374637.5cmark-gfm is an extended version of the C reference implementation of CommonMark, a rationalized version of Markdown syntax with a spec. Thr CVE-2023-374647.5OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption (JOSE). The AES GCM decryption routine incorrectly us