CVE-2025-24284

HighCVSS 8.8/10Last modified Oct 7, 2026

Description

This issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in macOS Sequoia 15.4. An app may be able to break out of its sandbox.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-693

Affected software

No affected versions have been published.

Timeline

Published: Jun 11, 2026
Last modified: Oct 7, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-242859.8Multiple Improper Input Validation vulnerabilities in UniFi Connect EV Station Lite may allow a Command Injection by a malicious actor with CVE-2025-242864.9A vulnerability allowing an authenticated user with the Backup Operator role to modify backup jobs, which could execute arbitrary code.CVE-2025-242876.1A vulnerability allowing local system users to modify directory contents, allowing for arbitrary code execution on the local system with ele CVE-2025-242889.8The Versa Director software exposes a number of services by default and allow attackers an easy foothold due to default credentials and mult CVE-2025-242897.5A Cross-Site Request Forgery (CSRF) leading to Cross-Site Scripting (XSS) vulnerability in the UCRM Client Signup Plugin (v1.3.4 and earlier CVE-2025-242909.9Multiple Authenticated SQL Injection vulnerabilities found in UISP Application (Version 2.4.206 and earlier) could allow a malicious actor w CVE-2025-242916.1The Versa Director SD-WAN orchestration platform provides functionality to upload various types of files. However, the Java code handling fi CVE-2025-242926.8A misconfigured query in UniFi Network (v9.1.120 and earlier) could allow users to authenticate to Enterprise WiFi or VPN Server (l2tp and O CVE-2025-242938.1# Active Storage allowed transformation methods potentially unsafe Active Storage attempts to prevent the use of potentially unsafe image CVE-2025-242947.5The attack vector is a potential Denial of Service (DoS). The vulnerability is caused by an insufficient check on the length of a decompress CVE-2025-242966.0Improper input validation in some firmware for the Intel(R) E810 Ethernet before version 4.6 may allow a privileged user to enable denial of CVE-2025-242979.8Due to lack of server-side input validation, attackers can inject malicious JavaScript code into users personal spaces of the web portal.