CVE-2025-43480

HighCVSS 8.1/10Last modified Oct 18, 2026

Description

The issue was addressed with improved checks. This issue is fixed in Safari 26.1, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. A malicious website may exfiltrate data cross-origin.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-942

Affected software

VendorProductVersions
AppleSafari< 26.1
AppleiOS and iPadOS< 26.1
ApplemacOS< 26.1
AppletvOS< 26.1
ApplevisionOS< 26.1
ApplewatchOS< 26.1

References

Timeline

Published
Nov 4, 2025
Last modified
Oct 18, 2026
NVD status
Modified

Related CVEs from 2025

CVE-2025-434815.2This issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7.2, macOS Tahoe 26.1. An app may be able to break ouCVE-2025-434825.5The issue was addressed with improved input validation. This issue is fixed in macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, macOS Tahoe 26.2. CVE-2025-434835.7A potential security vulnerability has been identified in the Poly Clariti Manager for versions prior to 10.12.1. The vulnerability could alCVE-2025-434846.1A potential reflected cross-site scripting vulnerability has been identified in the Poly Clariti Manager for versions prior to 10.12.1. The CVE-2025-434854.5A potential security vulnerability has been identified in the Poly Clariti Manager for versions prior to 10.12.2. The vulnerability could poCVE-2025-434864.8A potential stored cross-site scripting vulnerability has been identified in the Poly Clariti Manager for versions prior to 10.12.1. The webCVE-2025-434876.8A potential privilege escalation through Sudo vulnerability has been identified in the Poly Clariti Manager for versions prior to 10.12.2. TCVE-2025-434884.8A potential security vulnerability has been identified in the Poly Clariti Manager for versions prior to 10.12.2. The vulnerability could alCVE-2025-434895.2A potential security vulnerability has been identified in the Poly Clariti Manager for versions prior to 10.12.1. The vulnerability could deCVE-2025-43499.8A vulnerability classified as critical has been found in D-Link DIR-600L up to 2.07B01. This affects the function formSysCmd. The manipulatiCVE-2025-434908.4A potential security vulnerability has been identified in the HPAudioAnalytics service included in the HP Hotkey Support software, which migCVE-2025-434919.8A vulnerability in the Poly Lens Desktop application running on the Windows platform might allow modifications to the filesystem, which migh
CVE-2025-43480: High severity, CVSS 8.1 | Vulnix