https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2011-0214.htmlhttps://patchthecve.com/cve/CVE-2011-0214.htmlTue, 16 Jun 2026 23:27:01 +0000MEDIUM 5.0: CFNetwork in Apple Safari before 5.0.6 on Windows does not properly handle an untrusted attribute of a system root certificate, which allows remote web servers to bypass intended SSL restrictions via a certificate signed by a blacklisted certification authority.https://patchthecve.com/cve/CVE-2010-1420.htmlhttps://patchthecve.com/cve/CVE-2010-1420.htmlTue, 16 Jun 2026 23:18:21 +0000MEDIUM 4.3: Cross-site scripting (XSS) vulnerability in CFNetwork in Apple Safari before 5.0.6 allows remote attackers to inject arbitrary web script or HTML via a crafted text/plain file.https://patchthecve.com/cve/CVE-2010-1383.htmlhttps://patchthecve.com/cve/CVE-2010-1383.htmlTue, 16 Jun 2026 23:18:14 +0000HIGH 9.3: CFNetwork in Apple Safari before 5.0.6 on Windows allows remote web servers to execute arbitrary code by replaying the NTLM credentials of a client user, related to a "credential reflection" issue.https://patchthecve.com/cve/CVE-2010-1800.htmlhttps://patchthecve.com/cve/CVE-2010-1800.htmlTue, 16 Jun 2026 23:19:21 +0000MEDIUM 5.0: CFNetwork in Apple Mac OS X 10.6.3 and 10.6.4 supports anonymous SSL and TLS connections, which allows man-in-the-middle attackers to redirect a connection and obtain sensitive information via crafted responses.https://patchthecve.com/cve/CVE-2007-2403.htmlhttps://patchthecve.com/cve/CVE-2007-2403.htmlTue, 16 Jun 2026 22:39:31 +0000MEDIUM 6.8: CFNetwork on Apple Mac OS X 10.3.9 and 10.4.10 does not properly validate ftp: URIs, which allows remote attackers to trigger the transmission of arbitrary FTP commands to arbitrary FTP servers.https://patchthecve.com/cve/CVE-2007-0464.htmlhttps://patchthecve.com/cve/CVE-2007-0464.htmlTue, 16 Jun 2026 22:35:37 +0000MEDIUM 5.0: The _CFNetConnectionWillEnqueueRequests function in CFNetwork 129.19 on Apple Mac OS X 10.4 through 10.4.10 allows remote attackers to cause a denial of service (application crash) via a crafted HTTP 301 response, which results in a NULL pointer dereference.