Kritz

We studied how
systems break.

Research by the people building Kritz.

Company
Category

2026

AppleSafariBrowser

Safari · Web Inspector

Style resolver use-after-free; browser-process code execution.

CVE-2026-28955ZDI-CAN-28879
AppleOS

macOS · CoreSymbolication

Out-of-bounds read and information disclosure.

CVE-2026-28918ZDI-CAN-28695
Trading

Bitget · Web · Access control

Unpublished listing and delisting information.

Bitget WebBugRap report
TradingApps

Bitget · Windows · Origin validation

Wildcard-origin trust boundary bypass.

Bitget WindowsBugRap report

2025

AppleSafariBrowser

Safari · Scrollbar animation

Use-after-free affecting the browser process.

CVE-2025-31238
AppleOS

ProRes

Processing issue that can terminate the system unexpectedly.

CVE-2025-31245
AppleOS

macOS · CoreGraphics

PDF parsing out-of-bounds read and information disclosure.

CVE-2025-31196ZDI-CAN-26498
AppleSafariBrowser

Safari · Hidden Photos

Authentication bypass exposing the Hidden Photos album.

CVE-2025-31185
AppleOS

macOS · BOM

Memory handling issue triggered by web content.

CVE-2025-24222
AppleOS

macOS · ImageIO / CoreGraphics

Image parsing information disclosure.

CVE-2025-24210
AppleOS

macOS · sips

File parsing issue causing unexpected application termination.

CVE-2025-24139

2024

AppleOS

ImageIO

Image parsing memory disclosure.

CVE-2024-54500
AppleOS

ImageIO

Use-after-free during image processing.

CVE-2024-54499
AppleOS

QuartzCore

Denial of service triggered by web content.

CVE-2024-54497
AppleOS

macOS · sips

Out-of-bounds write during file parsing.

CVE-2024-44284
AppleOS

ImageIO

Out-of-bounds access during image processing.

CVE-2024-44176
AppleOS

SceneKit

Buffer overflow during file processing.

CVE-2024-44144
MicrosoftOS

Windows · SAPI

Use-after-free in the Speech Application Programming Interface.

CVE-2024-43574
AppleOS

ImageIO

Integer overflow during file processing.

CVE-2024-40784
AppleOS

ImageIO

Out-of-bounds access during file processing.

CVE-2024-40777
AppleOS

ImageIO

Out-of-bounds read during file processing.

CVE-2024-27880
AppleSafariBrowser

Safari · WebKit

File processing memory safety issue.

CVE-2024-27856
AppleOS

ImageIO

Image processing memory safety issue.

CVE-2024-27836
AppleOS

ImageIO

Buffer overflow during image processing.

CVE-2024-23286
AppleOS

ImageIO

Image processing memory disclosure.

CVE-2024-23257
ChromeBrowser

Chrome · QUIC

Use-after-free in the QUIC network implementation.

CVE-2024-3837

2023

AppleOS

ImageIO

Image processing memory corruption.

CVE-2023-42899
AppleOS

ImageIO

Image processing memory corruption.

CVE-2023-42898
AppleSafariBrowser

Safari · WebKit

Web content memory safety issue.

CVE-2023-42866
AppleSafariBrowser

Safari · WebKit Process Model

Denial of service triggered by web content.

CVE-2023-41983
AppleSafariBrowser

Safari · WebKit

Use-after-free during web content processing.

CVE-2023-41976
AppleSafariBrowser

Safari · WebKit

Web content processing memory safety issue.

CVE-2023-41074
AppleSafariBrowser

Safari · WebKit

Web content processing issue allowing arbitrary code execution.

CVE-2023-38597
AppleSafariBrowser

Safari · WebKit

Memory handling issue during web content processing.

CVE-2023-40447
AppleOS

CoreAnimation

Denial of service triggered by web content.

CVE-2023-40420
ChromeBrowser

Chrome

User interface spoofing.

CVE-2023-5859
Apps

Thunderbird

Attachment filename spoofing using Unicode direction overrides.

CVE-2023-3417

References

ChromeBrowser

Chrome

UI spoofing.

ZDI-CAN-22983Report reference
AppleOS

vImage

Out-of-bounds write.

ZDI-CAN-22307Report reference
AppleOS

libJPEG

Out-of-bounds write.

ZDI-CAN-23837Report reference
AppleOS

libJP2

Uninitialized pointer access.

ZDI-CAN-23836Report reference
AppleSafariBrowser

Safari · Network framework

Use-after-free.

CVE-2024-42972Unverified reference

No matching findings.