Security Digest
Critical Swift advisories
6 critical advisories for Swift packages since October 2023, newest first. Check your project with swift package show-dependencies.
- Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path CVE-2026-103922 CVSS 9.3 Critical
@capacitor/android>= 6.0.0, < 6.2.2 → fixed in 6.2.2;@capacitor/android>= 7.0.0, < 7.6.9 → fixed in 7.6.9;@capacitor/ios>= 6.0.0, < 6.2.2 → fixed in 6.2.2; +17 more packages - ExecuTorch vulnerable to Heap-based Buffer Overflow CVE-2025-54951 CVSS 9.8 Critical
executorch< 0.7.0 → fixed in 0.7.0;org.pytorch:executorch-android< 0.7.0 → fixed in 0.7.0;github.com/pytorch/executorch< 0.7.0 → fixed in 0.7.0 - ExecuTorch integer overflow vulnerability CVE-2025-30404 CVSS 9.8 Critical
executorch< 0.7.0 → fixed in 0.7.0;org.pytorch:executorch-android< 0.7.0 → fixed in 0.7.0;github.com/pytorch/executorch< 0.7.0 → fixed in 0.7.0 - ExecuTorch out-of-bounds access vulnerability CVE-2025-54950 CVSS 9.8 Critical
executorch< 0.7.0 → fixed in 0.7.0;org.pytorch:executorch-android< 0.7.0 → fixed in 0.7.0;github.com/pytorch/executorch< 0.7.0 → fixed in 0.7.0 - ExecuTorch heap buffer overflow vulnerability CVE-2025-54949 CVSS 9.8 Critical
executorch< 0.7.0 → fixed in 0.7.0;org.pytorch:executorch-android< 0.7.0 → fixed in 0.7.0;github.com/pytorch/executorch< 0.7.0 → fixed in 0.7.0 - ExecuTorch integer overflow vulnerability CVE-2025-30405 CVSS 9.8 Critical
executorch< 0.7.0 → fixed in 0.7.0;org.pytorch:executorch-android< 0.7.0 → fixed in 0.7.0;github.com/pytorch/executorch< 0.7.0 → fixed in 0.7.0