Apple vulnerabilities in CISA KEV
Apple has 96 vulnerabilities in CISA's catalogue of flaws known to be exploited, the 3rd highest of any vendor. 11 were added in the last 12 months; none are linked to known ransomware use (0% of its entries, against 20.4% across the catalogue). CISA's median fix window for these entries is 21 days (range 3 to 181), against 21 days (range 1 to 184) across the whole catalogue. The most exploited product is Multiple Products, with 55 entries. Other frequently affected products: iOS, iPadOS, and macOS (11); iOS (8).
Catalog v2026.11.04, released 5 Nov 2026. Source CISA ↗. All KEV entries.
$ ./kev --vendor apple --summary
Counts are computed from the catalog release on ; the 12 month window ends there.
┌─ total entries
96
in CISA KEV
┌─ first added
2021-11-03
earliest entry
┌─ latest added
2026-11-04
most recent entry
┌─ last 12 months
11
entries added
┌─ ransomware use
0 of 96
0% linked to ransomware
┌─ distinct products
9
affected products
$ awk -F, {print $1} /var/log/kev/apple.log | uniq -c
Entries by the year CISA added them.
| Year | Entries added | Of which ransomware |
|---|---|---|
| 2021 | 23 | 0 |
| 2022 | 26 | 0 |
| 2023 | 21 | 0 |
| 2024 | 7 | 0 |
| 2025 | 9 | 0 |
| 2026 | 10 | 0 |
$ sort /var/log/kev/apple.log | uniq -c | sort -rn | head -5
The five products with the most entries in the catalogue.
- Multiple Products 55 entries
- iOS, iPadOS, and macOS 11 entries
- iOS 8 entries
- macOS 6 entries
- iOS and iPadOS 5 entries
$ kev-due-dates --vendor apple
Days between the date CISA added an entry and the due date it set, median and range. Due dates apply to US federal agencies; for everyone else they are a patch-first ranking signal.
┌─ Apple
21 days (range 3 to 181)
median and range in days
┌─ whole catalogue
21 days (range 1 to 184)
median and range in days
$ grep -o 'CWE-[0-9]*' /var/log/kev/apple.log | sort | uniq -c | sort -rn | head -3
Weakness types CISA records for these entries (83 of 96 have at least one CWE).
$ grep -ril 'Apple' /var/log/news | head -5
Our reporting that names Apple or one of its KEV CVE ids, newest first.
┌─ /var/log/news
Patch Week pages with these entries
$ wc -l ./apple.kev · 96 rows
Descriptions: CISA Known Exploited Vulnerabilities catalogue
- CVE-2024-27834
Multiple Products
Apple Multiple Products Improper Authentication Vulnerability
due 2026-11-18 · CWE-287
$ cat CVE-2024-27834.txt
Description. Apple iOS, iPadOS, macOS, Safari, tvOS and watchOS 10.5 contain an improper authentication vulnerability which could allow an attacker with arbitrary read and write capability to bypass pointer authentication.
Required action. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- CVE-2026-86950
Multiple Products
Apple Multiple Products Out-of-Bounds Write Vulnerability
due 2026-10-13 · CWE-787
$ cat CVE-2026-86950.txt
Description. Apple iOS, macOS, and iPadOS contain an out-of-bounds write vulnerability in CoreGraphics that may lead to arbitrary code execution.
Required action. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- CVE-2026-65400
macOS
Apple macOS Improper Authentication Vulnerability
due 2026-08-21 · CWE-287
$ cat CVE-2026-65400.txt
Description. Apple macOS contains an improper authentication vulnerability that could allow an attacker on the network to authenticate to Screen Sharing without valid credentials.
Required action. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- CVE-2025-31277
Multiple Products
Apple Multiple Products Buffer Overflow Vulnerability
due 2026-04-03 · CWE-119
$ cat CVE-2025-31277.txt
Description. Apple Safari, iOS, watchOS, visionOS, iPadOS, macOS, and tvOS contain a buffer overflow vulnerability that could allow the processing of maliciously crafted web content which may lead to memory corruption.
Required action. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- CVE-2025-43510
Multiple Products
Apple Multiple Products Improper Locking Vulnerability
due 2026-04-03 · CWE-667
$ cat CVE-2025-43510.txt
Description. Apple watchOS, iOS, iPadOS, macOS, visionOS, and tvOS contain an improper locking vulnerability that could allow a malicious application to cause unexpected changes in memory shared between processes.
Required action. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- CVE-2025-43520
Multiple Products
Apple Multiple Products Classic Buffer Overflow Vulnerability
due 2026-04-03 · CWE-120
$ cat CVE-2025-43520.txt
Description. Apple watchOS, iOS, iPadOS, macOS, visionOS, and tvOS contain a classic buffer overflow vulnerability which could allow a malicious application to cause unexpected system termination or write kernel memory.
Required action. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- CVE-2021-30952
Multiple Products
Apple Multiple Products Integer Overflow or Wraparound Vulnerability
due 2026-03-26 · CWE-190
$ cat CVE-2021-30952.txt
Description. Apple tvOS, macOS, Safari, iPadOS and watchOS contain an integer overflow or wraparound vulnerability due to the processing of maliciously crafted web content that may lead to arbitrary code execution.
Required action. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- CVE-2023-41974
iOS and iPadOS
Apple iOS and iPadOS Use-After-Free Vulnerability
due 2026-03-26 · CWE-416
$ cat CVE-2023-41974.txt
Description. Apple iOS and iPadOS contain a use-after-free vulnerability. An app may be able to execute arbitrary code with kernel privileges.
Required action. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- CVE-2023-43000
Multiple Products
Apple Multiple products Use-After-Free Vulnerability
due 2026-03-26 · CWE-416
$ cat CVE-2023-43000.txt
Description. Apple macOS, iOS, iPadOS, and Safari 16.6 contain a use-after-free vulnerability due to the processing of maliciously crafted web content that may lead to memory corruption.
Required action. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- CVE-2026-20700
Multiple Products
Apple Multiple Buffer Overflow Vulnerability
due 2026-03-05 · CWE-119
$ cat CVE-2026-20700.txt
Description. Apple iOS, macOS, tvOS, watchOS, and visionOS contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow an attacker with memory write the capability to execute arbitrary code.
Required action. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- CVE-2025-43529
Multiple Products
Apple Multiple Products Use-After-Free WebKit Vulnerability
due 2026-01-05 · CWE-416
$ cat CVE-2025-43529.txt
Description. Apple iOS, iPadOS, macOS, and other Apple products contain a use-after-free vulnerability in WebKit. Processing maliciously crafted web content may lead to memory corruption. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
Required action. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- CVE-2022-48503
Multiple Products
Apple Multiple Products Unspecified Vulnerability
due 2025-11-10
$ cat CVE-2022-48503.txt
Description. Apple macOS, iOS, tvOS, Safari, and watchOS contain an unspecified vulnerability in JavaScriptCore that when processing web content may lead to arbitrary code execution. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
Required action. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- CVE-2025-43300
iOS, iPadOS, and macOS
Apple iOS, iPadOS, and macOS Out-of-Bounds Write Vulnerability
due 2025-09-11 · CWE-787
$ cat CVE-2025-43300.txt
Description. Apple iOS, iPadOS, and macOS contain an out-of-bounds write vulnerability in the Image I/O framework.
Required action. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- CVE-2025-43200
Multiple Products
Apple Multiple Products Unspecified Vulnerability
due 2025-07-07
$ cat CVE-2025-43200.txt
Description. Apple iOS, iPadOS, macOS, watchOS, and visionOS, contain an unspecified vulnerability when processing a maliciously crafted photo or video shared via an iCloud Link.
Required action. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- CVE-2025-31200
Multiple Products
Apple Multiple Products Memory Corruption Vulnerability
due 2025-05-08
$ cat CVE-2025-31200.txt
Description. Apple iOS, iPadOS, macOS, and other Apple products contain a memory corruption vulnerability that allows for code execution when processing an audio stream in a maliciously crafted media file.
Required action. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- CVE-2025-31201
Multiple Products
Apple Multiple Products Arbitrary Read and Write Vulnerability
due 2025-05-08
$ cat CVE-2025-31201.txt
Description. Apple iOS, iPadOS, macOS, and other Apple products contain an arbitrary read and write vulnerability that allows an attacker to bypass Pointer Authentication.
Required action. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- CVE-2025-24201
Multiple Products
Apple Multiple Products WebKit Out-of-Bounds Write Vulnerability
due 2025-04-03 · CWE-787
$ cat CVE-2025-24201.txt
Description. Apple iOS, iPadOS, macOS, and other Apple products contain an out-of-bounds write vulnerability in WebKit that may allow maliciously crafted web content to break out of Web Content sandbox. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
Required action. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- CVE-2025-24200
iOS and iPadOS
Apple iOS and iPadOS Incorrect Authorization Vulnerability
due 2025-03-05 · CWE-863
$ cat CVE-2025-24200.txt
Description. Apple iOS and iPadOS contains an incorrect authorization vulnerability that allows a physical attacker to disable USB Restricted Mode on a locked device.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2025-24085
Multiple Products
Apple Multiple Products Use-After-Free Vulnerability
due 2025-02-19 · CWE-416
$ cat CVE-2025-24085.txt
Description. Apple iOS, macOS, and other Apple products contain a user-after-free vulnerability that could allow a malicious application to elevate privileges.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2024-44308
Multiple Products
Apple Multiple Products Code Execution Vulnerability
due 2024-12-12
$ cat CVE-2024-44308.txt
Description. Apple iOS, macOS, and other Apple products contain an unspecified vulnerability when processing maliciously crafted web content that may lead to arbitrary code execution.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2024-44309
Multiple Products
Apple Multiple Products Cross-Site Scripting (XSS) Vulnerability
due 2024-12-12 · CWE-79
$ cat CVE-2024-44309.txt
Description. Apple iOS, macOS, and other Apple products contain an unspecified vulnerability when processing maliciously crafted web content that may lead to a cross-site scripting (XSS) attack.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2024-23225
Multiple Products
Apple Multiple Products Memory Corruption Vulnerability
due 2024-03-27 · CWE-787
$ cat CVE-2024-23225.txt
Description. Apple iOS, iPadOS, macOS, tvOS, watchOS, and visionOS kernel contain a memory corruption vulnerability that allows an attacker with arbitrary kernel read and write capability to bypass kernel memory protections.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2024-23296
Multiple Products
Apple Multiple Products Memory Corruption Vulnerability
due 2024-03-27 · CWE-787
$ cat CVE-2024-23296.txt
Description. Apple iOS, iPadOS, macOS, tvOS, and watchOS RTKit contain a memory corruption vulnerability that allows an attacker with arbitrary kernel read and write capability to bypass kernel memory protections.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2022-48618
Multiple Products
Apple Multiple Products Memory Corruption Vulnerability
due 2024-02-21 · CWE-367
$ cat CVE-2022-48618.txt
Description. Apple iOS, iPadOS, macOS, tvOS, and watchOS contain a time-of-check/time-of-use (TOCTOU) memory corruption vulnerability that allows an attacker with read and write capabilities to bypass Pointer Authentication.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2024-23222
Multiple Products
Apple Multiple Products WebKit Type Confusion Vulnerability
due 2024-02-13 · CWE-843
$ cat CVE-2024-23222.txt
Description. Apple iOS, iPadOS, macOS, tvOS, and Safari WebKit contain a type confusion vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2023-41990
Multiple Products
Apple Multiple Products Code Execution Vulnerability
due 2024-01-29
$ cat CVE-2023-41990.txt
Description. Apple iOS, iPadOS, macOS, tvOS, and watchOS contain an unspecified vulnerability that allows for code execution when processing a font file.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2023-42916
Multiple Products
Apple Multiple Products WebKit Out-of-Bounds Read Vulnerability
due 2023-12-25 · CWE-125
$ cat CVE-2023-42916.txt
Description. Apple iOS, iPadOS, macOS, and Safari WebKit contain an out-of-bounds read vulnerability that may disclose sensitive information when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
Required action. Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
- CVE-2023-42917
Multiple Products
Apple Multiple Products WebKit Memory Corruption Vulnerability
due 2023-12-25 · CWE-787
$ cat CVE-2023-42917.txt
Description. Apple iOS, iPadOS, macOS, and Safari WebKit contain a memory corruption vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
Required action. Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
- CVE-2023-42824
iOS and iPadOS
Apple iOS and iPadOS Kernel Privilege Escalation Vulnerability
due 2023-10-26
$ cat CVE-2023-42824.txt
Description. Apple iOS and iPadOS contain an unspecified vulnerability that allows for local privilege escalation.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2023-41991
Multiple Products
Apple Multiple Products Improper Certificate Validation Vulnerability
due 2023-10-16 · CWE-295
$ cat CVE-2023-41991.txt
Description. Apple iOS, iPadOS, macOS, and watchOS contain an improper certificate validation vulnerability that can allow a malicious app to bypass signature validation.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2023-41992
Multiple Products
Apple Multiple Products Kernel Privilege Escalation Vulnerability
due 2023-10-16 · CWE-754
$ cat CVE-2023-41992.txt
Description. Apple iOS, iPadOS, macOS, and watchOS contain an unspecified vulnerability that allows for local privilege escalation.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2023-41993
Multiple Products
Apple Multiple Products WebKit Code Execution Vulnerability
due 2023-10-16 · CWE-754
$ cat CVE-2023-41993.txt
Description. Apple iOS, iPadOS, macOS, and Safari WebKit contain an unspecified vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2023-41061
iOS, iPadOS, and watchOS
Apple iOS, iPadOS, and watchOS Wallet Code Execution Vulnerability
due 2023-10-02
$ cat CVE-2023-41061.txt
Description. Apple iOS, iPadOS, and watchOS contain an unspecified vulnerability due to a validation issue affecting Wallet in which a maliciously crafted attachment may result in code execution. This vulnerability was chained with CVE-2023-41064.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2023-41064
iOS, iPadOS, and macOS
Apple iOS, iPadOS, and macOS ImageIO Buffer Overflow Vulnerability
due 2023-10-02 · CWE-120
$ cat CVE-2023-41064.txt
Description. Apple iOS, iPadOS, and macOS contain a buffer overflow vulnerability in ImageIO when processing a maliciously crafted image, which may lead to code execution. This vulnerability was chained with CVE-2023-41061.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2023-38606
Multiple Products
Apple Multiple Products Kernel Unspecified Vulnerability
due 2023-08-16
$ cat CVE-2023-38606.txt
Description. Apple iOS, iPadOS, macOS, tvOS, and watchOS contain an unspecified vulnerability allowing an app to modify a sensitive kernel state.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2023-37450
Multiple Products
Apple Multiple Products WebKit Code Execution Vulnerability
due 2023-08-03
$ cat CVE-2023-37450.txt
Description. Apple iOS, iPadOS, macOS, and Safari WebKit contain an unspecified vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
Required action. Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.
- CVE-2023-32434
Multiple Products
Apple Multiple Products Integer Overflow Vulnerability
due 2023-07-14 · CWE-190
$ cat CVE-2023-32434.txt
Description. Apple iOS. iPadOS, macOS, and watchOS contain an integer overflow vulnerability that could allow an application to execute code with kernel privileges.
Required action. Apply updates per vendor instructions.
- CVE-2023-32435
Multiple Products
Apple Multiple Products WebKit Memory Corruption Vulnerability
due 2023-07-14 · CWE-787
$ cat CVE-2023-32435.txt
Description. Apple iOS, iPadOS, macOS, and Safari WebKit contain a memory corruption vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
Required action. Apply updates per vendor instructions.
- CVE-2023-32439
Multiple Products
Apple Multiple Products WebKit Type Confusion Vulnerability
due 2023-07-14 · CWE-843
$ cat CVE-2023-32439.txt
Description. Apple iOS, iPadOS, macOS, and Safari WebKit contain a type confusion vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
Required action. Apply updates per vendor instructions.
- CVE-2023-28204
Multiple Products
Apple Multiple Products WebKit Out-of-Bounds Read Vulnerability
due 2023-06-12 · CWE-125
$ cat CVE-2023-28204.txt
Description. Apple iOS, iPadOS, macOS, tvOS, watchOS, and Safari WebKit contain an out-of-bounds read vulnerability that may disclose sensitive information when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
Required action. Apply updates per vendor instructions.
- CVE-2023-32373
Multiple Products
Apple Multiple Products WebKit Use-After-Free Vulnerability
due 2023-06-12 · CWE-416
$ cat CVE-2023-32373.txt
Description. Apple iOS, iPadOS, macOS, tvOS, watchOS, and Safari WebKit contain a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
Required action. Apply updates per vendor instructions.
- CVE-2023-32409
Multiple Products
Apple Multiple Products WebKit Sandbox Escape Vulnerability
due 2023-06-12
$ cat CVE-2023-32409.txt
Description. Apple iOS, iPadOS, macOS, tvOS, watchOS, and Safari WebKit contain an unspecified vulnerability that can allow a remote attacker to break out of the Web Content sandbox. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
Required action. Apply updates per vendor instructions.
- CVE-2019-8526
macOS
Apple macOS Use-After-Free Vulnerability
due 2023-05-08 · CWE-416
$ cat CVE-2019-8526.txt
Description. Apple macOS contains a use-after-free vulnerability that could allow for privilege escalation.
Required action. Apply updates per vendor instructions.
- CVE-2023-28205
Multiple Products
Apple Multiple Products WebKit Use-After-Free Vulnerability
due 2023-05-01 · CWE-416
$ cat CVE-2023-28205.txt
Description. Apple iOS, iPadOS, macOS, and Safari WebKit contain a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
Required action. Apply updates per vendor instructions.
- CVE-2023-28206
iOS, iPadOS, and macOS
Apple iOS, iPadOS, and macOS IOSurfaceAccelerator Out-of-Bounds Write Vulnerability
due 2023-05-01 · CWE-787
$ cat CVE-2023-28206.txt
Description. Apple iOS, iPadOS, and macOS IOSurfaceAccelerator contain an out-of-bounds write vulnerability that allows an app to execute code with kernel privileges.
Required action. Apply updates per vendor instructions.
- CVE-2021-30900
iOS, iPadOS, and macOS
Apple iOS, iPadOS, and macOS Out-of-Bounds Write Vulnerability
due 2023-04-20 · CWE-20 CWE-787
$ cat CVE-2021-30900.txt
Description. Apple GPU drivers, included in iOS, iPadOS, and macOS, contain an out-of-bounds write vulnerability that may allow a malicious application to execute code with kernel privileges.
Required action. Apply updates per vendor instructions.
- CVE-2023-23529
Multiple Products
Apple Multiple Products WebKit Type Confusion Vulnerability
due 2023-03-07 · CWE-843
$ cat CVE-2023-23529.txt
Description. Apple iOS, MacOS, Safari and iPadOS WebKit contain a type confusion vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
Required action. Apply updates per vendor instructions.
- CVE-2022-42856
iOS
Apple iOS Type Confusion Vulnerability
due 2023-01-04 · CWE-843
$ cat CVE-2022-42856.txt
Description. Apple iOS contains a type confusion vulnerability when processing maliciously crafted web content leading to code execution.
Required action. Apply updates per vendor instructions.
- CVE-2022-42827
iOS and iPadOS
Apple iOS and iPadOS Out-of-Bounds Write Vulnerability
due 2022-11-15 · CWE-20 CWE-787
$ cat CVE-2022-42827.txt
Description. Apple iOS and iPadOS kernel contain an out-of-bounds write vulnerability which can allow an application to perform code execution with kernel privileges.
Required action. Apply updates per vendor instructions.
- CVE-2022-32917
iOS, iPadOS, and macOS
Apple iOS, iPadOS, and macOS Remote Code Execution Vulnerability
due 2022-10-05 · CWE-20 CWE-787
$ cat CVE-2022-32917.txt
Description. Apple kernel, which is included in iOS, iPadOS, and macOS, contains an unspecified vulnerability where an application may be able to execute code with kernel privileges.
Required action. Apply updates per vendor instructions.
- CVE-2020-9934
iOS, iPadOS, and macOS
Apple iOS, iPadOS, and macOS Input Validation Vulnerability
due 2022-09-29
$ cat CVE-2020-9934.txt
Description. Apple iOS, iPadOS, and macOS contain an unspecified vulnerability involving input validation which can allow a local attacker to view sensitive user information.
Required action. Apply updates per vendor instructions.
- CVE-2021-31010
iOS, macOS, watchOS
Apple iOS, macOS, watchOS Sandbox Bypass Vulnerability
due 2022-09-15 · CWE-20 CWE-502
$ cat CVE-2021-31010.txt
Description. In affected versions of Apple iOS, macOS, and watchOS, a sandboxed process may be able to circumvent sandbox restrictions.
Required action. Apply updates per vendor instructions.
- CVE-2022-32893
iOS and macOS
Apple iOS and macOS Out-of-Bounds Write Vulnerability
due 2022-09-08 · CWE-20 CWE-787
$ cat CVE-2022-32893.txt
Description. Apple iOS and macOS contain an out-of-bounds write vulnerability that could allow for remote code execution when processing malicious crafted web content.
Required action. Apply updates per vendor instructions.
- CVE-2022-32894
iOS and macOS
Apple iOS and macOS Out-of-Bounds Write Vulnerability
due 2022-09-08 · CWE-20 CWE-787
$ cat CVE-2022-32894.txt
Description. Apple iOS and macOS contain an out-of-bounds write vulnerability that could allow an application to execute code with kernel privileges.
Required action. Apply updates per vendor instructions.
- CVE-2018-4344
Multiple Products
Apple Multiple Products Memory Corruption Vulnerability
due 2022-07-18 · CWE-119
$ cat CVE-2018-4344.txt
Description. Apple iOS, macOS, tvOS, and watchOS contain a memory corruption vulnerability which can allow for code execution.
Required action. Apply updates per vendor instructions.
- CVE-2019-8605
Multiple Products
Apple Multiple Products Use-After-Free Vulnerability
due 2022-07-18 · CWE-416
$ cat CVE-2019-8605.txt
Description. A use-after-free vulnerability in Apple iOS, macOS, tvOS, and watchOS could allow a malicious application to execute code with system privileges.
Required action. Apply updates per vendor instructions.
- CVE-2020-3837
Multiple Products
Apple Multiple Products Memory Corruption Vulnerability
due 2022-07-18 · CWE-787
$ cat CVE-2020-3837.txt
Description. Apple iOS, iPadOS, macOS, tvOS, and watchOS contain a memory corruption vulnerability that could allow an application to execute code with kernel privileges.
Required action. Apply updates per vendor instructions.
- CVE-2020-9907
Multiple Products
Apple Multiple Products Memory Corruption Vulnerability
due 2022-07-18 · CWE-787
$ cat CVE-2020-9907.txt
Description. Apple iOS, iPadOS, and tvOS contain a memory corruption vulnerability that could allow an application to execute code with kernel privileges.
Required action. Apply updates per vendor instructions.
- CVE-2021-30983
iOS and iPadOS
Apple iOS and iPadOS Buffer Overflow Vulnerability
due 2022-07-18 · CWE-119
$ cat CVE-2021-30983.txt
Description. Apple iOS and iPadOS contain a buffer overflow vulnerability that could allow an application to execute code with kernel privileges.
Required action. Apply updates per vendor instructions.
- CVE-2016-4655
iOS
Apple iOS Information Disclosure Vulnerability
due 2022-06-14 · CWE-200
$ cat CVE-2016-4655.txt
Description. The Apple iOS kernel allows attackers to obtain sensitive information from memory via a crafted application.
Required action. Apply updates per vendor instructions.
- CVE-2016-4656
iOS
Apple iOS Memory Corruption Vulnerability
due 2022-06-14 · CWE-264
$ cat CVE-2016-4656.txt
Description. A memory corruption vulnerability in Apple iOS kernel allows attackers to execute code in a privileged context or cause a denial-of-service (DoS) via a crafted application.
Required action. Apply updates per vendor instructions.
- CVE-2016-4657
iOS
Apple iOS Webkit Memory Corruption Vulnerability
due 2022-06-14 · CWE-119
$ cat CVE-2016-4657.txt
Description. Apple iOS WebKit contains a memory corruption vulnerability that allows attackers to execute remote code or cause a denial-of-service (DoS) via a crafted web site. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
Required action. Apply updates per vendor instructions.
- CVE-2019-7286
Multiple Products
Apple Multiple Products Memory Corruption Vulnerability
due 2022-06-13 · CWE-787
$ cat CVE-2019-7286.txt
Description. Apple iOS, macOS, watchOS, and tvOS contain a memory corruption vulnerability that could allow for privilege escalation.
Required action. Apply updates per vendor instructions.
- CVE-2019-7287
iOS
Apple iOS Memory Corruption Vulnerability
due 2022-06-13 · CWE-787
$ cat CVE-2019-7287.txt
Description. Apple iOS contains a memory corruption vulnerability which could allow an attacker to perform remote code execution.
Required action. Apply updates per vendor instructions.
- CVE-2021-30883
Multiple Products
Apple Multiple Products Memory Corruption Vulnerability
due 2022-06-13 · CWE-787
$ cat CVE-2021-30883.txt
Description. Apple iOS, macOS, watchOS, and tvOS contain a memory corruption vulnerability that could allow for remote code execution.
Required action. Apply updates per vendor instructions.
- CVE-2019-8506
Multiple Products
Apple Multiple Products Type Confusion Vulnerability
due 2022-05-25 · CWE-843
$ cat CVE-2019-8506.txt
Description. A type confusion issue affecting multiple Apple products allows processing of maliciously crafted web content, leading to arbitrary code execution.
Required action. Apply updates per vendor instructions.
- CVE-2021-1789
Multiple Products
Apple Multiple Products Type Confusion Vulnerability
due 2022-05-25 · CWE-843
$ cat CVE-2021-1789.txt
Description. A type confusion issue affecting multiple Apple products allows processing of maliciously crafted web content, leading to arbitrary code execution.
Required action. Apply updates per vendor instructions.
- CVE-2022-22674
macOS
Apple macOS Out-of-Bounds Read Vulnerability
due 2022-04-25 · CWE-20 CWE-125
$ cat CVE-2022-22674.txt
Description. macOS Monterey contains an out-of-bounds read vulnerability that could allow an application to read kernel memory.
Required action. Apply updates per vendor instructions.
- CVE-2022-22675
macOS
Apple macOS Out-of-Bounds Write Vulnerability
due 2022-04-25 · CWE-20 CWE-125
$ cat CVE-2022-22675.txt
Description. macOS Monterey contains an out-of-bounds write vulnerability that could allow an application to execute arbitrary code with kernel privileges.
Required action. Apply updates per vendor instructions.
- CVE-2022-22620
iOS, iPadOS, and macOS
Apple iOS, iPadOS, and macOS Webkit Use-After-Free Vulnerability
due 2022-02-25 · CWE-416
$ cat CVE-2022-22620.txt
Description. Apple iOS, iPadOS, and macOS WebKit contain a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
Required action. Apply updates per vendor instructions.
- CVE-2014-4404
OS X
Apple OS X Heap-Based Buffer Overflow Vulnerability
due 2022-08-10 · CWE-119
$ cat CVE-2014-4404.txt
Description. Heap-based buffer overflow in IOHIDFamily in Apple OS X, which affects, iOS before 8 and Apple TV before 7, allows attackers to execute arbitrary code in a privileged context.
Required action. Apply updates per vendor instructions.
- CVE-2015-1130
OS X
Apple OS X Authentication Bypass Vulnerability
due 2022-08-10 · CWE-254
$ cat CVE-2015-1130.txt
Description. The XPC implementation in Admin Framework in Apple OS X before 10.10.3 allows local users to bypass authentication and obtain admin privileges.
Required action. Apply updates per vendor instructions.
- CVE-2022-22587
iOS and macOS
Apple Memory Corruption Vulnerability
due 2022-02-11 · CWE-20 CWE-787
$ cat CVE-2022-22587.txt
Description. Apple IOMobileFrameBuffer contains a memory corruption vulnerability which can allow a malicious application to execute arbitrary code with kernel privileges.
Required action. Apply updates per vendor instructions.
- CVE-2019-6223
iOS and macOS
Apple iOS and macOS Group Facetime Vulnerability
due 2022-05-03
$ cat CVE-2019-6223.txt
Description. Apple iOS and macOS Group FaceTime contains an unspecified vulnerability where the call initiator can cause the recipient's Apple device to answer unknowingly or without user interaction.
Required action. Apply updates per vendor instructions.
- CVE-2020-27930
Multiple Products
Apple Multiple Products Memory Corruption Vulnerability
due 2022-05-03 · CWE-787
$ cat CVE-2020-27930.txt
Description. Apple iOS, iPadOS, macOS, and watchOS FontParser contain a memory corruption vulnerability which may allow for code execution when processing maliciously crafted front.
Required action. Apply updates per vendor instructions.
- CVE-2020-27932
Multiple Products
Apple Multiple Products Type Confusion Vulnerability
due 2022-05-03 · CWE-843
$ cat CVE-2020-27932.txt
Description. Apple iOS, iPadOS, macOS, and watchOS contain a type confusion vulnerability that may allow a malicious application to execute code with kernel privileges.
Required action. Apply updates per vendor instructions.
- CVE-2020-27950
Multiple Products
Apple Multiple Products Memory Initialization Vulnerability
due 2022-05-03 · CWE-665
$ cat CVE-2020-27950.txt
Description. Apple iOS, iPadOS, macOS, and watchOS contain a memory initialization vulnerability that may allow a malicious application to disclose kernel memory.
Required action. Apply updates per vendor instructions.
- CVE-2020-9818
iOS, iPadOS, and watchOS
Apple iOS, iPadOS, and watchOS Out-of-Bounds Write Vulnerability
due 2022-05-03 · CWE-787
$ cat CVE-2020-9818.txt
Description. Apple iOS, iPadOS, and watchOS Mail contains an out-of-bounds write vulnerability which may allow memory modification or application termination when processing a maliciously crafted mail message.
Required action. Apply updates per vendor instructions.
- CVE-2020-9819
iOS, iPadOS, and watchOS
Apple iOS, iPadOS, and watchOS Memory Corruption Vulnerability
due 2022-05-03 · CWE-787
$ cat CVE-2020-9819.txt
Description. Apple iOS, iPadOS, and watchOS Mail contains a memory corruption vulnerability that may allow heap corruption when processing a maliciously crafted mail message.
Required action. Apply updates per vendor instructions.
- CVE-2020-9859
Multiple Products
Apple Multiple Products Code Execution Vulnerability
due 2022-05-03 · CWE-415
$ cat CVE-2020-9859.txt
Description. Apple iOS, iPadOS, macOS, watchOS, and tvOS contain an unspecified vulnerability that may allow an application to execute code with kernel privileges.
Required action. Apply updates per vendor instructions.
- CVE-2021-1782
Multiple Products
Apple Multiple Products Race Condition Vulnerability
due 2021-11-17 · CWE-362 CWE-667
$ cat CVE-2021-1782.txt
Description. Apple iOS, iPadOs, macOS, watchOS, and tvOS contain a race condition vulnerability that may allow a malicious application to elevate privileges.
Required action. Apply updates per vendor instructions.
- CVE-2021-1870
iOS, iPadOS, and macOS
Apple iOS, iPadOS, and macOS WebKit Remote Code Execution Vulnerability
due 2021-11-17 · CWE-1173
$ cat CVE-2021-1870.txt
Description. Apple iOS, iPadOS, and macOS WebKit contain an unspecified logic vulnerability that allows a remote attacker to execute code. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
Required action. Apply updates per vendor instructions.
- CVE-2021-1871
iOS, iPadOS, and macOS
Apple iOS, iPadOS, and macOS WebKit Remote Code Execution Vulnerability
due 2021-11-17 · CWE-1173
$ cat CVE-2021-1871.txt
Description. Apple iOS, iPadOS, and macOS WebKit contain an unspecified logic vulnerability that allows a remote attacker to execute code. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
Required action. Apply updates per vendor instructions.
- CVE-2021-1879
iOS, iPadOS, and watchOS
Apple iOS, iPadOS, and watchOS WebKit Cross-Site Scripting (XSS) Vulnerability
due 2021-11-17 · CWE-79
$ cat CVE-2021-1879.txt
Description. Apple iOS, iPadOS, and watchOS WebKit contain an unspecified vulnerability that allows for universal cross-site scripting (XSS) when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
Required action. Apply updates per vendor instructions.
- CVE-2021-30657
macOS
Apple macOS Unspecified Vulnerability
due 2021-11-17 · CWE-862
$ cat CVE-2021-30657.txt
Description. Apple macOS contains an unspecified logic issue in System Preferences that may allow a malicious application to bypass Gatekeeper checks.
Required action. Apply updates per vendor instructions.
- CVE-2021-30661
Multiple Products
Apple Multiple Products WebKit Storage Use-After-Free Vulnerability
due 2021-11-17 · CWE-416
$ cat CVE-2021-30661.txt
Description. Apple iOS, iPadOS, macOS, tvOS, watchOS, and Safari WebKit Storage contain a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
Required action. Apply updates per vendor instructions.
- CVE-2021-30663
Multiple Products
Apple Multiple Products WebKit Integer Overflow Vulnerability
due 2021-11-17 · CWE-20 CWE-190
$ cat CVE-2021-30663.txt
Description. Apple iOS, iPadOS, macOS, tvOS, and Safari WebKit contain an integer overflow vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
Required action. Apply updates per vendor instructions.
- CVE-2021-30665
Multiple Products
Apple Multiple Products WebKit Memory Corruption Vulnerability
due 2021-11-17 · CWE-787
$ cat CVE-2021-30665.txt
Description. Apple iOS, iPadOS, macOS, watchOS, and tvOS WebKit contain a memory corruption vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
Required action. Apply updates per vendor instructions.
- CVE-2021-30666
iOS
Apple iOS WebKit Buffer Overflow Vulnerability
due 2021-11-17 · CWE-119
$ cat CVE-2021-30666.txt
Description. Apple iOS WebKit contains a buffer-overflow vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
Required action. Apply updates per vendor instructions.
- CVE-2021-30713
macOS
Apple macOS Unspecified Vulnerability
due 2021-11-17 · CWE-862
$ cat CVE-2021-30713.txt
Description. Apple macOS Transparency, Consent, and Control (TCC) contains an unspecified permissions issue which may allow a malicious application to bypass privacy preferences.
Required action. Apply updates per vendor instructions.
- CVE-2021-30761
iOS
Apple iOS WebKit Memory Corruption Vulnerability
due 2021-11-17 · CWE-787
$ cat CVE-2021-30761.txt
Description. Apple iOS WebKit contains a memory corruption vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
Required action. Apply updates per vendor instructions.
- CVE-2021-30762
iOS
Apple iOS WebKit Use-After-Free Vulnerability
due 2021-11-17 · CWE-416
$ cat CVE-2021-30762.txt
Description. Apple iOS WebKit contains a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
Required action. Apply updates per vendor instructions.
- CVE-2021-30807
Multiple Products
Apple Multiple Products Memory Corruption Vulnerability
due 2021-11-17 · CWE-787
$ cat CVE-2021-30807.txt
Description. Apple iOS, iPadOS, macOS, and watchOS IOMobileFrameBuffer contain a memory corruption vulnerability which may allow an application to execute code with kernel privileges.
Required action. Apply updates per vendor instructions.
- CVE-2021-30858
iOS, iPadOS, and macOS
Apple iOS, iPadOS, macOS Use-After-Free Vulnerability
due 2021-11-17 · CWE-416
$ cat CVE-2021-30858.txt
Description. Apple iOS, iPadOS, and macOS WebKit contain a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
Required action. Apply updates per vendor instructions.
- CVE-2021-30860
Multiple Products
Apple Multiple Products Integer Overflow Vulnerability
due 2021-11-17 · CWE-20 CWE-190
$ cat CVE-2021-30860.txt
Description. Apple iOS, iPadOS, macOS, and watchOS CoreGraphics contain an integer overflow vulnerability which may allow code execution when processing a maliciously crafted PDF. The vulnerability is also known under the moniker of FORCEDENTRY.
Required action. Apply updates per vendor instructions.
- CVE-2021-30869
iOS, iPadOS, and macOS
Apple iOS, iPadOS, and macOS Type Confusion Vulnerability
due 2021-11-17 · CWE-843
$ cat CVE-2021-30869.txt
Description. Apple iOS, iPadOS, and macOS contain a type confusion vulnerability in the XNU which may allow a malicious application to execute code with kernel privileges.
Required action. Apply updates per vendor instructions.