CVE-2026-64715

The vulnerability is in WebKit on Apple platforms; a use-after-free triggered by malicious web content can crash the process. Patched in iOS/iPadOS 18.7.10, iOS/iPadOS 26.6.1, and macOS Tahoe 26.6.2. CISA rates exploitation as none, CVSS 6.5 (Medium).

CVE-2022-22643

CVE-2022-22643 concerns FaceTime on Apple devices. Description: A user may send audio and video in a FaceTime call without knowing that they have done so. Connected docs confirm affected platforms (iOS/iPadOS/macOS) and state the issue was fixed in iOS 15.4, iPadOS 15.4, and macOS Monterey 12.3 t...

CVE-2022-26766

CVE-2022-26766 is a certificate parsing issue addressed by Apple in updates for multiple OSes. The advisory states that a malicious app may bypass signature validation due to improved checks in certificate parsing. Affected and fixed versions include: tvOS 15.5; iOS 15.5 and iPadOS 15.5; watchOS ...

CVE-2023-23498

CVE-2023-23498 pertains to a logic issue in Apple's software stack where improved state management fixes an issue that could cause the quoted original message to be selected from the wrong email when forwarding an Exchange message. Affected platforms include iOS 15.7.3/iPadOS 15.7.3, iOS 16.3/iPa...

CVE-2023-35074

CVE-2023-35074 relates to a memory handling issue in WebKit/WebKitGTK used by Apple platforms (tvOS, Safari, watchOS, iOS, iPadOS, macOS Sonoma) and WebKitGTK-based environments. The vendor advisories state that processing web content may lead to arbitrary code execution, and the fix is a memory-...

CVE-2024-40782

CVE-2024-40782 is a WebKitGTK/use-after-free vulnerability where processing malicious web content could cause an unexpected process crash. It is addressed in Apple platforms as: iOS 16.7.9 and iPadOS 16.7.9; Safari 17.6; iOS 17.6 and iPadOS 17.6; watchOS 10.6; tvOS 17.6; visionOS 1.3; macOS Sonom...

CVE-2026-65341

CVE-2026-65341 affects WebKit in Safari 26.6.1, iOS 18.7.10/iPadOS 18.7.10, iOS 26.6.1/iPadOS 26.6.1, and macOS Tahoe 26.6.2. The flaw stems from improper memory handling; processing maliciously crafted web content can trigger memory corruption. CVSS 3.1 scores 5.4 (MEDIUM), network exploitable w...

CVE-2020-3829

CVE-2020-3829 corresponds to an out-of-bounds read fixed by Apple across multiple platforms. The Apple advisories show the vulnerability contributing to elevated-privilege risk and are mitigated by updates: iOS 13.3.1, iPadOS 13.3.1, macOS Catalina 10.15.3, tvOS 13.3.1, and watchOS 6.1.2. In the ...

CVE-2022-26731

CVE-2022-26731 is a logic-issue vulnerability in Apple software where a malicious website could track users in Safari private browsing mode. The issue is addressed through improved state management and is fixed in macOS Monterey 12.4, iOS 15.5, and iPadOS 15.5. Affected components include Safari/...

CVE-2026-28847

CVE-2026-28847 concerns a memory handling issue in WebKit/Web content processing that could trigger a crash when processing maliciously crafted content. Apple’s advisories indicate this vulnerability is fixed in Safari 26.5 and related OS updates (iOS 18.7.9 / iPadOS 18.7.9, macOS Tahoe 26.5, tvO...

CVE-2026-65339

CVE-2026-65339 is a logic issue in the Audio component of Apple's operating systems, allowing a local app to leak sensitive user information . The vulnerability requires low privileges and user interaction, with a CVSS 3.1 score of 5.0 (MEDIUM) — high confidentiality impact but no integrity or av...

CVE-2023-42833

CVE-2023-42833 is a WebKitGTK/WebKitGTK+ correctness issue where processing web content could lead to arbitrary code execution. The vendor advisory notes fixes in macOS Sonoma 14, Safari 17, iOS 17, and iPadOS 17. Root cause: improved checks in WebKit to address the vulnerability. Practical impac...

CVE-2023-42883

CVE-2023-42883 involves WebKitGTK/WebKit-based components where processing an image can cause a denial-of-service due to an underlying memory handling issue. The vulnerability is addressed in Apple platforms (Safari 17.2, macOS Sonoma 14.2, iOS 17.2/iPadOS 17.2, watchOS 10.2, tvOS 17.2; with olde...

CVE-2025-24223

The CVE-2025-24223 issue is a memory corruption vulnerability in WebKit-based components affecting multiple Apple platforms. The advisory states that the flaw is triggered by processing maliciously crafted web content and is mitigated by memory handling improvements, with fixes shipped in: watchO...

CVE-2022-22596

CVE-2022-22596 covers a memory corruption issue in Apple kernel components that could allow arbitrary code execution with kernel privileges. The vulnerability is addressed by updates in iOS 15.4, iPadOS 15.4, and watchOS 8.5. The initial description notes a memory corruption problem mitigated by ...

CVE-2022-22614

CVE-2022-22614 is a use-after-free vulnerability that Apple addressed across multiple platforms. The issue could allow arbitrary code execution with kernel privileges and is fixed by updates: tvOS 15.4; iOS 15.4 and iPadOS 15.4; macOS Big Sur 11.6.5; Security Update 2022-003 Catalina; watchOS 8.5...

CVE-2022-46693

The CVE-2022-46693 entry describes an out-of-bounds write vulnerability addressed by input-validation improvements. Affected products/versions include tvOS 16.2, iCloud for Windows 14.1, macOS Ventura 13.1, iOS 16.2, iPadOS 16.2, and watchOS 9.2. The issue can be triggered by processing a malicio...

CVE-2025-24137

CVE-2025-24137 is a type confusion issue addressed by Apple in multiple updates: iPadOS 17.7.4, macOS Sonoma 14.7.3, visionOS 2.3, iOS 18.3, iPadOS 18.3, macOS Sequoia 15.3, watchOS 11.3, and tvOS 18.3. The vulnerability could allow a remote attacker to cause an unexpected application termination...

CVE-2020-3840

CVE-2020-3840 describes an off-by-one error in the handling of racoon configuration files within IPSec-related components. The underlying issue arises from improper bounds checking, which could allow a maliciously crafted racoon config to trigger arbitrary code execution. Apple and Red Hat record...

CVE-2023-42875

CVE-2023-42875 is an arbitrary-code-execution vulnerability in WebKit/WebKitGTK components triggered by processing certain web content. The issue stems from improper memory handling. It is addressed in various advisories: Apple platforms (iOS 17, iPadOS 17, macOS Sonoma 14, watchOS 10, tvOS 17, S...

CVE-2020-9976

CVE-2020-9976 is an Apple security issue identified as a logic bug in a state-management path that could allow a malicious app to leak sensitive user information. The vulnerability is documented across Apple advisories for iOS 14.0/iPadOS 14.0, tvOS 14.0, and watchOS 7.0, with remediation deliver...

CVE-2022-32829

CVE-2022-32829 affects Apple platforms (iOS/iPadOS/macOS) and is tied to kernel-level arbitrary-code execution. The vulnerability was addressed by Apple with fixes in iOS 15.6, iPadOS 15.6, and macOS Monterey 12.5. The fixed versions suggest a kernel-privilege impact; no exploitation details are ...

CVE-2022-42864

CVE-2022-42864 describes a race condition in Apple's IOHID kernel path (IOHIDDevice::postElementTransaction) where element data may be read from shared memory while being validated, allowing out-of-bounds reads and writes on kernel heap. Exploitation details circulated in public proof-of-concept ...

CVE-2023-23540

CVE-2023-23540 concerns Apple devices where improved memory handling patches an issue that could allow an app to execute arbitrary code with kernel privileges. The vulnerability affects iOS, iPadOS, and macOS releases, with fixes in iOS 15.7.8/iPadOS 15.7.8, iOS 16.4/iPadOS 16.4, macOS Monterey 1...

CVE-2023-41974

CVE-2023-41974 is a kernel-use-after-free vulnerability in Apple iOS/iPadOS that was leveraged by the Coruna exploit framework. The CVE description notes that exploitation may allow an app to execute arbitrary code with kernel privileges, with fixes shipped in iOS/iPadOS 17 and in iOS 15.8.7 / iP...

CVE-2024-27833

CVE-2024-27833 affects Apple WebKit components across multiple Apple platforms. The issue is described as an integer overflow resolved by input validation, with fixes in tvOS 17.5, iOS 16.7.8 and iPadOS 16.7.8, visionOS 1.2, Safari 17.5, iOS 17.5 and iPadOS 17.5. The description notes that proces...

CVE-2022-26763

CVE-2022-26763 is an out-of-bounds access issue fixed in multiple Apple platforms. The cited advisories state an affected condition where a malicious application could execute arbitrary code with system privileges. The concrete fixes are in tvOS 15.5, iOS 15.5 and iPadOS 15.5, Security Update 202...

CVE-2022-46718

CVE-2022-46718 is a logic issue in Apple platforms that could allow an app to read sensitive location information. The issue is addressed with improved restrictions and is fixed in iOS 15.7.2 and iPadOS 15.7.2, macOS Ventura 13.1, macOS Big Sur 11.7.2, and macOS Monterey 12.6.2. Affected products...

CVE-2025-31215

CVE-2025-31215 is a WebKitGTK/WebKit-related issue where processing malicious web content may cause an unexpected process crash. The connected advisories show concrete details across multiple distributions: Affected software: webkit2gtk/WebKitGTK (and its WebKit components) used in Linux distros ...

CVE-2021-30855

CVE-2021-30855 is an Apple vulnerability in the Preferences component where a validation issue in the handling of symlinks could allow an application to access restricted files. The issue is addressed in Security Update 2021-005 Catalina, iOS 14.8/iPadOS 14.8 and iOS 15/iPadOS 15, watchOS 8, and ...

CVE-2022-32857

CVE-2022-32857 is a network-privacy flaw fixed by Apple in macOS Monterey 12.5, macOS Big Sur 11.6.8, Security Update 2022-005 Catalina, iOS 15.6/iPadOS 15.6, tvOS 15.6, and watchOS 8.7. The advisory states that information sent over the network should use HTTPS to prevent eavesdropping; the issu...

CVE-2022-32911

CVE-2022-32911 is an Apple macOS/kernel memory handling issue that could allow an app to execute arbitrary code with kernel privileges. It is fixed in macOS Monterey 12.6, iOS 15.7/iPadOS 15.7, iOS 16, and macOS Big Sur 11.7, per the CVE description and corroborating NASL/Apple security docs in t...

CVE-2023-27933

The CVE-2023-27933 issue is a kernel‑level memory handling flaw that could allow a root‑privileged app to execute arbitrary code. Apple fixes are shipped in macOS Ventura 13.3, macOS Monterey 12.6.4, iOS 16.4, iPadOS 16.4, tvOS 16.4, and watchOS 9.4. Impact is listed as High for confidentiality, ...

CVE-2026-64784

A WebKit out-of-bounds access flaw, credited to Janggoon Lee and Amy Burnett, affects Safari on iOS/iPadOS 18.7.10, iOS/iPadOS 26.6.1, and macOS Tahoe 26.6.2; visiting malicious web content may crash Safari. CVSS 3.1 base score 4.3 (MEDIUM). No public exploit details provided.

CVE-2020-9770

The CVE-2020-9770 issue is a logic/state-management bug in Bluetooth handling on Apple devices. According to sources, it allows a user in a privileged network position to intercept Bluetooth traffic, and Apple fixed it in iOS 13.4/iPadOS 13.4 (see Apple HT211102). Remediation is to update to the ...

CVE-2020-9870

CVE-2020-9870 is a WebKit/JavaScriptCore-related logic issue that allowed bypassing exploit mitigations (StructureID randomization, the Gigacage, and PAC/APRR) to achieve arbitrary memory read/write. The published material describes bypassing StructureID checks via crafted JSArray/JSCell headers,...

CVE-2021-30949

CVE-2021-30949 is a memory corruption vulnerability in Apple's kernel components. The description indicates that it was mitigated by improved state management and is fixed in macOS Big Sur 11.6.2, macOS Monterey 12.1, Security Update 2021-008 Catalina, tvOS 15.2, iOS 15.2 and iPadOS 15.2, and wat...

CVE-2022-32824

The CVE-2022-32824 entry describes a kernel memory disclosure vulnerability. Affected Apple platforms include tvOS, iOS, iPadOS, and watchOS; the issue stems from memory handling weaknesses that could allow an app to disclose kernel memory. Apple lists fixes in tvOS 15.6, iOS 15.6, iPadOS 15.6, a...

CVE-2022-32868

CVE-2022-32868 affects Safari and related iOS/iPadOS web-extension handling. The issue is a logic bug in state management that could enable a website to track users via Safari web extensions. The NVD/NIST description confirms a fix in Safari 16, iOS 16, iOS 15.7, and iPadOS 15.7. Connected source...

CVE-2022-32883

CVE-2022-32883 describes a logic issue that allowed an app to read sensitive location information. It is fixed in macOS Monterey 12.6, iOS 15.7 and iPadOS 15.7, iOS 16, and macOS Big Sur 11.7. The issue is mitigated by applying the listed Apple OS updates; no exploitation status is provided beyon...

CVE-2024-23265

CVE-2024-23265 is a memory corruption vulnerability fixed by updated locking in macOS family. Affected products/versions include macOS Monterey 12.7.4 and later (Ventura 13.6.5, Sonoma 14.4), visionOS 1.1, iOS 17.4 and iPadOS 17.4, watchOS 10.4, iOS 16.7.6 and iPadOS 16.7.6, and tvOS 17.4. The is...

CVE-2024-27838

CVE-2024-27838 describes a fingerprinting risk in WebKit-based components exposed by Apple platforms. The issue, triggered by visiting a malicious webpage, allows fingerprinting of the user. The CVE is fixed in multiple platforms and versions: tvOS 17.5; iOS 16.7.8 and iPadOS 16.7.8; visionOS 1.2...

CVE-2024-40776

CVE-2024-40776 is a use-after-free in the WebKitGTK/WebKit2GTK web engine where processing maliciously crafted web content may lead to an unexpected process crash. The initial CVE description confirms the issue and its fix across Apple platforms (iOS, iPadOS, macOS Sonoma, etc.). Connected adviso...

CVE-2025-24271

CVE-2025-24271 describes an access issue in AirPlay handling where an unauthenticated user on the same network as a signed‑in Mac could send AirPlay commands without pairing. Apple fixed this in multiple OS updates: macOS Sequoia 15.4, macOS Ventura 13.7.5, macOS Sonoma 14.7.5, iOS 18.4 and iPadO...

CVE-2026-43813

CVE-2026-43813 is a validation issue in Apple’s CloudAttestation component which may allow a malicious app to bypass code signing enforcement. The vulnerability is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6. The underlying issue relates to inpu...

CVE-2021-30919

CVE-2021-30919: An out-of-bounds write in processing a maliciously crafted PDF may lead to arbitrary code execution. Affected components relate to Apple platforms including iOS/iPadOS, macOS, tvOS and watchOS. The issue was addressed by input validation improvements and is fixed in iOS 15.1/iPadO...

CVE-2022-32839

The CVE-2022-32839 issue is resolved by improved bounds checks and affects multiple Apple platforms. Affects macOS Monterey 12.5, macOS Big Sur 11.6.8, Security Update 2022-005 Catalina, iOS 15.6, iPadOS 15.6, tvOS 15.6, and watchOS 8.7. The vulnerability could allow a remote attacker to cause an...

CVE-2024-23235

CVE-2024-23235 is a kernel race condition addressed by Apple with additional validation. It is fixed in macOS Sonoma 14.4, visionOS 1.1, iOS 17.4/iPadOS 17.4, watchOS 10.4, and iOS 16.7.6/iPadOS 16.7.6 and tvOS 17.4. The affected impact is that an app may be able to access user-sensitive data. Th...

CVE-2024-27851

CVE-2024-27851 affects Apple WebKit-based content processing. The issue arises from insufficient bounds checks in processing malicious web content, enabling arbitrary code execution. Official mitigation notes specify fixes across multiple Apple platforms, including tvOS 17.5, visionOS 1.2, Safari...

CVE-2026-43818

CVE-2026-43818 affects Apple OS components where processing a maliciously crafted image can trigger an integer overflow due to insufficient input validation. Apple has fixed this issue in iOS/iPadOS 26.6 and macOS Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6. The vulnerability’s root cause is an...