CVE-2026-20698

CVE-2026-20698 is a kernel-space issue in Apple XNU PF_ROUTE handling. A heap buffer overflow occurs in route_msg() when processing RTA_GENMASK, enabling a local, unprivileged process to trigger a kernel panic and potential heap corruption on affected devices. Affected: iOS and macOS prior to 26....

CVE-2026-43726

CVE-2026-43726 is a WebKit-related use-after-free vulnerability addressed by Apple in Safari 26.5.2, iOS 26.5.2/iPadOS 26.5.2, and macOS Tahoe 26.5.2. The initial description indicates a use-after-free in processing malicious web content, with fixes described as improved memory management. Connec...

CVE-2026-43745

CVE-2026-43745 describes an out-of-bounds write issue addressed by improved input validation. The vulnerability affects Safari and related Apple platforms, with fixes in Safari 26.5.2, iOS 26.5.2, iPadOS 26.5.2, and macOS Tahoe 26.5.2. The issue could lead to an unexpected Safari crash when proce...

CVE-2026-43812

CVE-2026-43812 is described as a memory-management use-after-free issue fixed in Apple OS updates: iOS/iPadOS 26.6, macOS Sequoia 15.7.8, macOS Tahoe 26.6, tvOS 26.6, and visionOS 26.6. The initial entry states exploitation could cause an unexpected system termination, with a CVSSv3.1 base score ...

CVE-2019-8788

CVE-2019-8788 stems from an information-disclosure risk in Apple’s Associated Domains URL parsing. The issue arises from improper URL handling, potentially enabling data exfiltration. Publicly documented fixes indicate that this was addressed through improved input validation and is resolved in: ...

CVE-2020-27920

CVE-2020-27920 is a use-after-free vulnerability fixed in Apple platforms. The issue, described as a use-after-free leading to code execution when processing maliciously crafted web content, affects macOS Big Sur (11.0.1 and 11.1), Catalina (Security Update 2020-001) and Mojave (Security Update 2...

CVE-2020-3880

The CVE-2020-3880 entry concerns an out-of-bounds read in image processing that Apple fixed via improved input validation. Affected platforms include watchOS 6.1.2; iOS 13.3.1 and iPadOS 13.3.1; tvOS 13.3.1; macOS Catalina 10.15.3; Security Update 2020-001 Mojave; Security Update 2020-001 High Si...

CVE-2020-9821

CVE-2020-9821 is a memory corruption vulnerability in Apple’s kernel that could allow a malicious application to execute arbitrary code with kernel privileges. Apple’s security updates indicate this issue is fixed in iOS 13.5 and iPadOS 13.5, macOS Catalina 10.15.5, tvOS 13.4.5, and watchOS 6.2.5...

CVE-2020-9900

CVE-2020-9900 involves a path validation issue in the symlink handling within Apple’s Crash Reporter pathway affecting multiple Apple OS variants (iOS/iPadOS, macOS, tvOS, watchOS). The root cause is improper path sanitization during symlink validation, enabling a local attacker to elevate privil...

CVE-2020-9988

CVE-2020-9988 is an Apple macOS/iOS/iPadOS issue where a local user could potentially recover or discover another user’s deleted messages due to an insufficient deletion mechanism. The vulnerability is tied to the Messages component and was addressed by improved deletion logic. Apple’s security e...

CVE-2021-30810

CVE-2021-30810: An authorization issue in Apple's Wi-Fi subsystem was fixed via improved state management. A nearby attacker could coerce a user into a malicious Wi-Fi network during device setup. Affected platforms include iOS 15/iPadOS 15, watchOS 8, and tvOS 15; patch available in those updates.

CVE-2021-30996

CVE-2021-30996 is a race condition affecting Apple platforms (notably IOMobileFrameBuffer and Kernel components) that could allow a malicious app to execute arbitrary code with kernel privileges. It was fixed in macOS Monterey 12.1 and iOS 15.2 / iPadOS 15.2. Public details in connected sources c...

CVE-2022-42850

CVE-2022-42850 is an Apple iOS/iPadOS vulnerability where an app could execute arbitrary code with kernel privileges due to improved memory handling. The issue affects iOS and iPadOS and is addressed in iOS 16.2 and iPadOS 16.2. The core detail provided states the vulnerability arises from memory...

CVE-2023-32365

The CVE-2023-32365 issue affects Apple iOS/iPadOS Photos via the Shake-to-undo feature, enabling a deleted photo to be surfaced without authentication. The root cause details in the sources indicate a logic/validation issue within the Photos handling that could expose previously deleted content. ...

CVE-2023-40448

CVE-2023-40448 affects Apple platforms (tvOS, iOS, iPadOS, watchOS, macOS Sonoma 14) where the Web Content sandbox isolation could be escaped. The issue stems from protocol handling, and Apple lists fixes in tvOS 17, iOS 16.7 / 17, iPadOS 16.7 / 17, watchOS 10, and macOS Sonoma 14. No exploitatio...

CVE-2023-41986

CVE-2023-41986 affects Apple platforms; an app may be able to modify protected parts of the file system. The issue is fixed in iOS 17, iPadOS 17, and macOS Sonoma 14. Attack vector is local with user interaction required; no exploitation status is provided beyond the fix in these OS versions. Rem...

CVE-2023-42888

CVE-2023-42888 (Apple iOS/iPadOS/WebKit) is an in-process vulnerability where processing a maliciously crafted image could disclose process memory. The issue is addressed in multiple Apple OS updates: iOS 16.7.5/iPadOS 16.7.5, iOS 17.2, iPadOS 17.2, watchOS 10.2, macOS Ventura 13.6.4, macOS Sonom...

CVE-2023-42947

CVE-2023-42947 is a path handling issue in Apple platforms that could allow an app to escape its sandbox. The description specifies a fix through updated validation and lists affected Apple OS versions: macOS Monterey 12.7.2, macOS Ventura 13.6.3, iOS 17.2 and iPadOS 17.2, tvOS 17.2, watchOS 10.2...

CVE-2024-27803

CVE-2024-27803 affects Apple iOS and iPadOS prior to 17.5; the issue is a permissions validation flaw that could allow sharing items from a device’s lock screen. Apple fixed it in iOS 17.5 and iPadOS 17.5. The description indicates a local/physical-access vector, with no explicit exploitation det...

CVE-2024-40788

CVE-2024-40788 is a local, type-confusion vulnerability in memory handling that could allow a local attacker to cause an unexpected system shutdown . The vulnerability is fixed in: iOS/iPadOS 16.7.9 and 17.6, macOS Ventura 13.6.8, macOS Monterey 12.7.6, macOS Sonoma 14.6, and on watchOS 10.6, tvO...

CVE-2024-44255

CVE-2024-44255 is a path handling issue addressed by Apple in versions listed as fixed: visionOS 2.1, iOS 18.1 / iPadOS 18.1, macOS Ventura 13.7.1, macOS Sonoma 14.7.1, watchOS 11.1, and tvOS 18.1. The issue allowed a malicious app to run arbitrary shortcuts without user consent due to improved p...

CVE-2024-44259

CVE-2024-44259 affects Apple Safari (and related WebKit components) with the root cause described as an issue in state management that could allow an attacker to misuse a trust relationship to download malicious content. Patches are stated for macOS Sequoia 15.1, Safari 18.1, iOS 18.1, iPadOS 18....

CVE-2024-54526

CVE-2024-54526 affects Apple platforms and is described as a privacy risk where a malicious app could access private information. Connected sources confirm fixes in specific OS updates: watchOS 11.2, tvOS 18.2, macOS Sequoia 15.2, iOS 18.2, iPadOS 18.2, macOS Ventura 13.7.2, and macOS Sonoma 14.7...

CVE-2025-30471

CVE-2025-30471 is a validation issue addressed by Apple across multiple platforms. The advisory indicates a remote attacker may cause a denial-of-service, with fixes shipped in visionOS 2.4, macOS Ventura 13.7.5, tvOS 18.4, iPadOS 17.7.6, iOS 18.4/iPadOS 18.4, macOS Sequoia 15.4, and macOS Sonoma...

CVE-2026-43700

CVE-2026-43700 describes a cross-origin issue in WebKit/Safari where processing maliciously crafted web content could disclose sensitive user information. The record states the root cause as improper tracking of security origins and the fix shipped in Safari 26.5.2, iOS 26.5.2, iPadOS 26.5.2, and...

CVE-2026-43735

CVE-2026-43735 affects WebKit in macOS Tahoe (and related Safari/iOS/iPadOS/WebKit stacks). The root issue is cross-origin data exfiltration via malicious web content, addressed by improved checks and fixed in Safari 26.5.2, iOS 26.5.2/iPadOS 26.5.2, and macOS Tahoe 26.5.2. References indicate Ap...

CVE-2026-64780

In WebKit, CVE-2026-64780 stems from improper input validation (WebKit Bugzilla 316918) allowing crafted web content to crash Safari. Fixed in Safari 26.6.1, iOS/iPadOS 18.7.10 and 26.6.1, macOS Tahoe 26.6.2. No in-the-wild exploitation reported; CVSS 4.3 (Medium) reflects availability-only impact.

CVE-2019-8789

The CVE-2019-8789 entry affects Apple Books in macOS Catalina (before 10.15.1), iOS, and iPadOS where a validation issue in handling symlinks could lead to disclosure of user information via a maliciously crafted iBooks file. Root cause: inadequate validation of symlinks within Books parsing. Imp...

CVE-2020-9808

CVE-2020-9808 is a memory corruption issue addressed by Apple across multiple OS updates. The vulnerability was mitigated by improved state management and is fixed in iOS 13.5/iPadOS 13.5, macOS Catalina 10.15.5, tvOS 13.4.5, and watchOS 6.2.5. The public description notes that an affected applic...

CVE-2020-9854

CVE-2020-9854 is a logic-issue vulnerability in Apple OS components that was addressed by improved input/validation logic. Public references indicate the issue could allow an application to gain elevated privileges and that patches are included in macOS Catalina 10.15.5 and iOS/iPadOS 13.5 (also ...

CVE-2020-9944

CVE-2020-9944: An out-of-bounds read in certain Apple media components was addressed by improved bounds checking. Affected: macOS Big Sur 11.0.1 and prior; affected watchOS 7.0, tvOS 14.0, iOS 14.0, and iPadOS 14.0. Impact (as stated): an application may be able to read restricted memory. Public ...

CVE-2020-9977

CVE-2020-9977 involves a validation issue in the entitlement verification for Safari open tabs exposure. According to official Apple advisories, the vulnerability was addressed by improved validation of the process entitlement and is fixed in macOS Big Sur 11.0.1 as well as iOS 14.0 and iPadOS 14...

CVE-2021-1780

CVE-2021-1780 is a memory initialization issue in Bluetooth on Apple devices, addressed in iOS 14.4 and iPadOS 14.4. The vulnerability allows a privileged attacker to cause a denial of service via memory handling weaknesses, as described in the NVD entry and Apple’s HT212146 documentation. The is...

CVE-2021-30863

CVE-2021-30863 affects devices with Face ID. The issue describes a spoofing risk where a 3D model resembling the enrolled user may authenticate via Face ID. Apple fixed the vulnerability in iOS 15 and iPadOS 15 by improving Face ID anti-spoofing models. Public-facing details in the connected sour...

CVE-2021-30875

The CVE-2021-30875 issue affects iOS/iPadOS and was reported as a lock-screen vulnerability in which a local attacker could view contacts from the lock screen due to inadequate state management. The Apple documentation for iOS 15.1 and iPadOS 15.1 describes this as a local-elevation/information-d...

CVE-2022-42790

CVE-2022-42790 is a logic/state-management issue in Apple platforms that could allow a user to view restricted content from the lock screen. Affected products/versions include macOS Big Sur 11.7, macOS Monterey 12.6, macOS Ventura 13, iOS 16, iOS 15.7, and iPadOS 15.7. The patch guidance in the p...

CVE-2023-27943

CVE-2023-27943 relates to macOS/iOS quarantine handling for files downloaded from the internet. The vulnerability description notes that files may not have the quarantine flag applied, and Apple’s fix is described as “improved checks.” Public documents confirm affected platforms: macOS Ventura 13...

CVE-2023-32392

The CVE-2023-32392 entry concerns a privacy issue where private location data could be exposed via log entry redaction. Apple fixed the flaw in multiple platforms: watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, macOS Big Sur 11.7.7, macOS Monterey 12.6.6, iOS 16.5, and iPadOS 16.5. The underlying im...

CVE-2023-41063

CVE-2023-41063 affects Apple platforms (macOS Ventura 13.6; macOS Sonoma 14; iOS 16.7, 17; tvOS 17). Root cause: memory handling issue that may allow an app to execute arbitrary code with kernel privileges. Impact: local attacker with user interaction could gain kernel-level code execution. Fix: ...

CVE-2023-42896

CVE-2023-42896 affects Apple platforms (macOS and iOS/iPadOS). The issue is in the handling of temporary files, allowing an app to modify protected parts of the file system. It is fixed by macOS Monterey 12.7.2, macOS Ventura 13.6.3, macOS Sonoma 14.2, and iOS/iPadOS 16.7.3 and 17.2. Exploitation...

CVE-2024-23259

CVE-2024-23259 affects Apple systems (notably macOS Sonoma 14.4, Safari/WebKit components) where processing web content may lead to a denial-of-service. Apple’s advisory indicates fixes in macOS Sonoma 14.4 and various iOS/iPadOS versions (iOS 16.7.6, iPadOS 16.7.6, iOS 17.4, iPadOS 17.4). The NV...

CVE-2024-27802

CVE-2024-27802 involves an out-of-bounds read addressed by improved input validation in Apple platforms. Affected products include macOS Ventura 13.6.7, macOS Monterey 12.7.5, iOS 16.7.8/iPadOS 16.7.8, tvOS 17.5, visionOS 1.2, iOS 17.5/iPadOS 17.5, and macOS Sonoma 14.5. The issue arises when pro...

CVE-2024-27831

CVE-2024-27831 is an out-of-bounds write issue addressed by Apple with improved input validation. The vulnerability affects multiple Apple platforms and is fixed in macOS Ventura 13.6.7, macOS Monterey 12.7.5, macOS Sonoma 14.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, tvOS 17.5, a...

CVE-2025-24144

The CVE-2025-24144 information disclosure issue is fixed in Apple OS releases: macOS Sequoia 15.3, macOS Sonoma 14.7.6, visionOS 2.3, iPadOS 17.7.7, iPadOS 18.3, iOS 18.3, macOS Ventura 13.7.6, and watchOS 11.3. The root cause is described as removal of the vulnerable code, leading to potential l...

CVE-2025-24145

CVE-2025-24145 describes a privacy issue where an app may view a contact’s phone number in system logs. Affected products updated: macOS Sequoia 15.3, iOS 18.3, iPadOS 18.3. Root cause relates to private data redaction in log entries; remediation is to apply the updates listed (Sequoia 15.3, iOS ...

CVE-2020-27899

CVE-2020-27899 describes a use-after-free vulnerability that was addressed with improved memory management. The issue could allow a local attacker to elevate privileges. Apple confirms fixes in multiple platforms and releases: iOS 14.2 and iPadOS 14.2, macOS Big Sur 11.0.1, watchOS 7.1, and tvOS ...

CVE-2020-9863

CVE-2020-9863 affects Apple platforms (iOS 13.6/iPadOS 13.6, macOS Catalina 10.15.6, tvOS 13.4.8, watchOS 6.2.8). Description: a memory initialization issue was fixed via improved memory handling; impact: an application may execute arbitrary code with kernel privileges. Mitigation: apply the Appl...

CVE-2020-9868

CVE-2020-9868: A certificate validation issue occurred when processing administrator-added certificates on Apple platforms. The root cause is a validation flaw that could allow impersonation of a trusted website via shared key material associated with an administrator-added certificate. Affected ...

CVE-2020-9968

CVE-2020-9968 is an Apple logic issue fixed in iOS 14.0/iPadOS 14.0, macOS Catalina 10.15.7, tvOS 14.0, and watchOS 7.0. A malicious application could access restricted files due to improved restrictions. Referenced Apple advisories HT211843, HT211844, and HT211850 corroborate the affected platfo...

CVE-2021-1807

CVE-2021-1807 is an Apple Safari input validation issue that allows a local user to write arbitrary files. The vulnerability stems from inadequate input sanitization; it is fixed in iOS 14.5 / iPadOS 14.5 / watchOS 7.4. Affected products include Apple Safari on those platforms. The CVE entry note...