CVE-2018-4201

CVE-2018-4201 affects WebKit on multiple Apple platforms (iOS <11.4, Safari <11.1.1, iCloud for Windows <7.5, iTunes for Windows <12.7.5, tvOS <11.4, watchOS

CVE-2020-9815

CVE-2020-9815 affects multiple Apple platforms (iOS 13.5/iPadOS 13.5, macOS Catalina 10.15.5, tvOS 13.4.5, watchOS 6.2.5). Description: Processing a maliciously crafted audio file may lead to arbitrary code execution due to an out-of-bounds read, addressed by improved bounds checking. Affected co...

CVE-2020-9961

CVE-2020-9961 is reported in Apple's ImageIO component. Affected platforms include macOS Catalina 10.15 (and Security Update 2020-005 for High Sierra and Mojave). The issue is described as an out-of-bounds read in ImageIO that could be triggered by processing a maliciously crafted image, leading ...

CVE-2021-1858

CVE-2021-1858 affects Apple OS components handling images. A vulnerability in processing a maliciously crafted image can lead to arbitrary code execution due to an out-of-bounds write, addressed by improved bounds checking. Fixed in Security Update 2021-002 Catalina, iOS 14.5/iPadOS 14.5, watchOS...

CVE-2021-1860

CVE-2021-1860 relates to a memory initialization issue in Apple platforms, addressed by memory handling improvements and fixed in Security Update 2021-002 (Catalina), 2021-003 (Mojave), and iOS 14.5 / iPadOS 14.5 / watchOS 7.4 / tvOS 14.5 / macOS Big Sur 11.3. A malicious application may be able ...

CVE-2021-30652

CVE-2021-30652 is a Libxpc race condition vulnerability in Apple platforms. The issue could allow a malicious application to gain root privileges. It is addressed by Apple in Security Update 2021-002 for Catalina, Security Update 2021-003 for Mojave, and in iOS 14.5 / iPadOS 14.5, watchOS 7.4, tv...

CVE-2021-30727

CVE-2021-30727 involves a logic issue addressed by improved state management and is fixed in macOS Big Sur 11.4, tvOS 14.6, watchOS 7.5, iOS 14.6, and iPadOS 14.6. A malicious app may be able to modify protected parts of the file system. No exploitation status or detailed root cause is provided b...

CVE-2021-30852

CVE-2021-30852 is a type-confusion issue in Apple’s Foundation component that can be triggered by processing malicious web content, potentially enabling arbitrary code execution. The vulnerability is addressed via memory-handling fixes and is fixed in iOS 14.8 and iPadOS 14.8, tvOS 15, watchOS 8,...

CVE-2021-30857

CVE-2021-30857 is a local kernel race-condition vulnerability in Apple’s kernel. The description indicates it could allow a malicious app to execute arbitrary code with kernel privileges. The initial document notes a fix was included in multiple updates: macOS Big Sur 11.6, iOS 14.8 / iPadOS 14.8...

CVE-2021-30903

CVE-2021-30903 affects Apple iOS/iPadOS (and macOS Monterey 12.0.1). The issue is triggered locally and may cause unexpected termination or arbitrary code execution. Affected component is Continuity Camera on Apple devices. Remediation is via updates: iOS 14.8.1/iPadOS 14.8.1, iOS 15.1/iPadOS 15....

CVE-2022-22670

CVE-2022-22670 in Apple's MediaRemote module affects tvOS 15.4, iOS 15.4, iPadOS 15.4, and watchOS 8.5. The issue is described as an access control restriction problem that could allow a malicious app to identify which other applications a user has installed. Public details in the connected docs ...

CVE-2022-42865

This CVE (CVE-2022-42865) concerns Apple platforms and is addressed by enabling hardened runtime. It is fixed in iOS 16.2, iPadOS 16.2, macOS Ventura 13.1, tvOS 16.2, and watchOS 9.2. The issue allows an app to bypass Privacy preferences. The connected documents corroborate: the vulnerability is ...

CVE-2023-42970

CVE-2023-42970 is a WebKitGTK/WebKitGTK3 use-after-free/memory-management issue that affects multiple Linux distributions. In the connected advisories, SUSE-SU-2025:01746-1 and SUSE-SU-2025:02033-1 list webkit2gtk3 updates to version 2.48.2 fixing CVE-2023-42970 (along with other CVEs). The advis...

CVE-2025-31182

CVE-2025-31182 : Apple addresses an issue where an app could delete files it should not access due to improper handling of symlinks. The vulnerability affects multiple Apple OS versions and is fixed in visionOS 2.4, macOS Ventura 13.7.5, tvOS 18.4, iOS 18.4, iPadOS 18.4, macOS Sequoia 15.4, and m...

CVE-2025-43227

CVE-2025-43227 affects WebKit/WebKitGTK in Apple Safari/WebKitGTK-based products where processing maliciously crafted web content could disclose sensitive user information. The vulnerability is mitigated by software updates: Safari 18.6; iOS 18.6 and iPadOS 18.6; macOS Sequoia 15.6; tvOS 18.6; wa...

CVE-2025-43433

The CVE-2025-43433 issue affects Apple software where processing maliciously crafted web content may lead to memory corruption. Apple published fixes across multiple platforms (tvOS 26.1, watchOS 26.1, macOS Tahoe 26.1, iOS 26.1, iPadOS 26.1, Safari 26.1, and iOS/iPadOS 18.7.2) with the underlyin...

CVE-2026-43705

CVE-2026-43705 is a type confusion vulnerability in WebKit/Safari components that could allow memory corruption when processing malicious web content. Affects Safari, iOS/iPadOS, macOS WebKit layers (Safari/WebKit stack) with memory corruption as the stated impact. The issue is fixed in Safari 26...

CVE-2017-2475

CVE-2017-2475 affects WebKitGTK+ (and WebKit in related builds) with UXSS via crafted frames on malicious websites. Public docs in connected sources describe CVE-2017-2475 as a cross-site scripting/UXSS issue in WebKit components. Mitigation as per Gentoo and Arch Linux advisories is to upgrade W...

CVE-2017-7038

CVE-2017-7038 is a WebKit/DOMParser vulnerability affecting Apple platforms. A logic issue in the DOMParser handling could allow cross‑site scripting when processing malicious web content. Affected: iOS prior to 10.3.3, Safari prior to 10.1.2, and tvOS prior to 10.2.2. Mitigation: upgrade to iOS ...

CVE-2018-4101

CVE-2018-4101 affects WebKit in Apple products (iOS < 11.3, Safari < 11.1, iCloud < 7.4 for Windows, iTunes < 12.7.4 on Windows, tvOS

CVE-2021-1741

CVE-2021-1741 is an out-of-bounds read in a macOS/iOS image-processing component. Processing a maliciously crafted image may lead to arbitrary code execution. It is fixed via macOS Big Sur 11.2, Security Update 2021-001 (Catalina 11.2, Mojave 11.2), watchOS 7.3, tvOS 14.4, iOS 14.4 and iPadOS 14.4.

CVE-2021-1882

CVE-2021-1882 is a memory corruption vulnerability in Apple software. Connected sources specify an issue that can allow an application to gain elevated privileges, with fixes in Security Update 2021-002 for Catalina, iOS 14.5/iPadOS 14.5, watchOS 7.4, tvOS 14.5, and macOS Big Sur 11.3. The NVD/NC...

CVE-2021-30697

CVE-2021-30697 is a logic issue described by Apple as being mitigated by improvements in state management. The CVE entry lists fixes in tvOS 14.6, macOS Security Update 2021-004 Mojave, iOS 14.6 and iPadOS 14.6, macOS Big Sur 11.4, and watchOS 7.5. A local user may be able to leak sensitive user ...

CVE-2021-30767

CVE-2021-30767 is a logic/state-management issue fixed in Apple platforms: macOS Big Sur 11.6.2, macOS Monterey 12.1, Security Update 2021-008 Catalina, iOS 15.2, iPadOS 15.2, and watchOS 8.3. The issue allows a local user to modify protected parts of the filesystem. The provided documents confir...

CVE-2021-31008

CVE-2021-31008 is a WebKit/type-confusion vulnerability addressed by Apple across multiple platforms. The RedHat/Apple entries confirm a type confusion issue in WebKit that could, when processing malicious web content, lead to code execution. Apple lists affected products as Safari, tvOS, iOS/iPa...

CVE-2022-26739

CVE-2022-26739 describes an out-of-bounds write vulnerability that could allow arbitrary code execution with kernel privileges. The issue is fixed in Apple platforms as follows: tvOS 15.5, macOS Monterey 12.4, iOS 15.5, and iPadOS 15.5. The root cause is an out-of-bounds write that was mitigated ...

CVE-2022-42798

CVE-2022-42798 affects Apple platforms via a memory handling issue in parsing maliciously crafted audio files, leading to potential user information disclosure. The vulnerability is fixed in specific updates: tvOS 16.1, iOS 15.7.1 and iPadOS 15.7.1, macOS Ventura 13, watchOS 9.1, iOS 16.1 and iPa...

CVE-2022-42862

CVE-2022-42862 affects Apple platforms (iOS/iPadOS/macOS). The advisory notes the issue was resolved by removing the vulnerable code and is fixed in iOS 16.2 / iPadOS 16.2 and macOS Ventura 13.1, addressing an app-level privacy preferences bypass. The CVSS vector indicates a local, low-attack com...

CVE-2023-27963

CVE-2023-27963 concerns Apple platforms where a shortcut may access sensitive data with certain actions without user prompts. The issue was addressed via additional permissions checks and is fixed in: macOS Ventura 13.3; macOS Monterey 12.6.4; iOS 16.4 and iPadOS 16.4; iOS 15.7.4 and iPadOS 15.7....

CVE-2023-28182

CVE-2023-28182 affects Apple devices where VPN servers configured with EAP-only authentication may be spoofed by a user in a privileged network position. The root issue is authentication weakness that could allow impersonation of a VPN server. Impact, as stated, is limited to integrity concerns f...

CVE-2023-28200

CVE-2023-28200 is a validation issue fixed by Apple in macOS Ventura 13.3, iOS 15.7.4, iPadOS 15.7.4, macOS Monterey 12.6.4 and macOS Big Sur 11.7.5. The vulnerability stems from insufficient input sanitization in a kernel-related validation path, allowing an app to disclose kernel memory. Exploi...

CVE-2024-23223

CVE-2024-23223 describes a privacy issue resolved by Apple in macOS Sonoma 14.3, watchOS 10.3, tvOS 17.3, iOS 17.3 and iPadOS 17.3. The issue allows an app to access sensitive user data due to improved handling of files. The NVD/CNA metrics list a low attack complexity, local attack vector, no pr...

CVE-2024-27857

CVE-2024-27857 is an out-of-bounds access issue affecting Apple Vision Pro WebKit; fixed in visionOS 1.2 through improved bounds checking. The Apple security content confirms WebKit entry CVE-2024-27857 with this remediation; exploitation details are not disclosed in the connected documents.

CVE-2025-43265

An out-of-bounds read in WebKit/WebKitGTK when processing malicious web content may disclose internal app states. CVE-2025-43265 is fixed in Safari 18.6 and corresponding platform updates (watchOS 11.6, visionOS 2.6, iOS 18.6, iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6). Related advisories (Debia...

CVE-2017-7049

CVE-2017-7049 affects Apple products via the WebKit component. A crafted web site may allow remote attackers to execute arbitrary code or cause memory corruption leading to a denial of service. Affected: iOS < 10.3.3; Safari < 10.1.2; iCloud on Windows < 6.2.2; iTunes on Windows < 12....

CVE-2017-7055

CVE-2017-7055 affects WebKit components in Apple software (iOS Safari, macOS Safari, WebKitGTK+ for Linux) with a memory-corruption/related issue that could allow remote code execution or memory corruption via a crafted web site. Public records show multiple related CVEs in WebKit/GTK ports aroun...

CVE-2019-8514

CVE-2019-8514 describes a logic issue in state management that could allow an application to gain elevated privileges. Affected platforms include Apple ecosystem components, with fixes delivered in iOS 12.2, macOS Mojave 10.14.4, tvOS 12.2, and watchOS 5.2. The description does not specify the ex...

CVE-2019-8830

CVE-2019-8830 involves an out-of-bounds read in FaceTime processing of malicious video, fixed by input validation improvements. Affected Apple platforms include tvOS 13.3, watchOS 6.1.1, macOS Catalina 10.15.2, Security Update 2019-002 Mojave, Security Update 2019-007 High Sierra, iOS 13.3/iPadOS...

CVE-2020-27917

CVE-2020-27917 is a use-after-free vulnerability in the libxml2/Web content handling path that could lead to arbitrary code execution when processing maliciously crafted web content. It is fixed in Apple platforms as part of macOS Big Sur 11.0.1, watchOS 7.1, iOS 14.2 and iPadOS 14.2, as well as ...

CVE-2020-3826

CVE-2020-3826 is an out-of-bounds read in Apple’s ImageIO image processing. Processing a maliciously crafted image may lead to arbitrary code execution. Fixed in iOS 13.3.1 / iPadOS 13.3.1, macOS Catalina 10.15.3, tvOS 13.3.1, watchOS 6.1.2, and corresponding Apple platform updates; iTunes/iCloud...

CVE-2021-1740

CVE-2021-1740 involves a parsing issue in how directory paths are handled on Apple platforms. The underlying problem is improper path validation, enabling a local user to modify protected parts of the file system. Affected products and OS versions include macOS Big Sur 11.3, macOS Catalina (Secur...

CVE-2021-1868

CVE-2021-1868 describes a logic issue addressed by improved state management, enabling a local attacker to potentially elevate privileges on affected Apple platforms. The vulnerability is fixed via Security Update packages: Catalina 2021-002, Mojave 2021-003, and iOS 14.5 / iPadOS 14.5 / watchOS ...

CVE-2021-30693

CVE-2021-30693 describes a validation issue in Apple's image-processing path that could allow arbitrary code execution when processing a malicious image. The issue is mitigated by updates: macOS Big Sur 11.4, macOS Security Update 2021-003 Catalina, 2021-004 Mojave, and iOS 14.6 / iPadOS 14.6. Th...

CVE-2021-30694

CVE-2021-30694 is an information-disclosure vulnerability in Apple platforms where processing a maliciously crafted USD file could disclose memory contents due to an issue with state management. Publicly affected software includes macOS Big Sur 11.4, Security Update 2021-003 Catalina, Security Up...

CVE-2021-30746

CVE-2021-30746 is an out-of-bounds read vulnerability addressed by improved input validation. Affected products include macOS Big Sur 11.4 and Security Updates 2021-003 Catalina, 2021-004 Mojave, and iOS 14.6 / iPadOS 14.6. The issue could disclose memory contents when processing a malicious USD ...

CVE-2021-30902

CVE-2021-30902 affects Apple iOS/iPadOS Voice Control on Apple devices. A use-after-free in Voice Control was addressed with improved memory management and is fixed in iOS 14.8.1/iPadOS 14.8.1 and iOS 15.1/iPadOS 15.1. Local attackers may cause unexpected app termination or arbitrary code executi...

CVE-2022-22658

Summary: CVE-2022-22658 is an input validation vulnerability in Apple iOS, affecting the Mail workflow when processing a maliciously crafted email. The underlying issue is improper input validation, leading to a denial-of-service. Affected product/versions: iOS prior to 16.0.3 (Mail app behavior ...

CVE-2022-22671

CVE-2022-22671 concerns an authentication issue in iOS/iPadOS where a person with physical access could view photos from the lock screen. The connected sources confirm the vulnerability affects Apple devices and is fixed in iOS 15.4 / iPadOS 15.4. Affected component: VoiceOver/lock-screen handlin...

CVE-2022-32781

CVE-2022-32781 affects Apple platforms (macOS Catalina, Big Sur, Monterey; iOS/iPadOS) with impact of potentially allowing an app with root privileges to access private information. The vulnerability was addressed by enabling hardened runtime and is fixed in macOS Monterey 12.4, iOS 15.5, iPadOS ...

CVE-2022-32820

CVE-2022-32820 is an out-of-bounds write issue that Apple fixed by improved input validation. The vulnerability could allow an app to execute arbitrary code with kernel privileges. Affected platforms include iOS/iPadOS 15.6, macOS Big Sur 11.6.8, watchOS 8.7, tvOS 15.6, macOS Monterey 12.5, and S...