CVE-2018-4322

CVE-2018-4322 is an iOS vulnerability in the Accounts component affecting versions prior to iOS 12. It concerns an entitlement-related issue that could allow a local app to read a persistent account identifier. Apple’s security content notes that the flaw was addressed with improved entitlements ...

CVE-2018-4339

CVE-2018-4339 affects Apple iOS; a local user could read a persistent device identifier due to a flawed entitlement. The issue is fixed in iOS 12.1 via a new entitlement, per Red Hat and Apple security notes detailing this CVE.

CVE-2018-4447

CVE-2018-4447 is a memory corruption issue fixed by Apple through improved state management. The vulnerability affected multiple Apple platforms prior to the listed updates: iOS versions before 12.1.1, macOS Mojave before 10.14.2, tvOS before 12.1.1, and watchOS before 5.1.2. Apple’s security con...

CVE-2021-1833

CVE-2021-1833 affects Apple iOS/iPadOS. The issue stems from permission checking/filtering that could allow an application to gain elevated privileges. Apple patched this in iOS 14.5 and iPadOS 14.5; update to these versions or later to mitigate. Public exploit details are not provided in the sup...

CVE-2024-40850

CVE-2024-40850 describes a file access issue corrected by improved input validation. The vulnerability affects multiple Apple platforms and versions, including macOS Ventura 13.7; iOS 17.7 and iPadOS 17.7; visionOS 2; watchOS 11; macOS Sequoia 15; iOS 18 and iPadOS 18; macOS Sonoma 14.7; and tvOS...

CVE-2024-44126

CVE-2024-44126 affects Apple ARKit components on macOS and iOS family. The vulnerability allows processing a maliciously crafted file to trigger a heap corruption, with potential impact across confidentiality, integrity, and availability as described in the CVE metrics. Apple’s advisories indicat...

CVE-2024-54512

CVE-2024-54512 concerns the Face Gallery component on Apple platforms. The issue allowed a system binary to fingerprint a user’s Apple Account. Apple addressed it by removing the relevant flags. Patches are included in watchOS 11.2 and iOS 18.2 / iPadOS 18.2. The Apple security content page for F...

CVE-2025-43349

CVE-2025-43349 describes an out-of-bounds write in media processing that may cause an app to terminate when handling a malicious video file. The Apple security content lists affected components (e.g., CoreMedia and CoreAudio entries) and notes that the issue is fixed by updating to newer OS relea...

CVE-2026-20668

CVE-2026-20668 is a logging issue in Apple OS components that could allow an app to access sensitive user data. Affected products include iOS and iPadOS (18.7.7 and 26.3), macOS (Sequoia 15.7.5, Sonoma 14.8.5, Tahoe 26.3), and visionOS 26.3. The underlying problem is improper data handling in log...

CVE-2026-28871

CVE-2026-28871 is a logic issue that can enable cross-site scripting when visiting a malicious website. The vulnerability is fixed in Apple platforms: Safari 26.4, iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, and macOS Tahoe 26.4. Related Nessus/OpenVAS entries confirm affected WebKit/...

CVE-2026-43801

CVE-2026-43801 affects Apple platforms (iOS/iPadOS 26.6; macOS Sequoia 15.7.8; Sonoma 14.8.8; Tahoe 26.6; tvOS 26.6; visionOS 26.6; watchOS 26.6). The issue: an app may access sensitive user data due to inadequate checks; Apple states fixes are included in the listed OS updates (improved checks)....

CVE-2026-64707

CVE-2026-64707 : A permissions issue in the BackgroundAssets component allowed an app to delete files for which it had no permission. Root cause cited as insufficient validation in deletion/permission checks. Fixed in macOS Sonoma 14.8.8, macOS Sequoia 15.7.8, macOS Tahoe 26.6, iOS/iPadOS 26.6, a...

CVE-2026-64729

Technical details for CVE-2026-64729 are not publicly provided in the connected documents. Monitor for updates; the initial description lists a use-after-free issue fixed in 26.6 across Apple OSes.

CVE-2009-0961

The CVE-2009-0961 issue affects Apple iPhone OS 1.0–2.2.1 and iPhone OS for iPod touch 1.1–2.2.1. The Mail component could dismiss the call-approval dialog when another alert appears, potentially allowing a remote attacker to place a call without user approval by triggering an alert. The connecte...

CVE-2009-1679

The CVE covers Apple iPhone OS 1.0–2.2.1 and iPhone OS for iPod touch 1.1–2.2.1. The Profiles component, when installing a configuration profile, can replace ActiveSync’s password policy with a weaker one, allowing physically proximate attackers to bypass the policy. Impact: bypass of password po...

CVE-2009-1680

CVE-2009-1680 affects Safari on Apple iPhone OS versions 1.0 through 2.2.1 and iPhone OS for iPod touch 1.1 through 2.2.1. The issue is that the browser does not properly clear the search history when cleared from the Settings application, allowing physically proximate attackers to obtain the sea...

CVE-2010-1811

CVE-2010-1811 affects ImageIO in Apple iOS prior to 4.1, where a heap/buffer overflow in TIFF handling could allow a remote attacker to cause arbitrary code execution or a memory corruption/DoS in an affected device (iPhone/iPod touch). The provided documents specify the vulnerability class and i...

CVE-2012-0594

Technical details for CVE-2012-0594 are not publicly provided in the supplied connected documents. Monitor for updates from vendors and advisories.

CVE-2012-0602

CVE-2012-0602 affects WebKit as used in Apple iOS before 5.1 and iTunes before 10.6. The vulnerability lies in WebKit’s handling of crafted web content, enabling a remote attacker to execute arbitrary code or cause a denial of service via memory corruption and application crash. The initial descr...

CVE-2012-0605

Technical details for CVE-2012-0605 are not provided in the connected documents. Public information in the initial description is limited to a high‑level summary of WebKit/iOS/iTunes impact. Monitor for updates.

CVE-2012-0632

CVE-2012-0632 concerns WebKit as used in Apple iOS prior to 5.1 and iTunes prior to 10.6. A crafted website could remotely trigger memory corruption leading to arbitrary code execution or an application crash. The description specifies memory corruption and a crash as potential impacts, indicatin...

CVE-2012-0644

CVE-2012-0644 refers to a race condition in Apple iOS Passcode Lock (before 5.1) that lets a physically proximate attacker bypass the lock via a slide-to-dial gesture. Affected: iOS prior to 5.1 (Passcode Lock component). Root cause: race condition in handling slide-to-dial. Impact: bypass of pas...

CVE-2014-2019

The CVE-2014-2019 entry concerns the iCloud subsystem in Apple iOS prior to 7.1. Affected component: iCloud integration within iOS on Apple devices. The vulnerability allows physically proximate attackers to bypass the password prompt and either turn off Find My iPhone or perform a Delete Account...

CVE-2015-3732

CVE-2015-3732 affects WebKit/WebKit2 used in Apple iOS and Safari; the root cause is memory corruption in WebKit leading to remote code execution or memory corruption crashes when visiting crafted sites. Connected advisories confirm a fix: WebKit2 updated to version 2.10.9 (Mageia/MGASA-2016-0116...

CVE-2016-4626

CVE-2016-4626 affects IOHIDFamily in Apple devices (iOS prior to 9.3.3, OS X prior to 10.11.6, tvOS prior to 9.2.2, watchOS prior to 2.2.2). Root cause: a null pointer dereference. Impact per Apple docs: a local user may be able to execute arbitrary code with kernel privileges. Apple’s security c...

CVE-2017-13805

Summary of CVE-2017-13805 (Apple iOS Siri Information Disclosure) : The vulnerability affects iOS versions prior to 11.1 and involves the Siri component. An attacker with physical proximity could exploit a Siri request to read notifications that are not allowed on the lock screen, leaking private...

CVE-2018-4168

CVE-2018-4168 concerns the Apple iOS Files Widget. Affected: iOS versions prior to 11.3. Issue: the Files Widget could display cached data while the device was locked, enabling a physically proximate attacker with access to the screen to see sensitive information. Root cause (per Apple documentat...

CVE-2018-4313

CVE-2018-4313 concerns a consistency issue in how application snapshots are handled in Messages, allowing a local user to potentially discover a user’s deleted messages. The issue affected iOS prior to 12, tvOS prior to 12, and watchOS prior to 5. Apple documented the vulnerability in its securit...

CVE-2019-8732

CVE-2019-8732 affects iOS and was remedied in iOS 13. The issue caused deleted calls to remain visible on the device due to data handling during deletion, and Apple implemented an improved data deletion mechanism in iOS 13 to address it. Public references across multiple feeds (NVD/NVD listing, R...

CVE-2021-1812

Apple CVE-2021-1812 is an Apple CoreMotion logic issue fixed in iOS 14.5/iPadOS 14.5 that could allow a malicious app to execute arbitrary code with system privileges. Affected product: Apple iOS/iPadOS devices; root cause described as improved validation. Exploitation details are not provided in...

CVE-2021-30662

CVE-2021-30662 affects Apple iOS/iPadOS; processing a maliciously crafted file may lead to arbitrary code execution. Apple fixed this with iOS 14.5 and iPadOS 14.5. Public references note associated updates in Apple’s security content. Other connected records reiterate the same remediation date a...

CVE-2025-31207

CVE-2025-31207 is an Apple logic issue affecting iOS and iPadOS where an app may enumerate a user’s installed apps. The connected documentation confirms the vulnerability and that it is addressed in iOS 18.5 and iPadOS 18.5 with “improved checks.” The NVD/Red Hat/NCSC entries repeat the same desc...

CVE-2025-43480

CVE-2025-43480 is a cross-origin data exfiltration vulnerability impacting Apple platforms and Safari/WebKit in general. The issue is addressed with improved checks and is fixed in tvOS 26.1, watchOS 26.1, macOS Tahoe 26.1, iOS 26.1, iPadOS 26.1, Safari 26.1, and visionOS 26.1. The CVSSv3.1 score...

CVE-2025-43511

CVE-2025-43511 is a use-after-free vulnerability in WebKit when processing maliciously crafted web content, causing an unexpected process crash. The Connected documents confirm impact on WebKitGTK/WebKit2GTK components and list remediation via security updates across multiple distributions (e.g.,...

CVE-2025-43534

The CVE-2025-43534 issue is a path-handling flaw in iOS/iPadOS that was addressed by validation improvements. It affects iOS 18.7.7 and iPadOS 18.7.7, as well as iOS 26.2 and iPadOS 26.2, where a user with physical access could potentially bypass Activation Lock. The available connected sources c...

CVE-2025-43541

CVE-2025-43541 is a type-confusion issue in WebKit/WebKitGTK affecting the web rendering stack. Connected advisories show the issue being fixed in WebKitGTK/WebKitGTK+related components, with remediation via updated packages such as webkitgtk4 (e.g., WebKitGTK 2.50.4 and related debian/alma/redha...

CVE-2026-28956

CVE-2026-28956 is a memory corruption issue addressed with improved input validation; fixed in iOS/iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, and watchOS 26.5. Processing a malicious media file may cause an app to terminate or memory corrup...

CVE-2026-28958

CVE-2026-28958 is an Apple vulnerability addressed by updates to iOS/iPadOS 26.5, macOS Tahoe 26.5, and visionOS 26.5. The issue is described as an access to sensitive user data due to improved data protection in the fixed releases. Connected advisories confirm fixes across macOS, iOS/iPadOS, and...

CVE-2026-28969

CVE-2026-28969 is a use-after-free in the IOKit subsystem that Apple fixed by improving memory management. The vulnerability could allow an app to cause unexpected system termination. The CVE is addressed in multiple Apple OS updates: iOS 18.7.9 and iPadOS 18.7.9 iOS 26.5 and iPadOS 26.5 macOS Se...

CVE-2026-43799

The CVE-2026-43799 issue is a use-after-free memory management vulnerability in Apple platforms. Affected components are Apple OS family releases including iOS/iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6. The underlying caus...

CVE-2026-64692

CVE-2026-64692 is an Apple-ecosystem issue described as an out-of-bounds read that was addressed by improving bounds checking. The vulnerability is fixed in multiple Apple OS updates (iOS 26.6 and iPadOS 26.6; macOS Sequoia 15.7.8; macOS Sonoma 14.8.8; macOS Tahoe 26.6; tvOS 26.6; visionOS 26.6; ...

CVE-2026-64734

CVE-2026-64734 affects Apple platforms (iOS/iPadOS 26.6, macOS Sequoia 15.7.8, Sonoma 14.8.8, Tahoe 26.6, visionOS, watchOS 26.6). Root cause: processing a maliciously crafted contact may leak sensitive data; fix implemented via improved checks. Remediation: update to the listed fixed versions (a...

CVE-2011-2819

CVE-2011-2819 is referenced in connected OpenVAS entries as a WebKit/WebKit-based cross-origin vulnerability describing a cross-origin issue in the handling of the beforeload event. The initial description refers to a Chrome-based SOP bypass via base URI, but the connected documents ground this C...

CVE-2012-0615

CVE-2012-0615 affects WebKit as used in Apple iOS before 5.1 and iTunes before 10.6. The vulnerability allows a remote attacker to execute arbitrary code or cause a denial of service via a crafted web site, via memory corruption leading to an application crash. The description does not specify af...

CVE-2012-0646

CVE-2012-0646 affects Apple iOS prior to 5.1, describing a format string vulnerability in the VPN racoon configuration handler that could allow remote code execution with system privileges when a crafted racoon file is processed. The core issue is a format-string vulnerability in the VPN configur...

CVE-2016-1721

CVE-2016-1721 is reported for Apple devices: iOS before 9.2.1, OS X before 10.11.3, and tvOS before 9.1.1. The description indicates a local privilege escalation or denial of service caused by memory corruption in the kernel via unspecified vectors. The connected Apple security content references...

CVE-2016-4679

CVE-2016-4679 affects Apple OSes (iOS <10.1, macOS <10.12.1, tvOS <10.0.1, watchOS

CVE-2017-2375

CVE-2017-2375 concerns an issue in preventing the uploading of CallKit call history to iCloud on Apple iOS. The documented root cause is an internal logic issue, and the impact is that updates for CallKit call history were exposed to iCloud. The vulnerability is addressed in iOS 10.2.1, with the ...

CVE-2018-4362

CVE-2018-4362 affects Safari/WebKit on macOS and iOS, describing an inconsistent user interface issue that was addressed with improved state management. Public documentation notes that the issue affected versions prior to Safari 11.1.2 and iOS 12, with a fix delivered in Safari 11.1.2 (and corres...

CVE-2024-44127

CVE-2024-44127 : A privacy issue in Apple iOS/iPadOS where Private Browsing tabs could be accessed without authentication due to state-management weaknesses. The CVE is addressed in updates: iOS 17.7 and iPadOS 17.7, and iOS 18/iPadOS 18. Mitigations include applying these updates to prevent unau...