Apple iOS vulnerabilities

4,473 known vulnerabilities affecting apple/iphone_os.

Total CVEs

4,473

CISA KEV

actively exploited

Public exploits

278

Exploited in wild

142

Severity breakdown

CRITICAL347HIGH1787MEDIUM2030LOW309

Vulnerabilities

SortPage 157 of 224

CVE-2026-20678P4MEDIUMCVSS 5.5fixed in 18.7.5≥ 26.0, < 26.32026-02-11

CVE-2026-20678 [MEDIUM] CWE-200 CVE-2026-20678: An authorization issue was addressed with improved state management. This issue is fixed in iOS 18.7 An authorization issue was addressed with improved state management. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3. An app may be able to access sensitive user data.

nvd

CVE-2026-65403P4MEDIUMCVSS 5.5fixed in 26.72026-09-14

CVE-2026-65403 [MEDIUM] CWE-284 CVE-2026-65403: This issue was addressed with improved checks. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS This issue was addressed with improved checks. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, visionOS 27, watchOS 27. An app may be able to access sensitive user data.

nvd

CVE-2026-65353P4MEDIUMCVSS 5.5fixed in 26.62026-09-14

CVE-2026-65353 [MEDIUM] CWE-285 CVE-2026-65353: An authorization issue was addressed with improved state management. This issue is fixed in iOS 26.6 An authorization issue was addressed with improved state management. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6. An app may be able to access sensitive user data.

nvd

CVE-2026-84508P4MEDIUMCVSS 5.5fixed in 27.02026-10-20

CVE-2026-84508 [MEDIUM] CWE-284 CVE-2026-84508: This issue was addressed with improved validation of the caller's access. This issue is fixed in iOS This issue was addressed with improved validation of the caller's access. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Tahoe 26.7, visionOS 27. An app may be able to access protected user data.

nvd

CVE-2026-84636P4MEDIUMCVSS 5.5fixed in 27.02026-09-14

CVE-2026-84636 [MEDIUM] CWE-285 CVE-2026-84636: An authorization issue was addressed with improved state management. This issue is fixed in iOS 27 a An authorization issue was addressed with improved state management. This issue is fixed in iOS 27 and iPadOS 27, tvOS 27, visionOS 27, watchOS 27. An app may be able to access sensitive user data.

nvd

CVE-2026-84617P4MEDIUMCVSS 5.5fixed in 26.72026-09-14

CVE-2026-84617 [MEDIUM] CWE-863 CVE-2026-84617: An authorization issue was addressed with improved state management. This issue is fixed in iOS 26.7 An authorization issue was addressed with improved state management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27. An app may be able to access sensitive user data.

nvd

CVE-2026-84491P4MEDIUMCVSS 5.5≥ 26.0, < 26.72026-09-14

CVE-2026-84491 [MEDIUM] CWE-284 CVE-2026-84491: A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.7 and A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. An app may be able to access sensitive user data.

nvd

CVE-2026-86884P4MEDIUMCVSS 5.5fixed in 27.02026-09-14

CVE-2026-86884 [MEDIUM] CWE-269 CVE-2026-86884: A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 27 and iP A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, watchOS 27. An app may be able to access sensitive user data.

nvd

CVE-2023-34352P4MEDIUMCVSS 5.3fixed in 16.52023-09-06

CVE-2023-34352 [MEDIUM] CWE-276 CVE-2023-34352: A permissions issue was addressed with improved redaction of sensitive information. This issue is fi A permissions issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Ventura 13.4, tvOS 16.5, iOS 16.5 and iPadOS 16.5, watchOS 9.5. An attacker may be able to leak user account emails.

nvd

CVE-2026-86955P4MEDIUMCVSS 5.5fixed in 27.02026-10-20

CVE-2026-86955 [MEDIUM] CWE-862 CVE-2026-86955: An authorization issue was addressed with improved state management. This issue is fixed in iOS 27 a An authorization issue was addressed with improved state management. This issue is fixed in iOS 27 and iPadOS 27. An app may be able to access sensitive user data.

nvd

CVE-2026-113908P4MEDIUMCVSS 5.5fixed in 27.22026-10-26

CVE-2026-113908 [MEDIUM] CWE-200 CVE-2026-113908: A privacy issue was addressed by removing sensitive data. This issue is fixed in iOS 27.2 and iPadOS A privacy issue was addressed by removing sensitive data. This issue is fixed in iOS 27.2 and iPadOS 27.2. An app may be able to access sensitive user data.

nvd

CVE-2026-86976P4MEDIUMCVSS 5.5fixed in 27.02026-10-20

CVE-2026-86976 [MEDIUM] CWE-285 CVE-2026-86976: An authorization issue was addressed with improved state management. This issue is fixed in iOS 27 a An authorization issue was addressed with improved state management. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27. An app may be able to access sensitive user data.

nvd

CVE-2026-20655P4MEDIUMCVSS 5.5fixed in 18.7.5≥ 26.0, < 26.32026-02-11

CVE-2026-20655 [MEDIUM] CWE-287 CVE-2026-20655: An authorization issue was addressed with improved state management. This issue is fixed in iOS 18.7 An authorization issue was addressed with improved state management. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3. An attacker with physical access to a locked device may be able to view sensitive user information.

nvd

CVE-2026-112701P4MEDIUMCVSS 5.5fixed in 26.7.2≥ 27.0, < 27.22026-10-26

CVE-2026-112701 [MEDIUM] CWE-862 CVE-2026-112701: An authorization issue was addressed with improved state management. This issue is fixed in iOS 26.7 An authorization issue was addressed with improved state management. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2. An app may be able to access sensitive user data.

nvd

CVE-2026-113914P4MEDIUMCVSS 5.5fixed in 26.7.2≥ 27.0, < 27.22026-10-26

CVE-2026-113914 [MEDIUM] CWE-862 CVE-2026-113914: An authorization issue was addressed with improved state management. This issue is fixed in iOS 26.7 An authorization issue was addressed with improved state management. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2. An app may be able to access sensitive user data.

nvd

CVE-2021-1837P4MEDIUMCVSS 5.3fixed in 14.52021-09-08

CVE-2021-1837 [MEDIUM] CWE-295 CVE-2021-1837: A certificate validation issue was addressed. This issue is fixed in iOS 14.5 and iPadOS 14.5. An at A certificate validation issue was addressed. This issue is fixed in iOS 14.5 and iPadOS 14.5. An attacker in a privileged network position may be able to alter network traffic.

nvd

CVE-2025-31276P4MEDIUMCVSS 5.3fixed in 18.62025-07-30

CVE-2025-31276 [MEDIUM] CWE-359 CVE-2025-31276: This issue was addressed through improved state management. This issue is fixed in iOS 18.6 and iPad This issue was addressed through improved state management. This issue is fixed in iOS 18.6 and iPadOS 18.6, iPadOS 17.7.9. Remote content may be loaded even when the 'Load Remote Images' setting is turned off.

nvd

CVE-2011-3102P4MEDIUMCVSS 6.8≤ 6.1.4v1.0.0+46 more2012-05-16

CVE-2011-3102 [MEDIUM] CWE-189 CVE-2011-3102: Off-by-one error in libxml2, as used in Google Chrome before 19.0.1084.46 and other products, allows Off-by-one error in libxml2, as used in Google Chrome before 19.0.1084.46 and other products, allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via unknown vectors.

nvd

CVE-2025-24089P4MEDIUMCVSS 5.3fixed in 18.32026-01-16

CVE-2025-24089 [MEDIUM] CWE-200 CVE-2025-24089: A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 18.3 and A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 18.3 and iPadOS 18.3. An app may be able to enumerate a user's installed apps.

nvd

CVE-2014-4378P4MEDIUMCVSS 5.8≤ 7.1.2v7.0+8 more2014-09-18

CVE-2014-4378 [MEDIUM] CWE-119 CVE-2014-4378: CoreGraphics in Apple iOS before 8 and Apple TV before 7 allows remote attackers to obtain sensitive CoreGraphics in Apple iOS before 8 and Apple TV before 7 allows remote attackers to obtain sensitive information or cause a denial of service (out-of-bounds read and application crash) via a crafted PDF document.

nvd

← Previous157 / 224Next →