Apple iOS vulnerabilities

CVE-2023-42897 [MEDIUM] CVE-2023-42897: The issue was addressed with improved checks. This issue is fixed in iOS 17.2 and iPadOS 17.2. An at The issue was addressed with improved checks. This issue is fixed in iOS 17.2 and iPadOS 17.2. An attacker with physical access may be able to use Siri to access sensitive user data.

CVE-2010-3831 [MEDIUM] CWE-200 CVE-2010-3831: Photos in Apple iOS before 4.2 enables support for HTTP Basic Authentication over an unencrypted con Photos in Apple iOS before 4.2 enables support for HTTP Basic Authentication over an unencrypted connection, which allows man-in-the-middle attackers to read MobileMe account passwords by spoofing a MobileMe Gallery server during a "Send to MobileMe" action.

CVE-2020-27902 [MEDIUM] CWE-306 CVE-2020-27902: An authentication issue was addressed with improved state management. This issue is fixed in iOS 14. An authentication issue was addressed with improved state management. This issue is fixed in iOS 14.2 and iPadOS 14.2. A person with physical access to an iOS device may be able to access stored passwords without authentication.

CVE-2018-4307 [MEDIUM] CWE-20 CVE-2018-4307: A logic issue was addressed with improved state management. This issue affected versions prior to iO A logic issue was addressed with improved state management. This issue affected versions prior to iOS 12, Safari 12.

CVE-2022-22621 [MEDIUM] CVE-2022-22621: This issue was addressed with improved checks. This issue is fixed in tvOS 15.4, iOS 15.4 and iPadOS This issue was addressed with improved checks. This issue is fixed in tvOS 15.4, iOS 15.4 and iPadOS 15.4, macOS Monterey 12.3, watchOS 8.5. A person with physical access to an iOS device may be able to see sensitive information via keyboard suggestions.

CVE-2021-30948 [MEDIUM] CWE-522 CVE-2021-30948: An inconsistent user interface issue was addressed with improved state management. This issue is fix An inconsistent user interface issue was addressed with improved state management. This issue is fixed in iOS 15.2 and iPadOS 15.2. A person with physical access to an iOS device may be able to access stored passwords without authentication.

CVE-2024-54470 [MEDIUM] CWE-862 CVE-2024-54470: A logic issue was addressed with improved checks. This issue is fixed in iOS 17.7.1 and iPadOS 17.7. A logic issue was addressed with improved checks. This issue is fixed in iOS 17.7.1 and iPadOS 17.7.1, iOS 18.1 and iPadOS 18.1. An attacker with physical access may be able to access contacts from the lock screen.

CVE-2024-44171 [MEDIUM] CVE-2024-44171: This issue was addressed through improved state management. This issue is fixed in iOS 17.7 and iPad This issue was addressed through improved state management. This issue is fixed in iOS 17.7 and iPadOS 17.7, iOS 18 and iPadOS 18, watchOS 11. An attacker with physical access to a locked device may be able to Control Nearby Devices via accessibility features.

CVE-2025-31227 [MEDIUM] CWE-863 CVE-2025-31227: A logic issue was addressed with improved checks. This issue is fixed in iOS 18.5 and iPadOS 18.5. A A logic issue was addressed with improved checks. This issue is fixed in iOS 18.5 and iPadOS 18.5. An attacker with physical access to a device may be able to access a deleted call recording.

CVE-2019-8550 [MEDIUM] CWE-459 CVE-2019-8550: An issue existed in the pausing of FaceTime video. The issue was resolved with improved logic. This An issue existed in the pausing of FaceTime video. The issue was resolved with improved logic. This issue is fixed in iOS 12.2, macOS Mojave 10.14.4, watchOS 5.2. A user’s video may not be paused in a FaceTime call if they exit the FaceTime app while the call is ringing.

CVE-2024-40840 [MEDIUM] CVE-2024-40840: This issue was addressed through improved state management. This issue is fixed in iOS 18 and iPadOS This issue was addressed through improved state management. This issue is fixed in iOS 18 and iPadOS 18. An attacker with physical access may be able to use Siri to access sensitive user data.

CVE-2012-3746 [MEDIUM] CWE-310 CVE-2012-3746: UIWebView in UIKit in Apple iOS before 6 does not properly use the Data Protection feature, which al UIWebView in UIKit in Apple iOS before 6 does not properly use the Data Protection feature, which allows context-dependent attackers to obtain cleartext file content by leveraging direct access to a device's filesystem.

CVE-2026-86890 [MEDIUM] CWE-287 CVE-2026-86890: A logic issue was addressed with improved checks. This issue is fixed in iOS 26.7 and iPadOS 26.7, i A logic issue was addressed with improved checks. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27. An attacker with physical access to a locked device may be able to view sensitive user information.

CVE-2015-1129 [MEDIUM] CWE-310 CVE-2015-1129: Apple Safari before 6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5 does not properly select X.509 cli Apple Safari before 6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5 does not properly select X.509 client certificates, which makes it easier for remote attackers to track users via a crafted web site.

CVE-2025-43418 [MEDIUM] CWE-284 CVE-2025-43418: This issue was addressed by restricting options offered on a locked device. This issue is fixed in i This issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1. An attacker with physical access to a locked device may be able to view sensitive user information.

CVE-2026-28895 [MEDIUM] CWE-284 CVE-2026-28895: The issue was addressed with improved checks. This issue is fixed in iOS 26.4 and iPadOS 26.4. An at The issue was addressed with improved checks. This issue is fixed in iOS 26.4 and iPadOS 26.4. An attacker with physical access to an iOS device with Stolen Device Protection enabled may be able to access biometrics-gated Protected Apps with the passcode.

CVE-2022-26731 [MEDIUM] CVE-2022-26731: A logic issue was addressed with improved state management. This issue is fixed in macOS Monterey 12 A logic issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.4, iOS 15.5 and iPadOS 15.5. A malicious website may be able to track users in Safari private browsing mode.

CVE-2026-20661 [MEDIUM] CWE-285 CVE-2026-20661: An authorization issue was addressed with improved state management. This issue is fixed in iOS 18.7 An authorization issue was addressed with improved state management. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3. An attacker with physical access to a locked device may be able to view sensitive user information.

CVE-2023-41977 [MEDIUM] CVE-2023-41977: The issue was addressed with improved handling of caches. This issue is fixed in macOS Sonoma 14.1, The issue was addressed with improved handling of caches. This issue is fixed in macOS Sonoma 14.1, iOS 16.7.2 and iPadOS 16.7.2. Visiting a malicious website may reveal browsing history.

CVE-2019-7284 [MEDIUM] CVE-2019-7284: This issue was addressed with improved checks. This issue is fixed in iOS 12.2. Processing a malicio This issue was addressed with improved checks. This issue is fixed in iOS 12.2. Processing a maliciously crafted mail message may lead to S/MIME signature spoofing.