Apple iOS vulnerabilities
4,134 known vulnerabilities affecting apple/iphone_os.
Total CVEs
4,134
CISA KEV
92
actively exploited
Public exploits
276
Exploited in wild
141
Severity breakdown
CRITICAL340HIGH1687MEDIUM1818LOW289
Vulnerabilities
Page 41 of 207
CVE-2026-64729P3CRITICALCVSS 9.8fixed in 26.62026-07-27
CVE-2026-64729 [CRITICAL] CWE-416 CVE-2026-64729: A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to cause unexpected system termination.
nvd
CVE-2026-28928P3CRITICALCVSS 9.8fixed in 26.62026-07-27
CVE-2026-28928 [CRITICAL] CWE-416 CVE-2026-28928: A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, watchOS 26.6. An app may be able to cause unexpected system termination.
nvd
CVE-2026-64746P3CRITICALCVSS 9.8fixed in 26.62026-07-27
CVE-2026-64746 [CRITICAL] CWE-862 CVE-2026-64746: An authorization issue was addressed with improved validation. This issue is fixed in iOS 26.6 and i
An authorization issue was addressed with improved validation. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, visionOS 26.6, watchOS 26.6. An app may be able to add contacts without user authorization.
nvd
CVE-2026-64720P3CRITICALCVSS 9.8fixed in 26.62026-07-27
CVE-2026-64720 [CRITICAL] CWE-362 CVE-2026-64720: A race condition was addressed with improved state handling. This issue is fixed in iOS 26.6 and iPa
A race condition was addressed with improved state handling. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, watchOS 26.6. An app may be able to cause unexpected system termination.
nvd
CVE-2016-1859P3HIGHCVSS 8.8fixed in 9.3.22016-05-20
CVE-2016-1859 [HIGH] CWE-119 CVE-2016-1859: The WebKit Canvas implementation in Apple iOS before 9.3.2, Safari before 9.1.1, and tvOS before 9.2
The WebKit Canvas implementation in Apple iOS before 9.3.2, Safari before 9.1.1, and tvOS before 9.2.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.
nvd
CVE-2016-1807P4MEDIUMCVSS 5.1PoCfixed in 9.3.22016-05-20
CVE-2016-1807 [MEDIUM] CWE-362 CVE-2016-1807: Race condition in the Disk Images subsystem in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS bef
Race condition in the Disk Images subsystem in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1 allows local users to obtain sensitive information from kernel memory via unspecified vectors.
nvd
CVE-2018-4191P3HIGHCVSS 8.8fixed in 12.02019-04-03
CVE-2018-4191 [HIGH] CWE-119 CVE-2018-4191: A memory corruption issue was addressed with improved validation. This issue affected versions prior
A memory corruption issue was addressed with improved validation. This issue affected versions prior to iOS 12, tvOS 12, watchOS 5, Safari 12, iTunes 12.9 for Windows, iCloud for Windows 7.7.
nvd
CVE-2018-4316P3HIGHCVSS 8.8fixed in 12.02019-04-03
CVE-2018-4316 [HIGH] CWE-119 CVE-2018-4316: A memory corruption issue was addressed with improved state management. This issue affected versions
A memory corruption issue was addressed with improved state management. This issue affected versions prior to iOS 12, tvOS 12, Safari 12, iTunes 12.9 for Windows, iCloud for Windows 7.7.
nvd
CVE-2016-7632P3HIGHCVSS 8.8≤ 10.1.12017-02-20
CVE-2016-7632 [HIGH] CWE-119 CVE-2016-7632: An issue was discovered in certain Apple products. iOS before 10.2 is affected. Safari before 10.0.2
An issue was discovered in certain Apple products. iOS before 10.2 is affected. Safari before 10.0.2 is affected. iCloud before 6.1 is affected. iTunes before 12.5.4 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a cra
nvd
CVE-2016-7611P3HIGHCVSS 8.8≤ 10.1.12017-02-20
CVE-2016-7611 [HIGH] CWE-119 CVE-2016-7611: An issue was discovered in certain Apple products. iOS before 10.2 is affected. Safari before 10.0.2
An issue was discovered in certain Apple products. iOS before 10.2 is affected. Safari before 10.0.2 is affected. iCloud before 6.1 is affected. iTunes before 12.5.4 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a cra
nvd
CVE-2016-7656P3HIGHCVSS 8.8≤ 10.1.12017-02-20
CVE-2016-7656 [HIGH] CWE-119 CVE-2016-7656: An issue was discovered in certain Apple products. iOS before 10.2 is affected. Safari before 10.0.2
An issue was discovered in certain Apple products. iOS before 10.2 is affected. Safari before 10.0.2 is affected. iCloud before 6.1 is affected. iTunes before 12.5.4 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a cra
nvd
CVE-2016-7641P3HIGHCVSS 8.8≤ 10.1.12017-02-20
CVE-2016-7641 [HIGH] CWE-119 CVE-2016-7641: An issue was discovered in certain Apple products. iOS before 10.2 is affected. Safari before 10.0.2
An issue was discovered in certain Apple products. iOS before 10.2 is affected. Safari before 10.0.2 is affected. iCloud before 6.1 is affected. iTunes before 12.5.4 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a cra
nvd
CVE-2016-7654P3HIGHCVSS 8.8≤ 10.1.12017-02-20
CVE-2016-7654 [HIGH] CWE-119 CVE-2016-7654: An issue was discovered in certain Apple products. iOS before 10.2 is affected. Safari before 10.0.2
An issue was discovered in certain Apple products. iOS before 10.2 is affected. Safari before 10.0.2 is affected. iCloud before 6.1 is affected. iTunes before 12.5.4 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a cra
nvd
CVE-2016-7645P3HIGHCVSS 8.8≤ 10.1.12017-02-20
CVE-2016-7645 [HIGH] CWE-119 CVE-2016-7645: An issue was discovered in certain Apple products. iOS before 10.2 is affected. Safari before 10.0.2
An issue was discovered in certain Apple products. iOS before 10.2 is affected. Safari before 10.0.2 is affected. iCloud before 6.1 is affected. iTunes before 12.5.4 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a cra
nvd
CVE-2016-7639P3HIGHCVSS 8.8≤ 10.1.12017-02-20
CVE-2016-7639 [HIGH] CWE-119 CVE-2016-7639: An issue was discovered in certain Apple products. iOS before 10.2 is affected. Safari before 10.0.2
An issue was discovered in certain Apple products. iOS before 10.2 is affected. Safari before 10.0.2 is affected. iCloud before 6.1 is affected. iTunes before 12.5.4 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a cra
nvd
CVE-2016-7642P3HIGHCVSS 8.8≤ 10.1.12017-02-20
CVE-2016-7642 [HIGH] CWE-119 CVE-2016-7642: An issue was discovered in certain Apple products. iOS before 10.2 is affected. Safari before 10.0.2
An issue was discovered in certain Apple products. iOS before 10.2 is affected. Safari before 10.0.2 is affected. iCloud before 6.1 is affected. iTunes before 12.5.4 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a cra
nvd
CVE-2017-2433P3HIGHCVSS 8.8≤ 10.2.12017-04-02
CVE-2017-2433 [HIGH] CWE-119 CVE-2017-2433: An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 i
An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
nvd
CVE-2017-2405P3HIGHCVSS 8.8≤ 10.2.12017-04-02
CVE-2017-2405 [HIGH] CWE-119 CVE-2017-2405: An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 i
An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. The issue involves the "WebKit Web Inspector" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
nvd
CVE-2016-7648P3HIGHCVSS 8.8≤ 10.1.12017-02-20
CVE-2016-7648 [HIGH] CWE-119 CVE-2016-7648: An issue was discovered in certain Apple products. iOS before 10.2 is affected. Safari before 10.0.2
An issue was discovered in certain Apple products. iOS before 10.2 is affected. Safari before 10.0.2 is affected. iCloud before 6.1 is affected. iTunes before 12.5.4 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a cra
nvd
CVE-2016-7587P3HIGHCVSS 8.8≤ 10.1.12017-02-20
CVE-2016-7587 [HIGH] CWE-119 CVE-2016-7587: An issue was discovered in certain Apple products. iOS before 10.2 is affected. Safari before 10.0.2
An issue was discovered in certain Apple products. iOS before 10.2 is affected. Safari before 10.0.2 is affected. iCloud before 6.1 is affected. iTunes before 12.5.4 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a cra
nvd