Apple flaws being used in attacks

CISA lists 95 flaws in Apple products as being used in attacks, most recently on 29 Sep 2026.

What to do

1. Update every Apple product you use.Install the updates Apple offers, on every device, and restart when asked. Each flaw below has a fix or clear advice; that’s one of CISA’s conditions for listing it.
2. If someone looks after IT for you, send them this page.Many of these are in equipment you don’t see: routers, firewalls, servers, the office network. Ask them to confirm each one is fixed, or that you don’t use the product.
3. Check anything else in the lookup.Search any app, company or CVE. Not being on CISA’s list doesn’t mean safe: keep updating either way.

Every flaw, newest first

1. Being used in attacksAdded by CISA on 29 Sep 2026
   Apple Multiple Products
   CVE-2026-86950Apple Multiple Products Out-of-Bounds Write Vulnerability
   Apple iOS, macOS, and iPadOS contain an out-of-bounds write vulnerability in CoreGraphics that may lead to arbitrary code execution.
   CISA’s required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Read all

   Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
   HARD’s advisoryCVE recordNVD
2. Being used in attacksAdded by CISA on 18 Aug 2026
   Apple macOS
   CVE-2026-65400Apple macOS Improper Authentication Vulnerability
   Apple macOS contains an improper authentication vulnerability that could allow an attacker on the network to authenticate to Screen Sharing without valid credentials.
   CISA’s required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Read all

   Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
   HARD’s advisoryCVE recordNVD
3. Being used in attacksAdded by CISA on 20 Mar 2026
   Apple Multiple Products
   CVE-2025-43520Apple Multiple Products Classic Buffer Overflow Vulnerability
   Apple watchOS, iOS, iPadOS, macOS, visionOS, and tvOS contain a classic buffer overflow vulnerability which could allow a malicious application to cause unexpected system termination or write kernel memory.
   CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
   CVE recordNVD
4. Being used in attacksAdded by CISA on 20 Mar 2026
   Apple Multiple Products
   CVE-2025-43510Apple Multiple Products Improper Locking Vulnerability
   Apple watchOS, iOS, iPadOS, macOS, visionOS, and tvOS contain an improper locking vulnerability that could allow a malicious application to cause unexpected changes in memory shared between processes.
   CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
   CVE recordNVD
5. Being used in attacksAdded by CISA on 20 Mar 2026
   Apple Multiple Products
   CVE-2025-31277Apple Multiple Products Buffer Overflow Vulnerability
   Apple Safari, iOS, watchOS, visionOS, iPadOS, macOS, and tvOS contain a buffer overflow vulnerability that could allow the processing of maliciously crafted web content which may lead to memory corruption.
   CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
   CVE recordNVD
6. Being used in attacksAdded by CISA on 5 Mar 2026
   Apple Multiple Products
   CVE-2023-43000Apple Multiple products Use-After-Free Vulnerability
   Apple macOS, iOS, iPadOS, and Safari 16.6 contain a use-after-free vulnerability due to the processing of maliciously crafted web content that may lead to memory corruption.
   CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
   CVE recordNVD
7. Being used in attacksAdded by CISA on 5 Mar 2026
   Apple iOS and iPadOS
   CVE-2023-41974Apple iOS and iPadOS Use-After-Free Vulnerability
   Apple iOS and iPadOS contain a use-after-free vulnerability. An app may be able to execute arbitrary code with kernel privileges.
   CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
   CVE recordNVD
8. Being used in attacksAdded by CISA on 5 Mar 2026
   Apple Multiple Products
   CVE-2021-30952Apple Multiple Products Integer Overflow or Wraparound Vulnerability
   Apple tvOS, macOS, Safari, iPadOS and watchOS contain an integer overflow or wraparound vulnerability due to the processing of maliciously crafted web content that may lead to arbitrary code execution.
   CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
   CVE recordNVD
9. Being used in attacksAdded by CISA on 12 Feb 2026
   Apple Multiple Products
   CVE-2026-20700Apple Multiple Buffer Overflow Vulnerability
   Apple iOS, macOS, tvOS, watchOS, and visionOS contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow an attacker with memory write the capability to execute arbitrary code.
   CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
   CVE recordNVD
10. Being used in attacksAdded by CISA on 15 Dec 2025
    Apple Multiple Products
    CVE-2025-43529Apple Multiple Products Use-After-Free WebKit Vulnerability
    Apple iOS, iPadOS, macOS, and other Apple products contain a use-after-free vulnerability in WebKit. Processing maliciously crafted web content may lead to memory corruption. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
    CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
    CVE recordNVD
11. Being used in attacksAdded by CISA on 20 Oct 2025
    Apple Multiple Products
    CVE-2022-48503Apple Multiple Products Unspecified Vulnerability
    Apple macOS, iOS, tvOS, Safari, and watchOS contain an unspecified vulnerability in JavaScriptCore that when processing web content may lead to arbitrary code execution. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
    CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
    CVE recordNVD
12. Being used in attacksAdded by CISA on 21 Aug 2025
    Apple iOS, iPadOS, and macOS
    CVE-2025-43300Apple iOS, iPadOS, and macOS Out-of-Bounds Write Vulnerability
    Apple iOS, iPadOS, and macOS contain an out-of-bounds write vulnerability in the Image I/O framework.
    CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
    CVE recordNVD
13. Being used in attacksAdded by CISA on 16 Jun 2025
    Apple Multiple Products
    CVE-2025-43200Apple Multiple Products Unspecified Vulnerability
    Apple iOS, iPadOS, macOS, watchOS, and visionOS, contain an unspecified vulnerability when processing a maliciously crafted photo or video shared via an iCloud Link.
    CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
    CVE recordNVD
14. Being used in attacksAdded by CISA on 17 Apr 2025
    Apple Multiple Products
    CVE-2025-31201Apple Multiple Products Arbitrary Read and Write Vulnerability
    Apple iOS, iPadOS, macOS, and other Apple products contain an arbitrary read and write vulnerability that allows an attacker to bypass Pointer Authentication.
    CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
    CVE recordNVD
15. Being used in attacksAdded by CISA on 17 Apr 2025
    Apple Multiple Products
    CVE-2025-31200Apple Multiple Products Memory Corruption Vulnerability
    Apple iOS, iPadOS, macOS, and other Apple products contain a memory corruption vulnerability that allows for code execution when processing an audio stream in a maliciously crafted media file.
    CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
    CVE recordNVD
16. Being used in attacksAdded by CISA on 13 Mar 2025
    Apple Multiple Products
    CVE-2025-24201Apple Multiple Products WebKit Out-of-Bounds Write Vulnerability
    Apple iOS, iPadOS, macOS, and other Apple products contain an out-of-bounds write vulnerability in WebKit that may allow maliciously crafted web content to break out of Web Content sandbox. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
    CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
    CVE recordNVD
17. Being used in attacksAdded by CISA on 12 Feb 2025
    Apple iOS and iPadOS
    CVE-2025-24200Apple iOS and iPadOS Incorrect Authorization Vulnerability
    Apple iOS and iPadOS contains an incorrect authorization vulnerability that allows a physical attacker to disable USB Restricted Mode on a locked device.
    CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
    CVE recordNVD
18. Being used in attacksAdded by CISA on 29 Jan 2025
    Apple Multiple Products
    CVE-2025-24085Apple Multiple Products Use-After-Free Vulnerability
    Apple iOS, macOS, and other Apple products contain a user-after-free vulnerability that could allow a malicious application to elevate privileges.
    CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
    CVE recordNVD
19. Being used in attacksAdded by CISA on 21 Nov 2024
    Apple Multiple Products
    CVE-2024-44309Apple Multiple Products Cross-Site Scripting (XSS) Vulnerability
    Apple iOS, macOS, and other Apple products contain an unspecified vulnerability when processing maliciously crafted web content that may lead to a cross-site scripting (XSS) attack.
    CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
    CVE recordNVD
20. Being used in attacksAdded by CISA on 21 Nov 2024
    Apple Multiple Products
    CVE-2024-44308Apple Multiple Products Code Execution Vulnerability
    Apple iOS, macOS, and other Apple products contain an unspecified vulnerability when processing maliciously crafted web content that may lead to arbitrary code execution.
    CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
    CVE recordNVD
21. Being used in attacksAdded by CISA on 6 Mar 2024
    Apple Multiple Products
    CVE-2024-23296Apple Multiple Products Memory Corruption Vulnerability
    Apple iOS, iPadOS, macOS, tvOS, and watchOS RTKit contain a memory corruption vulnerability that allows an attacker with arbitrary kernel read and write capability to bypass kernel memory protections.
    CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
    CVE recordNVD
22. Being used in attacksAdded by CISA on 6 Mar 2024
    Apple Multiple Products
    CVE-2024-23225Apple Multiple Products Memory Corruption Vulnerability
    Apple iOS, iPadOS, macOS, tvOS, watchOS, and visionOS kernel contain a memory corruption vulnerability that allows an attacker with arbitrary kernel read and write capability to bypass kernel memory protections.
    CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
    CVE recordNVD
23. Being used in attacksAdded by CISA on 31 Jan 2024
    Apple Multiple Products
    CVE-2022-48618Apple Multiple Products Memory Corruption Vulnerability
    Apple iOS, iPadOS, macOS, tvOS, and watchOS contain a time-of-check/time-of-use (TOCTOU) memory corruption vulnerability that allows an attacker with read and write capabilities to bypass Pointer Authentication.
    CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
    CVE recordNVD
24. Being used in attacksAdded by CISA on 23 Jan 2024
    Apple Multiple Products
    CVE-2024-23222Apple Multiple Products WebKit Type Confusion Vulnerability
    Apple iOS, iPadOS, macOS, tvOS, and Safari WebKit contain a type confusion vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
    CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
    CVE recordNVD
25. Being used in attacksAdded by CISA on 8 Jan 2024
    Apple Multiple Products
    CVE-2023-41990Apple Multiple Products Code Execution Vulnerability
    Apple iOS, iPadOS, macOS, tvOS, and watchOS contain an unspecified vulnerability that allows for code execution when processing a font file.
    CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
    CVE recordNVD
26. Being used in attacksAdded by CISA on 4 Dec 2023
    Apple Multiple Products
    CVE-2023-42917Apple Multiple Products WebKit Memory Corruption Vulnerability
    Apple iOS, iPadOS, macOS, and Safari WebKit contain a memory corruption vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
    CISA’s required actionApply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
    CVE recordNVD
27. Being used in attacksAdded by CISA on 4 Dec 2023
    Apple Multiple Products
    CVE-2023-42916Apple Multiple Products WebKit Out-of-Bounds Read Vulnerability
    Apple iOS, iPadOS, macOS, and Safari WebKit contain an out-of-bounds read vulnerability that may disclose sensitive information when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
    CISA’s required actionApply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
    CVE recordNVD
28. Being used in attacksAdded by CISA on 5 Oct 2023
    Apple iOS and iPadOS
    CVE-2023-42824Apple iOS and iPadOS Kernel Privilege Escalation Vulnerability
    Apple iOS and iPadOS contain an unspecified vulnerability that allows for local privilege escalation.
    CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
    CVE recordNVD
29. Being used in attacksAdded by CISA on 25 Sep 2023
    Apple Multiple Products
    CVE-2023-41993Apple Multiple Products WebKit Code Execution Vulnerability
    Apple iOS, iPadOS, macOS, and Safari WebKit contain an unspecified vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
    CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
    CVE recordNVD
30. Being used in attacksAdded by CISA on 25 Sep 2023
    Apple Multiple Products
    CVE-2023-41992Apple Multiple Products Kernel Privilege Escalation Vulnerability
    Apple iOS, iPadOS, macOS, and watchOS contain an unspecified vulnerability that allows for local privilege escalation.
    CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
    CVE recordNVD
31. Being used in attacksAdded by CISA on 25 Sep 2023
    Apple Multiple Products
    CVE-2023-41991Apple Multiple Products Improper Certificate Validation Vulnerability
    Apple iOS, iPadOS, macOS, and watchOS contain an improper certificate validation vulnerability that can allow a malicious app to bypass signature validation.
    CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
    CVE recordNVD
32. Being used in attacksAdded by CISA on 11 Sep 2023
    Apple iOS, iPadOS, and macOS
    CVE-2023-41064Apple iOS, iPadOS, and macOS ImageIO Buffer Overflow Vulnerability
    Apple iOS, iPadOS, and macOS contain a buffer overflow vulnerability in ImageIO when processing a maliciously crafted image, which may lead to code execution. This vulnerability was chained with CVE-2023-41061.
    CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
    CVE recordNVD
33. Being used in attacksAdded by CISA on 11 Sep 2023
    Apple iOS, iPadOS, and watchOS
    CVE-2023-41061Apple iOS, iPadOS, and watchOS Wallet Code Execution Vulnerability
    Apple iOS, iPadOS, and watchOS contain an unspecified vulnerability due to a validation issue affecting Wallet in which a maliciously crafted attachment may result in code execution. This vulnerability was chained with CVE-2023-41064.
    CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
    CVE recordNVD
34. Being used in attacksAdded by CISA on 26 Jul 2023
    Apple Multiple Products
    CVE-2023-38606Apple Multiple Products Kernel Unspecified Vulnerability
    Apple iOS, iPadOS, macOS, tvOS, and watchOS contain an unspecified vulnerability allowing an app to modify a sensitive kernel state.
    CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
    CVE recordNVD
35. Being used in attacksAdded by CISA on 13 Jul 2023
    Apple Multiple Products
    CVE-2023-37450Apple Multiple Products WebKit Code Execution Vulnerability
    Apple iOS, iPadOS, macOS, and Safari WebKit contain an unspecified vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
    CISA’s required actionApply updates per vendor instructions or discontinue use of the product if updates are unavailable.
    CVE recordNVD
36. Being used in attacksAdded by CISA on 23 Jun 2023
    Apple Multiple Products
    CVE-2023-32439Apple Multiple Products WebKit Type Confusion Vulnerability
    Apple iOS, iPadOS, macOS, and Safari WebKit contain a type confusion vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
37. Being used in attacksAdded by CISA on 23 Jun 2023
    Apple Multiple Products
    CVE-2023-32435Apple Multiple Products WebKit Memory Corruption Vulnerability
    Apple iOS, iPadOS, macOS, and Safari WebKit contain a memory corruption vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
38. Being used in attacksAdded by CISA on 23 Jun 2023
    Apple Multiple Products
    CVE-2023-32434Apple Multiple Products Integer Overflow Vulnerability
    Apple iOS. iPadOS, macOS, and watchOS contain an integer overflow vulnerability that could allow an application to execute code with kernel privileges.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
39. Being used in attacksAdded by CISA on 22 May 2023
    Apple Multiple Products
    CVE-2023-32409Apple Multiple Products WebKit Sandbox Escape Vulnerability
    Apple iOS, iPadOS, macOS, tvOS, watchOS, and Safari WebKit contain an unspecified vulnerability that can allow a remote attacker to break out of the Web Content sandbox. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
40. Being used in attacksAdded by CISA on 22 May 2023
    Apple Multiple Products
    CVE-2023-32373Apple Multiple Products WebKit Use-After-Free Vulnerability
    Apple iOS, iPadOS, macOS, tvOS, watchOS, and Safari WebKit contain a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
41. Being used in attacksAdded by CISA on 22 May 2023
    Apple Multiple Products
    CVE-2023-28204Apple Multiple Products WebKit Out-of-Bounds Read Vulnerability
    Apple iOS, iPadOS, macOS, tvOS, watchOS, and Safari WebKit contain an out-of-bounds read vulnerability that may disclose sensitive information when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
42. Being used in attacksAdded by CISA on 17 Apr 2023
    Apple macOS
    CVE-2019-8526Apple macOS Use-After-Free Vulnerability
    Apple macOS contains a use-after-free vulnerability that could allow for privilege escalation.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
43. Being used in attacksAdded by CISA on 10 Apr 2023
    Apple iOS, iPadOS, and macOS
    CVE-2023-28206Apple iOS, iPadOS, and macOS IOSurfaceAccelerator Out-of-Bounds Write Vulnerability
    Apple iOS, iPadOS, and macOS IOSurfaceAccelerator contain an out-of-bounds write vulnerability that allows an app to execute code with kernel privileges.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
44. Being used in attacksAdded by CISA on 10 Apr 2023
    Apple Multiple Products
    CVE-2023-28205Apple Multiple Products WebKit Use-After-Free Vulnerability
    Apple iOS, iPadOS, macOS, and Safari WebKit contain a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
45. Being used in attacksAdded by CISA on 30 Mar 2023
    Apple iOS, iPadOS, and macOS
    CVE-2021-30900Apple iOS, iPadOS, and macOS Out-of-Bounds Write Vulnerability
    Apple GPU drivers, included in iOS, iPadOS, and macOS, contain an out-of-bounds write vulnerability that may allow a malicious application to execute code with kernel privileges.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
46. Being used in attacksAdded by CISA on 14 Feb 2023
    Apple Multiple Products
    CVE-2023-23529Apple Multiple Products WebKit Type Confusion Vulnerability
    Apple iOS, MacOS, Safari and iPadOS WebKit contain a type confusion vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
47. Being used in attacksAdded by CISA on 14 Dec 2022
    Apple iOS
    CVE-2022-42856Apple iOS Type Confusion Vulnerability
    Apple iOS contains a type confusion vulnerability when processing maliciously crafted web content leading to code execution.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
48. Being used in attacksAdded by CISA on 25 Oct 2022
    Apple iOS and iPadOS
    CVE-2022-42827Apple iOS and iPadOS Out-of-Bounds Write Vulnerability
    Apple iOS and iPadOS kernel contain an out-of-bounds write vulnerability which can allow an application to perform code execution with kernel privileges.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
49. Being used in attacksAdded by CISA on 14 Sep 2022
    Apple iOS, iPadOS, and macOS
    CVE-2022-32917Apple iOS, iPadOS, and macOS Remote Code Execution Vulnerability
    Apple kernel, which is included in iOS, iPadOS, and macOS, contains an unspecified vulnerability where an application may be able to execute code with kernel privileges.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
50. Being used in attacksAdded by CISA on 8 Sep 2022
    Apple iOS, iPadOS, and macOS
    CVE-2020-9934Apple iOS, iPadOS, and macOS Input Validation Vulnerability
    Apple iOS, iPadOS, and macOS contain an unspecified vulnerability involving input validation which can allow a local attacker to view sensitive user information.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
51. Being used in attacksAdded by CISA on 25 Aug 2022
    Apple iOS, macOS, watchOS
    CVE-2021-31010Apple iOS, macOS, watchOS Sandbox Bypass Vulnerability
    In affected versions of Apple iOS, macOS, and watchOS, a sandboxed process may be able to circumvent sandbox restrictions.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
52. Being used in attacksAdded by CISA on 18 Aug 2022
    Apple iOS and macOS
    CVE-2022-32894Apple iOS and macOS Out-of-Bounds Write Vulnerability
    Apple iOS and macOS contain an out-of-bounds write vulnerability that could allow an application to execute code with kernel privileges.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
53. Being used in attacksAdded by CISA on 18 Aug 2022
    Apple iOS and macOS
    CVE-2022-32893Apple iOS and macOS Out-of-Bounds Write Vulnerability
    Apple iOS and macOS contain an out-of-bounds write vulnerability that could allow for remote code execution when processing malicious crafted web content.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
54. Being used in attacksAdded by CISA on 27 Jun 2022
    Apple iOS and iPadOS
    CVE-2021-30983Apple iOS and iPadOS Buffer Overflow Vulnerability
    Apple iOS and iPadOS contain a buffer overflow vulnerability that could allow an application to execute code with kernel privileges.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
55. Being used in attacksAdded by CISA on 27 Jun 2022
    Apple Multiple Products
    CVE-2020-9907Apple Multiple Products Memory Corruption Vulnerability
    Apple iOS, iPadOS, and tvOS contain a memory corruption vulnerability that could allow an application to execute code with kernel privileges.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
56. Being used in attacksAdded by CISA on 27 Jun 2022
    Apple Multiple Products
    CVE-2020-3837Apple Multiple Products Memory Corruption Vulnerability
    Apple iOS, iPadOS, macOS, tvOS, and watchOS contain a memory corruption vulnerability that could allow an application to execute code with kernel privileges.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
57. Being used in attacksAdded by CISA on 27 Jun 2022
    Apple Multiple Products
    CVE-2019-8605Apple Multiple Products Use-After-Free Vulnerability
    A use-after-free vulnerability in Apple iOS, macOS, tvOS, and watchOS could allow a malicious application to execute code with system privileges.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
58. Being used in attacksAdded by CISA on 27 Jun 2022
    Apple Multiple Products
    CVE-2018-4344Apple Multiple Products Memory Corruption Vulnerability
    Apple iOS, macOS, tvOS, and watchOS contain a memory corruption vulnerability which can allow for code execution.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
59. Being used in attacksAdded by CISA on 24 May 2022
    Apple iOS
    CVE-2016-4657Apple iOS Webkit Memory Corruption Vulnerability
    Apple iOS WebKit contains a memory corruption vulnerability that allows attackers to execute remote code or cause a denial-of-service (DoS) via a crafted web site. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
60. Being used in attacksAdded by CISA on 24 May 2022
    Apple iOS
    CVE-2016-4656Apple iOS Memory Corruption Vulnerability
    A memory corruption vulnerability in Apple iOS kernel allows attackers to execute code in a privileged context or cause a denial-of-service (DoS) via a crafted application.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
61. Being used in attacksAdded by CISA on 24 May 2022
    Apple iOS
    CVE-2016-4655Apple iOS Information Disclosure Vulnerability
    The Apple iOS kernel allows attackers to obtain sensitive information from memory via a crafted application.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
62. Being used in attacksAdded by CISA on 23 May 2022
    Apple Multiple Products
    CVE-2021-30883Apple Multiple Products Memory Corruption Vulnerability
    Apple iOS, macOS, watchOS, and tvOS contain a memory corruption vulnerability that could allow for remote code execution.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
63. Being used in attacksAdded by CISA on 23 May 2022
    Apple iOS
    CVE-2019-7287Apple iOS Memory Corruption Vulnerability
    Apple iOS contains a memory corruption vulnerability which could allow an attacker to perform remote code execution.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
64. Being used in attacksAdded by CISA on 23 May 2022
    Apple Multiple Products
    CVE-2019-7286Apple Multiple Products Memory Corruption Vulnerability
    Apple iOS, macOS, watchOS, and tvOS contain a memory corruption vulnerability that could allow for privilege escalation.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
65. Being used in attacksAdded by CISA on 4 May 2022
    Apple Multiple Products
    CVE-2021-1789Apple Multiple Products Type Confusion Vulnerability
    A type confusion issue affecting multiple Apple products allows processing of maliciously crafted web content, leading to arbitrary code execution.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
66. Being used in attacksAdded by CISA on 4 May 2022
    Apple Multiple Products
    CVE-2019-8506Apple Multiple Products Type Confusion Vulnerability
    A type confusion issue affecting multiple Apple products allows processing of maliciously crafted web content, leading to arbitrary code execution.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
67. Being used in attacksAdded by CISA on 4 Apr 2022
    Apple macOS
    CVE-2022-22675Apple macOS Out-of-Bounds Write Vulnerability
    macOS Monterey contains an out-of-bounds write vulnerability that could allow an application to execute arbitrary code with kernel privileges.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
68. Being used in attacksAdded by CISA on 4 Apr 2022
    Apple macOS
    CVE-2022-22674Apple macOS Out-of-Bounds Read Vulnerability
    macOS Monterey contains an out-of-bounds read vulnerability that could allow an application to read kernel memory.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
69. Being used in attacksAdded by CISA on 11 Feb 2022
    Apple iOS, iPadOS, and macOS
    CVE-2022-22620Apple iOS, iPadOS, and macOS Webkit Use-After-Free Vulnerability
    Apple iOS, iPadOS, and macOS WebKit contain a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
70. Being used in attacksAdded by CISA on 10 Feb 2022
    Apple OS X
    CVE-2015-1130Apple OS X Authentication Bypass Vulnerability
    The XPC implementation in Admin Framework in Apple OS X before 10.10.3 allows local users to bypass authentication and obtain admin privileges.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
71. Being used in attacksAdded by CISA on 10 Feb 2022
    Apple OS X
    CVE-2014-4404Apple OS X Heap-Based Buffer Overflow Vulnerability
    Heap-based buffer overflow in IOHIDFamily in Apple OS X, which affects, iOS before 8 and Apple TV before 7, allows attackers to execute arbitrary code in a privileged context.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
72. Being used in attacksAdded by CISA on 28 Jan 2022
    Apple iOS and macOS
    CVE-2022-22587Apple Memory Corruption Vulnerability
    Apple IOMobileFrameBuffer contains a memory corruption vulnerability which can allow a malicious application to execute arbitrary code with kernel privileges.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
73. Being used in attacksAdded by CISA on 3 Nov 2021
    Apple iOS, iPadOS, and macOS
    CVE-2021-30869Apple iOS, iPadOS, and macOS Type Confusion Vulnerability
    Apple iOS, iPadOS, and macOS contain a type confusion vulnerability in the XNU which may allow a malicious application to execute code with kernel privileges.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
74. Being used in attacksAdded by CISA on 3 Nov 2021
    Apple Multiple Products
    CVE-2021-30860Apple Multiple Products Integer Overflow Vulnerability
    Apple iOS, iPadOS, macOS, and watchOS CoreGraphics contain an integer overflow vulnerability which may allow code execution when processing a maliciously crafted PDF. The vulnerability is also known under the moniker of FORCEDENTRY.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
75. Being used in attacksAdded by CISA on 3 Nov 2021
    Apple iOS, iPadOS, and macOS
    CVE-2021-30858Apple iOS, iPadOS, macOS Use-After-Free Vulnerability
    Apple iOS, iPadOS, and macOS WebKit contain a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
76. Being used in attacksAdded by CISA on 3 Nov 2021
    Apple Multiple Products
    CVE-2021-30807Apple Multiple Products Memory Corruption Vulnerability
    Apple iOS, iPadOS, macOS, and watchOS IOMobileFrameBuffer contain a memory corruption vulnerability which may allow an application to execute code with kernel privileges.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
77. Being used in attacksAdded by CISA on 3 Nov 2021
    Apple iOS
    CVE-2021-30762Apple iOS WebKit Use-After-Free Vulnerability
    Apple iOS WebKit contains a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
78. Being used in attacksAdded by CISA on 3 Nov 2021
    Apple iOS
    CVE-2021-30761Apple iOS WebKit Memory Corruption Vulnerability
    Apple iOS WebKit contains a memory corruption vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
79. Being used in attacksAdded by CISA on 3 Nov 2021
    Apple macOS
    CVE-2021-30713Apple macOS Unspecified Vulnerability
    Apple macOS Transparency, Consent, and Control (TCC) contains an unspecified permissions issue which may allow a malicious application to bypass privacy preferences.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
80. Being used in attacksAdded by CISA on 3 Nov 2021
    Apple iOS
    CVE-2021-30666Apple iOS WebKit Buffer Overflow Vulnerability
    Apple iOS WebKit contains a buffer-overflow vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
81. Being used in attacksAdded by CISA on 3 Nov 2021
    Apple Multiple Products
    CVE-2021-30665Apple Multiple Products WebKit Memory Corruption Vulnerability
    Apple iOS, iPadOS, macOS, watchOS, and tvOS WebKit contain a memory corruption vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
82. Being used in attacksAdded by CISA on 3 Nov 2021
    Apple Multiple Products
    CVE-2021-30663Apple Multiple Products WebKit Integer Overflow Vulnerability
    Apple iOS, iPadOS, macOS, tvOS, and Safari WebKit contain an integer overflow vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
83. Being used in attacksAdded by CISA on 3 Nov 2021
    Apple Multiple Products
    CVE-2021-30661Apple Multiple Products WebKit Storage Use-After-Free Vulnerability
    Apple iOS, iPadOS, macOS, tvOS, watchOS, and Safari WebKit Storage contain a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
84. Being used in attacksAdded by CISA on 3 Nov 2021
    Apple macOS
    CVE-2021-30657Apple macOS Unspecified Vulnerability
    Apple macOS contains an unspecified logic issue in System Preferences that may allow a malicious application to bypass Gatekeeper checks.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
85. Being used in attacksAdded by CISA on 3 Nov 2021
    Apple iOS, iPadOS, and watchOS
    CVE-2021-1879Apple iOS, iPadOS, and watchOS WebKit Cross-Site Scripting (XSS) Vulnerability
    Apple iOS, iPadOS, and watchOS WebKit contain an unspecified vulnerability that allows for universal cross-site scripting (XSS) when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
86. Being used in attacksAdded by CISA on 3 Nov 2021
    Apple iOS, iPadOS, and macOS
    CVE-2021-1871Apple iOS, iPadOS, and macOS WebKit Remote Code Execution Vulnerability
    Apple iOS, iPadOS, and macOS WebKit contain an unspecified logic vulnerability that allows a remote attacker to execute code. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
87. Being used in attacksAdded by CISA on 3 Nov 2021
    Apple iOS, iPadOS, and macOS
    CVE-2021-1870Apple iOS, iPadOS, and macOS WebKit Remote Code Execution Vulnerability
    Apple iOS, iPadOS, and macOS WebKit contain an unspecified logic vulnerability that allows a remote attacker to execute code. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
88. Being used in attacksAdded by CISA on 3 Nov 2021
    Apple Multiple Products
    CVE-2021-1782Apple Multiple Products Race Condition Vulnerability
    Apple iOS, iPadOs, macOS, watchOS, and tvOS contain a race condition vulnerability that may allow a malicious application to elevate privileges.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
89. Being used in attacksAdded by CISA on 3 Nov 2021
    Apple Multiple Products
    CVE-2020-27950Apple Multiple Products Memory Initialization Vulnerability
    Apple iOS, iPadOS, macOS, and watchOS contain a memory initialization vulnerability that may allow a malicious application to disclose kernel memory.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
90. Being used in attacksAdded by CISA on 3 Nov 2021
    Apple Multiple Products
    CVE-2020-27932Apple Multiple Products Type Confusion Vulnerability
    Apple iOS, iPadOS, macOS, and watchOS contain a type confusion vulnerability that may allow a malicious application to execute code with kernel privileges.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
91. Being used in attacksAdded by CISA on 3 Nov 2021
    Apple Multiple Products
    CVE-2020-27930Apple Multiple Products Memory Corruption Vulnerability
    Apple iOS, iPadOS, macOS, and watchOS FontParser contain a memory corruption vulnerability which may allow for code execution when processing maliciously crafted front.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
92. Being used in attacksAdded by CISA on 3 Nov 2021
    Apple Multiple Products
    CVE-2020-9859Apple Multiple Products Code Execution Vulnerability
    Apple iOS, iPadOS, macOS, watchOS, and tvOS contain an unspecified vulnerability that may allow an application to execute code with kernel privileges.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
93. Being used in attacksAdded by CISA on 3 Nov 2021
    Apple iOS, iPadOS, and watchOS
    CVE-2020-9819Apple iOS, iPadOS, and watchOS Memory Corruption Vulnerability
    Apple iOS, iPadOS, and watchOS Mail contains a memory corruption vulnerability that may allow heap corruption when processing a maliciously crafted mail message.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
94. Being used in attacksAdded by CISA on 3 Nov 2021
    Apple iOS, iPadOS, and watchOS
    CVE-2020-9818Apple iOS, iPadOS, and watchOS Out-of-Bounds Write Vulnerability
    Apple iOS, iPadOS, and watchOS Mail contains an out-of-bounds write vulnerability which may allow memory modification or application termination when processing a maliciously crafted mail message.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
95. Being used in attacksAdded by CISA on 3 Nov 2021
    Apple iOS and macOS
    CVE-2019-6223Apple iOS and macOS Group Facetime Vulnerability
    Apple iOS and macOS Group FaceTime contains an unspecified vulnerability where the call initiator can cause the recipient's Apple device to answer unknowingly or without user interaction.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD

From CISA’s Known Exploited Vulnerabilities catalog, updated 21 Oct 2026 (version 2026.10.21). CISA’s required actions are written for US government agencies. Apple on CISA’s site.