Cyberfeed6 › Vendors › Apple
CISA lists 96 Apple vulnerabilities as exploited in real attacks. Most entries concern Multiple Products, iOS, iPadOS, and macOS, iOS, macOS.
Showing the 40 most recently added of 96. Check the vendor notice before you act: it names the fixed versions.
| Vulnerability | Product | Added to list | Severity | Ransomware | Fix |
|---|---|---|---|---|---|
| CVE-2024-27834Apple Multiple Products Improper Authentication Vulnerability | Multiple Products | 2026-11-04 | Medium (5.5) | No | Vendor notice |
| CVE-2026-86950Apple Multiple Products Out-of-Bounds Write Vulnerability | Multiple Products | 2026-09-29 | High (8.8) | No | Vendor notice |
| CVE-2026-65400Apple macOS Improper Authentication Vulnerability | macOS | 2026-08-18 | Critical (9.8) | No | Vendor notice |
| CVE-2025-43520Apple Multiple Products Classic Buffer Overflow Vulnerability | Multiple Products | 2026-03-20 | Medium (5.5) | No | Vendor notice |
| CVE-2025-43510Apple Multiple Products Improper Locking Vulnerability | Multiple Products | 2026-03-20 | High (7.8) | No | Vendor notice |
| CVE-2025-31277Apple Multiple Products Buffer Overflow Vulnerability | Multiple Products | 2026-03-20 | High (8.8) | No | Vendor notice |
| CVE-2023-43000Apple Multiple products Use-After-Free Vulnerability | Multiple Products | 2026-03-05 | High (8.8) | No | Vendor notice |
| CVE-2023-41974Apple iOS and iPadOS Use-After-Free Vulnerability | iOS and iPadOS | 2026-03-05 | High (7.8) | No | Vendor notice |
| CVE-2021-30952Apple Multiple Products Integer Overflow or Wraparound Vulnerability | Multiple Products | 2026-03-05 | High (8.8) | No | Vendor notice |
| CVE-2026-20700Apple Multiple Buffer Overflow Vulnerability | Multiple Products | 2026-02-12 | High (7.8) | No | Vendor notice |
| CVE-2025-43529Apple Multiple Products Use-After-Free WebKit Vulnerability | Multiple Products | 2025-12-15 | High (8.8) | No | Vendor notice |
| CVE-2022-48503Apple Multiple Products Unspecified Vulnerability | Multiple Products | 2025-10-20 | High (8.8) | No | Vendor notice |
| CVE-2025-43300Apple iOS, iPadOS, and macOS Out-of-Bounds Write Vulnerability | iOS, iPadOS, and macOS | 2025-08-21 | Critical (10.0) | No | Vendor notice |
| CVE-2025-43200Apple Multiple Products Unspecified Vulnerability | Multiple Products | 2025-06-16 | Medium (4.2) | No | Vendor notice |
| CVE-2025-31201Apple Multiple Products Arbitrary Read and Write Vulnerability | Multiple Products | 2025-04-17 | Critical (9.8) | No | Vendor notice |
| CVE-2025-31200Apple Multiple Products Memory Corruption Vulnerability | Multiple Products | 2025-04-17 | Critical (9.8) | No | Vendor notice |
| CVE-2025-24201Apple Multiple Products WebKit Out-of-Bounds Write Vulnerability | Multiple Products | 2025-03-13 | Critical (10.0) | No | Vendor notice |
| CVE-2025-24200Apple iOS and iPadOS Incorrect Authorization Vulnerability | iOS and iPadOS | 2025-02-12 | Medium (6.1) | No | Vendor notice |
| CVE-2025-24085Apple Multiple Products Use-After-Free Vulnerability | Multiple Products | 2025-01-29 | Critical (10.0) | No | Vendor notice |
| CVE-2024-44309Apple Multiple Products Cross-Site Scripting (XSS) Vulnerability | Multiple Products | 2024-11-21 | Medium (6.3) | No | Vendor notice |
| CVE-2024-44308Apple Multiple Products Code Execution Vulnerability | Multiple Products | 2024-11-21 | High (8.8) | No | Vendor notice |
| CVE-2024-23296Apple Multiple Products Memory Corruption Vulnerability | Multiple Products | 2024-03-06 | High (7.8) | No | Vendor notice |
| CVE-2024-23225Apple Multiple Products Memory Corruption Vulnerability | Multiple Products | 2024-03-06 | High (7.8) | No | Vendor notice |
| CVE-2022-48618Apple Multiple Products Memory Corruption Vulnerability | Multiple Products | 2024-01-31 | High (7.0) | No | Vendor notice |
| CVE-2024-23222Apple Multiple Products WebKit Type Confusion Vulnerability | Multiple Products | 2024-01-23 | High (8.8) | No | Vendor notice |
| CVE-2023-41990Apple Multiple Products Code Execution Vulnerability | Multiple Products | 2024-01-08 | High (7.8) | No | Vendor notice |
| CVE-2023-42917Apple Multiple Products WebKit Memory Corruption Vulnerability | Multiple Products | 2023-12-04 | High (8.8) | No | Vendor notice |
| CVE-2023-42916Apple Multiple Products WebKit Out-of-Bounds Read Vulnerability | Multiple Products | 2023-12-04 | Medium (6.5) | No | Vendor notice |
| CVE-2023-42824Apple iOS and iPadOS Kernel Privilege Escalation Vulnerability | iOS and iPadOS | 2023-10-05 | High (7.8) | No | Vendor notice |
| CVE-2023-41993Apple Multiple Products WebKit Code Execution Vulnerability | Multiple Products | 2023-09-25 | High (8.8) | No | Vendor notice |
| CVE-2023-41992Apple Multiple Products Kernel Privilege Escalation Vulnerability | Multiple Products | 2023-09-25 | High (7.8) | No | Vendor notice |
| CVE-2023-41991Apple Multiple Products Improper Certificate Validation Vulnerability | Multiple Products | 2023-09-25 | Medium (5.5) | No | Vendor notice |
| CVE-2023-41064Apple iOS, iPadOS, and macOS ImageIO Buffer Overflow Vulnerability | iOS, iPadOS, and macOS | 2023-09-11 | High (7.8) | No | Vendor notice |
| CVE-2023-41061Apple iOS, iPadOS, and watchOS Wallet Code Execution Vulnerability | iOS, iPadOS, and watchOS | 2023-09-11 | High (7.8) | No | Vendor notice |
| CVE-2023-38606Apple Multiple Products Kernel Unspecified Vulnerability | Multiple Products | 2023-07-26 | Medium (5.5) | No | Vendor notice |
| CVE-2023-37450Apple Multiple Products WebKit Code Execution Vulnerability | Multiple Products | 2023-07-13 | High (8.8) | No | Vendor notice |
| CVE-2023-32439Apple Multiple Products WebKit Type Confusion Vulnerability | Multiple Products | 2023-06-23 | High (8.8) | No | Vendor notice |
| CVE-2023-32435Apple Multiple Products WebKit Memory Corruption Vulnerability | Multiple Products | 2023-06-23 | High (8.8) | No | Vendor notice |
| CVE-2023-32434Apple Multiple Products Integer Overflow Vulnerability | Multiple Products | 2023-06-23 | High (7.8) | No | Vendor notice |
| CVE-2023-32409Apple Multiple Products WebKit Sandbox Escape Vulnerability | Multiple Products | 2023-05-22 | High (8.6) | No | Vendor notice |
Source: CISA Known Exploited Vulnerabilities catalog, released 2026-11-04. Severity scores are CVSS where available. "Ransomware" means CISA has marked the flaw as known to be used in ransomware campaigns.