IO
Operating System
iOS
On CISA KEVExploited in the wildRansomware-linked
4,331
CVEs
93
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 215High 272Medium 13Low 0
Watch
Add iOS to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2017-7110 | 9.8 | Oct 23 | An issue was discovered in certain Apple products Affected: through 10.3.3 |
| CVE-2017-7108 | 9.8 | Oct 23 | An issue was discovered in certain Apple products Affected: through 10.3.3 |
| CVE-2017-7105 | 9.8 | Oct 23 | An issue was discovered in certain Apple products Affected: through 10.3.3 |
| CVE-2017-7103 | 9.8 | Oct 23 | An issue was discovered in certain Apple products Affected: through 10.3.3 |
| CVE-2017-11121 | 9.8 | Sep 28 | On Broadcom BCM4355C0 Wi-Fi chips 9.44.78.27.0.1.56 and other chips, properly crafted malicious over-the-air Fast Transition frames can potentially trigger internal Wi-Fi firmware… Affected: before 11.0 |
| CVE-2017-11120 | 9.8 | Sep 28 | On Broadcom BCM4355C0 Wi-Fi chips 9.44.78.27.0.1.56 and other chips, an attacker can craft a malformed RRM neighbor report frame to trigger an internal buffer overflow in the… Affected: before 11.0 |
| CVE-2017-8248 | 9.8 | Aug 16 | A buffer overflow may occur in the processing of a downlink NAS message in Qualcomm Telephony as used in Apple iPhone 5 and later, iPad 4th generation and later, iPod touch 6th… Affected: through 10.3.2 |
| CVE-2017-7062 | 9.8 | Jul 20 | An issue was discovered in certain Apple products Affected: through 10.3.2 |
| CVE-2016-9843 | 9.8 | May 23 | The crc32_big function in crc32.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving big-endian CRC calculation Affected: before 11 |
| CVE-2016-9841 | 9.8 | May 23 | inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic Affected: before 11 |
| CVE-2017-2524 | 9.8 | May 22 | An issue was discovered in certain Apple products Affected: before 10.3.2 |
| CVE-2017-2523 | 9.8 | May 22 | An issue was discovered in certain Apple products Affected: before 10.3.2 |
| CVE-2017-2522 | 9.8 | May 22 | An issue was discovered in certain Apple products Affected: before 10.3.2 |
| CVE-2017-2520 | 9.8 | May 22 | An issue was discovered in certain Apple products Affected: before 10.3.2 |
| CVE-2017-2519 | 9.8 | May 22 | An issue was discovered in certain Apple products Affected: before 10.3.2 |
| CVE-2017-2518 | 9.8 | May 22 | An issue was discovered in certain Apple products Affected: before 10.3.2 |
| CVE-2017-2513 | 9.8 | May 22 | An issue was discovered in certain Apple products Affected: through 10.3.1 |
| CVE-2017-2434 | 9.8 | Apr 2 | An issue was discovered in certain Apple products Affected: through 10.2.1 |
| CVE-2017-2428 | 9.8 | Apr 2 | An issue was discovered in certain Apple products Affected: through 10.2.1 |
| CVE-2017-2423 | 9.8 | Apr 2 | An issue was discovered in certain Apple products Affected: through 10.2.1 |
| CVE-2016-7663 | 9.8 | Feb 20 | An issue was discovered in certain Apple products Affected: through 10.1.1 |
| CVE-2016-7630 | 9.8 | Feb 20 | An issue was discovered in certain Apple products Affected: through 10.1.1 |
| CVE-2016-4702 | 9.8 | Sep 25 | Audio in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 allows remote attackers to execute arbitrary code or cause a denial of service (memory… Affected: before 10.0 |
| CVE-2016-4658 | 9.8 | Sep 25 | xpointer.c in libxml2 before 2.9.5 (as used in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3, and other products) does not forbid namespace nodes in… Affected: before 10.0 |
| CVE-2016-4616 | 9.8 | Jul 22 | libxml2 in Apple iOS before 9.3.3, OS X before 10.11.6, iTunes before 12.4.2 on Windows, iCloud before 5.2.1 on Windows, tvOS before 9.2.2, and watchOS before 2.2.2 allows remote… Affected: before 9.3.3 |
| CVE-2016-4615 | 9.8 | Jul 22 | libxml2 in Apple iOS before 9.3.3, OS X before 10.11.6, iTunes before 12.4.2 on Windows, iCloud before 5.2.1 on Windows, tvOS before 9.2.2, and watchOS before 2.2.2 allows remote… Affected: before 9.3.3 |
| CVE-2016-4614 | 9.8 | Jul 22 | libxml2 in Apple iOS before 9.3.3, OS X before 10.11.6, iTunes before 12.4.2 on Windows, iCloud before 5.2.1 on Windows, tvOS before 9.2.2, and watchOS before 2.2.2 allows remote… Affected: before 9.3.3 |
| CVE-2016-4609 | 9.8 | Jul 22 | libxslt in Apple iOS before 9.3.3, OS X before 10.11.6, iTunes before 12.4.2 on Windows, iCloud before 5.2.1 on Windows, tvOS before 9.2.2, and watchOS before 2.2.2 allows remote… Affected: before 9.3.3 |
| CVE-2016-4607 | 9.8 | Jul 22 | libxslt in Apple iOS before 9.3.3, OS X before 10.11.6, iTunes before 12.4.2 on Windows, iCloud before 5.2.1 on Windows, tvOS before 9.2.2, and watchOS before 2.2.2 allows remote… Affected: before 9.3.3 |
| CVE-2015-7988 | 9.8 | Jun 26 | The handle_regservice_request function in mDNSResponder before 625.41.2 allows remote attackers to execute arbitrary code or cause a denial of service (NULL pointer dereference)… Affected: 9.0 before 9.1 |
| CVE-2015-7987 | 9.8 | Jun 26 | Multiple buffer overflows in mDNSResponder before 625.41.2 allow remote attackers to read or write to out-of-bounds memory locations via vectors involving the (1)… Affected: 9.0 before 9.1 |
| CVE-2016-4448 | 9.8 | Jun 9 | Format string vulnerability in libxml2 before 2.9.4 allows attackers to have unspecified impact via format string specifiers in unknown vectors Affected: through 9.3.2 |
| CVE-2016-1761 | 9.8 | Mar 24 | libxml2 in Apple iOS before 9.3, OS X before 10.11.4, and watchOS before 2.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via… Affected: through 9.2.1 |
| CVE-2016-0801 | 9.8 | Feb 7 | The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01 allows remote attackers to execute arbitrary code or cause… Affected: through 9.2.1 |
| CVE-2010-1205 | 9.8 | Jun 30 | Buffer overflow in pngpread.c in libpng before 1.2.44 and 1.4.x before 1.4.3, as used in progressive applications, might allow remote attackers to execute arbitrary code via a PNG… Affected: 2.0 through 4.1 |
| CVE-2008-3612 | 9.8 | Sep 11 | The Networking subsystem in Apple iPod touch 2.0 through 2.0.2, and iPhone 2.0 through 2.0.2, uses predictable TCP initial sequence numbers, which allows remote attackers to spoof… Affected: 2.0.0 through 2.0.2 |
| CVE-2024-40867 | 9.6 | Oct 28 | A custom URL scheme handling issue was addressed with improved input validation Affected: before 18.1 |
| CVE-2024-4558 | 9.6 | May 7 | Use after free in ANGLE in Google Chrome prior to 124.0.6367.155 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page Affected: before 17.6 |
| CVE-2019-8617 | 9.6 | Dec 18 | An access issue was addressed with additional sandbox restrictions Affected: before 12.3 |
| CVE-2019-8562 | 9.6 | Dec 18 | A memory corruption issue was addressed with improved validation Affected: before 12.2 |
| CVE-2016-4734 | 9.6 | Sep 25 | WebKit in Apple iOS before 10, Safari before 10, and tvOS before 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a… Affected: before 10.0 |
| CVE-2026-64740 | 9.3 | Jul 27 | A parsing issue in the handling of directory paths was addressed with improved path validation Affected: before 26.6 |
| CVE-2026-20688 | 9.3 | Mar 25 | A path handling issue was addressed with improved validation Affected: before 26.4 |
| CVE-2024-44206 | 9.3 | Oct 24 | An issue in the handling of URL protocols was addressed with improved logic Affected: before 17.6 |
| CVE-2026-84625 | 9.1 | Sep 14 | A permissions issue was addressed with additional sandbox restrictions Affected: before 27.0 |
| CVE-2026-86881 | 9.1 | Sep 14 | A certificate validation issue was addressed with improved certificate validation Affected: before 26.7 |
| CVE-2026-39868 | 9.1 | Jun 29 | This issue was addressed with improved input validation Affected: before 26.5.2 |
| CVE-2025-31229 | 9.1 | Jul 29 | A logic issue was addressed with improved checks Affected: before 18.6 |
| CVE-2025-31281 | 9.1 | Jul 29 | An input validation issue was addressed with improved memory handling Affected: before 18.6 |
| CVE-2025-30436 | 9.1 | May 12 | This issue was addressed by restricting options offered on a locked device Affected: before 18.4 |
The 500 most important CVEs for this product (exploited first, then by severity)