Login Request a demo
IO
Operating System
iOS
by Apple · last CVE Sep 28, 2026
On CISA KEVExploited in the wildRansomware-linked
4,331
CVEs
93
On KEV
10.0
Max CVSS
0
New 30D
Vulnerabilities4,331In the news12Timeline
Severity mix
Critical 215High 272Medium 13Low 0
Severity
All severities500Critical215High272Medium13Low0
Exploitation
On CISA KEV93Exploited in the wild93
Watch

Add iOS to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2017-2518
9.8
5%
May 22
An issue was discovered in certain Apple products
Affected: before 10.3.2
CVE-2017-2513
9.8
3%
May 22
An issue was discovered in certain Apple products
Affected: through 10.3.1
CVE-2017-2434
9.8
2%
Apr 2
An issue was discovered in certain Apple products
Affected: through 10.2.1
CVE-2017-2428
9.8
3%
Apr 2
An issue was discovered in certain Apple products
Affected: through 10.2.1
CVE-2017-2423
9.8
2%
Apr 2
An issue was discovered in certain Apple products
Affected: through 10.2.1
CVE-2016-7663
9.8
3%
Feb 20
An issue was discovered in certain Apple products
Affected: through 10.1.1
CVE-2016-7630
9.8
1%
Feb 20
An issue was discovered in certain Apple products
Affected: through 10.1.1
CVE-2016-4702
9.8
6%
Sep 25
Audio in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 allows remote attackers to execute arbitrary code or cause a denial of service (memory…
Affected: before 10.0
CVE-2016-4658
9.8
9%
Sep 25
xpointer.c in libxml2 before 2.9.5 (as used in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3, and other products) does not forbid namespace nodes in…
Affected: before 10.0
CVE-2016-4616
9.8
3%
Jul 22
libxml2 in Apple iOS before 9.3.3, OS X before 10.11.6, iTunes before 12.4.2 on Windows, iCloud before 5.2.1 on Windows, tvOS before 9.2.2, and watchOS before 2.2.2 allows remote…
Affected: before 9.3.3
CVE-2016-4615
9.8
3%
Jul 22
libxml2 in Apple iOS before 9.3.3, OS X before 10.11.6, iTunes before 12.4.2 on Windows, iCloud before 5.2.1 on Windows, tvOS before 9.2.2, and watchOS before 2.2.2 allows remote…
Affected: before 9.3.3
CVE-2016-4614
9.8
3%
Jul 22
libxml2 in Apple iOS before 9.3.3, OS X before 10.11.6, iTunes before 12.4.2 on Windows, iCloud before 5.2.1 on Windows, tvOS before 9.2.2, and watchOS before 2.2.2 allows remote…
Affected: before 9.3.3
CVE-2016-4609
9.8
5%
Jul 22
libxslt in Apple iOS before 9.3.3, OS X before 10.11.6, iTunes before 12.4.2 on Windows, iCloud before 5.2.1 on Windows, tvOS before 9.2.2, and watchOS before 2.2.2 allows remote…
Affected: before 9.3.3
CVE-2016-4607
9.8
5%
Jul 22
libxslt in Apple iOS before 9.3.3, OS X before 10.11.6, iTunes before 12.4.2 on Windows, iCloud before 5.2.1 on Windows, tvOS before 9.2.2, and watchOS before 2.2.2 allows remote…
Affected: before 9.3.3
CVE-2015-7988
9.8
5%
Jun 26
The handle_regservice_request function in mDNSResponder before 625.41.2 allows remote attackers to execute arbitrary code or cause a denial of service (NULL pointer dereference)…
Affected: 9.0 before 9.1
CVE-2015-7987
9.8
3%
Jun 26
Multiple buffer overflows in mDNSResponder before 625.41.2 allow remote attackers to read or write to out-of-bounds memory locations via vectors involving the (1)…
Affected: 9.0 before 9.1
CVE-2016-4448
9.8
7%
Jun 9
Format string vulnerability in libxml2 before 2.9.4 allows attackers to have unspecified impact via format string specifiers in unknown vectors
Affected: through 9.3.2
CVE-2016-1761
9.8
7%
Mar 24
libxml2 in Apple iOS before 9.3, OS X before 10.11.4, and watchOS before 2.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via…
Affected: through 9.2.1
CVE-2016-0801
9.8
33%
Feb 7
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01 allows remote attackers to execute arbitrary code or cause…
Affected: through 9.2.1
CVE-2010-1205
9.8
43%
Jun 30
Buffer overflow in pngpread.c in libpng before 1.2.44 and 1.4.x before 1.4.3, as used in progressive applications, might allow remote attackers to execute arbitrary code via a PNG…
Affected: 2.0 through 4.1
CVE-2008-3612
9.8
4%
Sep 11
The Networking subsystem in Apple iPod touch 2.0 through 2.0.2, and iPhone 2.0 through 2.0.2, uses predictable TCP initial sequence numbers, which allows remote attackers to spoof…
Affected: 2.0.0 through 2.0.2
CVE-2024-40867
9.6
1%
Oct 28
A custom URL scheme handling issue was addressed with improved input validation
Affected: before 18.1
CVE-2024-4558
9.6
2%
May 7
Use after free in ANGLE in Google Chrome prior to 124.0.6367.155 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page
Affected: before 17.6
CVE-2019-8617
9.6
1%
Dec 18
An access issue was addressed with additional sandbox restrictions
Affected: before 12.3
CVE-2019-8562
9.6
1%
Dec 18
A memory corruption issue was addressed with improved validation
Affected: before 12.2
CVE-2016-4734
9.6
3%
Sep 25
WebKit in Apple iOS before 10, Safari before 10, and tvOS before 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a…
Affected: before 10.0
CVE-2026-64740
9.3
0%
Jul 27
A parsing issue in the handling of directory paths was addressed with improved path validation
Affected: before 26.6
CVE-2026-20688
9.3
0%
Mar 25
A path handling issue was addressed with improved validation
Affected: before 26.4
CVE-2024-44206
9.3
0%
Oct 24
An issue in the handling of URL protocols was addressed with improved logic
Affected: before 17.6
CVE-2026-84625
9.1
0%
Sep 14
A permissions issue was addressed with additional sandbox restrictions
Affected: before 27.0
CVE-2026-86881
9.1
0%
Sep 14
A certificate validation issue was addressed with improved certificate validation
Affected: before 26.7
CVE-2026-39868
9.1
1%
Jun 29
This issue was addressed with improved input validation
Affected: before 26.5.2
CVE-2025-31229
9.1
1%
Jul 29
A logic issue was addressed with improved checks
Affected: before 18.6
CVE-2025-31281
9.1
1%
Jul 29
An input validation issue was addressed with improved memory handling
Affected: before 18.6
CVE-2025-30436
9.1
0%
May 12
This issue was addressed by restricting options offered on a locked device
Affected: before 18.4
CVE-2025-30448
9.1
1%
May 12
This issue was addressed with additional entitlement checks
Affected: before 17.7.7
CVE-2024-54542
9.1
1%
Jan 27
An authentication issue was addressed with improved state management
Affected: before 18.2
CVE-2024-54512
9.1
0%
Jan 27
The issue was addressed by removing the relevant flags
Affected: before 18.2
CVE-2024-54530
9.1
1%
Jan 27
The issue was addressed with improved checks
Affected: before 18.2
CVE-2025-24154
9.1
1%
Jan 27
An out-of-bounds write was addressed with improved input validation
Affected: before 18.3
CVE-2024-44217
9.1
0%
Oct 28
A permissions issue was addressed by removing vulnerable code and adding additional checks
Affected: before 18.0
CVE-2022-32847
9.1
4%
Sep 23
This issue was addressed with improved checks
Affected: before 15.6
CVE-2021-30925
9.1
1%
Aug 24
The issue was addressed with improved permissions logic
Affected: before 15.0
CVE-2020-36331
9.1
2%
May 21
A flaw was found in libwebp in versions before 1.0.1
Affected: before 14.7
CVE-2020-36330
9.1
2%
May 21
A flaw was found in libwebp in versions before 1.0.1
Affected: before 14.7
CVE-2020-9920
9.1
2%
Oct 22
A path handling issue was addressed with improved validation
Affected: before 13.6
CVE-2020-9906
9.1
5%
Oct 22
A memory corruption issue was addressed with improved input validation
Affected: before 13.6
CVE-2020-9868
9.1
1%
Oct 22
A certificate validation issue existed when processing administrator added certificates
Affected: before 13.6
CVE-2019-8527
9.1
3%
Dec 18
A buffer overflow was addressed with improved size validation
Affected: before 12.2
CVE-2026-20677
9.0
0%
Feb 11
A race condition was addressed with improved handling of symbolic links
Affected: before 18.7.5; 26.0 before 26.3
Page 6 of 10 · 500 total
1…567…10
The 500 most important CVEs for this product (exploited first, then by severity)