Apple Known Exploited Vulnerabilities
Evidence-backed KEV intelligence for Apple products — CISA KEV status, confidence, sensor telemetry, and virtual-patch availability.
Total KEVs
96
In CISA KEV
95
Beyond CISA KEV
1
Sensor Observed
0
Virtual Patch Available
0
Apple KEVs Added by Year
96 Apple KEVs added all time (primary attestation date).
Attested CVEs
| CVE | Product | Confidence | CISA KEV | Added |
|---|---|---|---|---|
|
CVE-2021-30762
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 12.5.4. Processing maliciously crafted web content... |
iOS | Confirmed | In CISA | 03 Nov 2021 |
|
CVE-2020-9819
A memory consumption issue was addressed with improved memory handling. This issue is fixed in iOS 13.5 and iPadOS 13.5, iOS 12.4.7, watchOS 6.2.5,... |
iOS, iOS-1, watchOS, watchOS-1 | Confirmed | In CISA | 03 Nov 2021 |
|
CVE-2020-9818
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 13.5 and iPadOS 13.5, iOS 12.4.7, watchOS... |
iOS, iOS-1, watchOS | Confirmed | In CISA | 03 Nov 2021 |
|
CVE-2020-27932
A type confusion issue was addressed with improved state handling. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.1, iOS 12.4.9, watchOS... |
watchOS, iOS and iPadOS, macOS | Confirmed | In CISA | 03 Nov 2021 |
|
CVE-2020-27950
A memory initialization issue was addressed. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.1, iOS 12.4.9, watchOS 6.2.9, Security Update... |
watchOS, iOS and iPadOS, macOS | Confirmed | In CISA | 03 Nov 2021 |
|
CVE-2021-30807
A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Big Sur 11.5.1, iOS 14.7.1 and iPadOS 14.7.1,... |
macOS | Confirmed | In CISA | 03 Nov 2021 |
|
CVE-2020-27930
A memory corruption issue was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.1, iOS 12.4.9,... |
watchOS, iOS and iPadOS, macOS | Confirmed | In CISA | 03 Nov 2021 |
|
CVE-2021-30860
An integer overflow was addressed with improved input validation. This issue is fixed in Security Update 2021-005 Catalina, iOS 14.8 and iPadOS... |
macOS, watchOS, iOS | Confirmed | In CISA | 03 Nov 2021 |
|
CVE-2019-6223
A logic issue existed in the handling of Group FaceTime calls. The issue was addressed with improved state management. This issue is fixed in iOS... |
iOS, macOS | Confirmed | In CISA | 03 Nov 2021 |
|
CVE-2021-30858
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6.... |
macOS, iOS | Confirmed | In CISA | 03 Nov 2021 |
|
CVE-2022-22587
A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 15.3 and iPadOS 15.3, macOS Big Sur 11.6.3,... |
iOS and iPadOS, macOS | Confirmed | In CISA | 28 Jan 2022 |
|
CVE-2014-4404
Heap-based buffer overflow in IOHIDFamily in Apple iOS before 8 and Apple TV before 7 allows attackers to execute arbitrary code in a privileged... |
iOS, Apple TV | Confirmed | In CISA | 10 Feb 2022 |
|
CVE-2015-1130
The XPC implementation in Admin Framework in Apple OS X before 10.10.3 allows local users to bypass authentication and obtain admin privileges via... |
OS X | Confirmed | In CISA | 10 Feb 2022 |
|
CVE-2022-22620
A use after free issue was addressed with improved memory management. This issue is fixed in macOS Monterey 12.2.1, iOS 15.3.1 and iPadOS 15.3.1,... |
Safari (v and ), macOS | Confirmed | In CISA | 11 Feb 2022 |
|
CVE-2022-22674
An out-of-bounds read issue existed that led to the disclosure of kernel memory. This was addressed with improved input validation. This issue is... |
macOS | Confirmed | In CISA | 04 Apr 2022 |
|
CVE-2022-22675
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in tvOS 15.5, watchOS 8.6, macOS Big Sur 11.6.6,... |
iOS and iPadOS, macOS, watchOS | Confirmed | In CISA | 04 Apr 2022 |
|
CVE-2019-8506
A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, watchOS 5.2, Safari 12.1, iTunes... |
iOS, tvOS, watchOS, Safari, iTunes for Windows, iCloud for Windows | Confirmed | In CISA | 04 May 2022 |
|
CVE-2021-1789
A type confusion issue was addressed with improved state handling. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina,... |
iOS and iPadOS, macOS | Confirmed | In CISA | 04 May 2022 |
|
CVE-2019-8720
A vulnerability was found in WebKit. The flaw is triggered when processing maliciously crafted web content that may lead to arbitrary code... |
webkitgtk | Confirmed | In CISA | 23 May 2022 |
|
CVE-2019-7287
A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 12.1.4. An application may be able to execute... |
iOS | Confirmed | In CISA | 23 May 2022 |
|
CVE-2019-7286
A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 12.1.4, macOS Mojave 10.14.3 Supplemental... |
iOS, macOS | Confirmed | In CISA | 23 May 2022 |
|
CVE-2021-30883
A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 15.0.2 and iPadOS 15.0.2, macOS Monterey 12.0.1,... |
iOS and iPadOS, macOS | Confirmed | In CISA | 23 May 2022 |
|
CVE-2016-4657
WebKit in Apple iOS before 9.3.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted... |
iOS | Confirmed | In CISA | 24 May 2022 |
|
CVE-2016-4656
The kernel in Apple iOS before 9.3.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory... |
iOS | Confirmed | In CISA | 24 May 2022 |
|
CVE-2016-4655
The kernel in Apple iOS before 9.3.5 allows attackers to obtain sensitive information from memory via a crafted app. |
iOS | Confirmed | In CISA | 24 May 2022 |
Common Vulnerability Classes (CWE)
- CWE-787 — Out-of-bounds Write 28
- CWE-416 — Use After Free 12
- CWE-843 — Access of Resource Using Incompatible Type ('Type Confusion') 8
- CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer 6
- CWE-120 — Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') 4
- CWE-190 — Integer Overflow or Wraparound 4
- CWE-125 — Out-of-bounds Read 3
- CWE-667 — Improper Locking 2
Browse all known exploited vulnerabilities · What is a known exploited vulnerability? · Methodology