By year
99
00
01
02
03
04
05
06
07
08
09
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
Bars are flaws published each year; the red part is the share attackers have used.
Exploited Apple flaws
These are on CISA’s Known Exploited Vulnerabilities list, newest first. If you run any of these products, these come before everything else.
- CVE-2026-86950 Apple Multiple Products Out-of-Bounds WriteExploited since Sep 29, 2026 · CVSS 8.8
- CVE-2026-65400 Apple macOS Improper AuthenticationExploited since Aug 18, 2026 · CVSS 9.8
- CVE-2025-43510 Apple Multiple Products Improper LockingExploited since Mar 20, 2026 · CVSS 7.8
- CVE-2025-31277 Apple Multiple Products Buffer OverflowExploited since Mar 20, 2026 · CVSS 8.8
- CVE-2025-43520 Apple Multiple Products Classic Buffer OverflowExploited since Mar 20, 2026 · CVSS 5.5
- CVE-2023-41974 Apple iOS and iPadOS Use-After-FreeExploited since Mar 5, 2026 · CVSS 7.8
- CVE-2023-43000 Apple Multiple products Use-After-FreeExploited since Mar 5, 2026 · CVSS 8.8
- CVE-2021-30952 Apple Multiple Products Integer Overflow or WraparoundExploited since Mar 5, 2026 · CVSS 7.8
- CVE-2026-20700 Apple Multiple Buffer OverflowExploited since Feb 12, 2026 · CVSS 7.8
- CVE-2025-43529 Apple Multiple Products Use-After-Free WebKitExploited since Dec 15, 2025 · CVSS 8.8
- CVE-2022-48503 Apple Multiple Products UnspecifiedExploited since Oct 20, 2025 · CVSS 8.8
- CVE-2025-43300 Apple iOS, iPadOS, and macOS Out-of-Bounds WriteExploited since Aug 21, 2025 · CVSS 10
- CVE-2025-43200 Apple Multiple Products UnspecifiedExploited since Jun 16, 2025 · CVSS 4.2
- CVE-2025-31200 Apple Multiple Products Memory CorruptionExploited since Apr 17, 2025 · CVSS 9.8
- CVE-2025-31201 Apple Multiple Products Arbitrary Read and WriteExploited since Apr 17, 2025 · CVSS 9.8
- CVE-2025-24201 Apple Multiple Products WebKit Out-of-Bounds WriteExploited since Mar 13, 2025 · CVSS 10
- CVE-2025-24200 Apple iOS and iPadOS Incorrect AuthorizationExploited since Feb 12, 2025 · CVSS 6.1
- CVE-2025-24085 Apple Multiple Products Use-After-FreeExploited since Jan 29, 2025 · CVSS 10
- CVE-2024-44308 Apple Multiple Products Code ExecutionExploited since Nov 21, 2024 · CVSS 8.8
- CVE-2024-44309 Apple Multiple Products Cross-Site Scripting (XSS)Exploited since Nov 21, 2024 · CVSS 6.3
- CVE-2024-23225 Apple Multiple Products Memory CorruptionExploited since Mar 6, 2024 · CVSS 7.8
- CVE-2024-23296 Apple Multiple Products Memory CorruptionExploited since Mar 6, 2024 · CVSS 7.8
- CVE-2022-48618 Apple Multiple Products Memory CorruptionExploited since Jan 31, 2024 · CVSS 7
- CVE-2024-23222 Apple Multiple Products WebKit Type ConfusionExploited since Jan 23, 2024 · CVSS 8.8
- CVE-2023-41990 Apple Multiple Products Code ExecutionExploited since Jan 8, 2024 · CVSS 7.8
- CVE-2023-42916 Apple Multiple Products WebKit Out-of-Bounds ReadExploited since Dec 4, 2023 · CVSS 6.5
- CVE-2023-42917 Apple Multiple Products WebKit Memory CorruptionExploited since Dec 4, 2023 · CVSS 8.8
- CVE-2023-42824 Apple iOS and iPadOS Kernel Privilege EscalationExploited since Oct 5, 2023 · CVSS 7.8
- CVE-2023-41991 Apple Multiple Products Improper Certificate ValidationExploited since Sep 25, 2023 · CVSS 5.5
- CVE-2023-41992 Apple Multiple Products Kernel Privilege EscalationExploited since Sep 25, 2023 · CVSS 7.8
- CVE-2023-41993 Apple Multiple Products WebKit Code ExecutionExploited since Sep 25, 2023 · CVSS 8.8
- CVE-2023-41064 Apple iOS, iPadOS, and macOS ImageIO Buffer OverflowExploited since Sep 11, 2023 · CVSS 7.8
- CVE-2023-41061 Apple iOS, iPadOS, and watchOS Wallet Code ExecutionExploited since Sep 11, 2023 · CVSS 7.8
- CVE-2023-38606 Apple Multiple Products Kernel UnspecifiedExploited since Jul 26, 2023 · CVSS 5.5
- CVE-2023-37450 Apple Multiple Products WebKit Code ExecutionExploited since Jul 13, 2023 · CVSS 8.8
- CVE-2023-32439 Apple Multiple Products WebKit Type ConfusionExploited since Jun 23, 2023 · CVSS 8.8
- CVE-2023-32434 Apple Multiple Products Integer OverflowExploited since Jun 23, 2023 · CVSS 7.8
- CVE-2023-32435 Apple Multiple Products WebKit Memory CorruptionExploited since Jun 23, 2023 · CVSS 8.8
- CVE-2023-32409 Apple Multiple Products WebKit Sandbox EscapeExploited since May 22, 2023 · CVSS 8.6
- CVE-2023-32373 Apple Multiple Products WebKit Use-After-FreeExploited since May 22, 2023 · CVSS 8.8
- CVE-2023-28204 Apple Multiple Products WebKit Out-of-Bounds ReadExploited since May 22, 2023 · CVSS 6.5
- CVE-2019-8526 Apple macOS Use-After-FreeExploited since Apr 17, 2023 · CVSS 7.8
- CVE-2023-28205 Apple Multiple Products WebKit Use-After-FreeExploited since Apr 10, 2023 · CVSS 8.8
- CVE-2023-28206 Apple iOS, iPadOS, and macOS IOSurfaceAccelerator Out-of-Bounds WriteExploited since Apr 10, 2023 · CVSS 8.6
- CVE-2021-30900 Apple iOS, iPadOS, and macOS Out-of-Bounds WriteExploited since Mar 30, 2023 · CVSS 7.8
- CVE-2023-23529 Apple Multiple Products WebKit Type ConfusionExploited since Feb 14, 2023 · CVSS 8.8
- CVE-2022-42856 Apple iOS Type ConfusionExploited since Dec 14, 2022 · CVSS 8.8
- CVE-2022-42827 Apple iOS and iPadOS Out-of-Bounds WriteExploited since Oct 25, 2022 · CVSS 7.8
- CVE-2022-32917 Apple iOS, iPadOS, and macOS Remote Code ExecutionExploited since Sep 14, 2022 · CVSS 7.8
- CVE-2020-9934 Apple iOS, iPadOS, and macOS Input ValidationExploited since Sep 8, 2022 · CVSS 5.5
- CVE-2021-31010 Apple iOS, macOS, watchOS Sandbox BypassExploited since Aug 25, 2022 · CVSS 7.5
- CVE-2022-32893 Apple iOS and macOS Out-of-Bounds WriteExploited since Aug 18, 2022 · CVSS 8.8
- CVE-2022-32894 Apple iOS and macOS Out-of-Bounds WriteExploited since Aug 18, 2022 · CVSS 7.8
- CVE-2020-3837 Apple Multiple Products Memory CorruptionExploited since Jun 27, 2022 · CVSS 7.8
- CVE-2021-30983 Apple iOS and iPadOS Buffer OverflowExploited since Jun 27, 2022 · CVSS 7.8
- CVE-2020-9907 Apple Multiple Products Memory CorruptionExploited since Jun 27, 2022 · CVSS 7.8
- CVE-2018-4344 Apple Multiple Products Memory CorruptionExploited since Jun 27, 2022 · CVSS 7.8
- CVE-2019-8605 Apple Multiple Products Use-After-FreeExploited since Jun 27, 2022 · CVSS 7.8
- CVE-2016-4655 Apple iOS Information DisclosureExploited since May 24, 2022 · CVSS 5.5
- CVE-2016-4657 Apple iOS Webkit Memory CorruptionExploited since May 24, 2022 · CVSS 8.8
Latest high and critical flaws
- CVE-2026-86929 An out-of-bounds write issue was addressed with improved bounds checking.High 8.8 · Oct 26, 2026
- CVE-2026-86916 A use after free issue was addressed with improved memory management.High 7.8 · Oct 26, 2026
- CVE-2026-65327 A logic issue was addressed with improved checks.High 8.4 · Oct 26, 2026
- CVE-2026-64759 An integer overflow was addressed with improved input validation.High 8.8 · Oct 26, 2026
- CVE-2026-113947 This issue was addressed with improved access restrictions.High 8.8 · Oct 26, 2026
- CVE-2026-112688 A memory corruption issue was addressed with improved memory handling.High 8.8 · Oct 26, 2026
- CVE-2026-112659 A type confusion issue was addressed with improved memory handling.High 8.8 · Oct 26, 2026
- CVE-2026-112655 A use-after-free issue was addressed with improved memory management.High 8.8 · Oct 26, 2026
- CVE-2026-112651 A use-after-free issue was addressed with improved memory management.High 8.8 · Oct 26, 2026
- CVE-2026-112637 A use-after-free issue was addressed with improved memory management.High 8.8 · Oct 26, 2026
- CVE-2026-112626 A use-after-free issue was addressed with improved memory management.High 8.8 · Oct 26, 2026
- CVE-2026-112623 A use-after-free issue was addressed with improved memory management.High 8.8 · Oct 26, 2026
- CVE-2026-112484 This issue was addressed with improved file handling.High 7.8 · Oct 26, 2026
- CVE-2026-112457 A double free issue was addressed with improved memory management.High 7.1 · Oct 26, 2026
- CVE-2026-112438 A logic issue was addressed with improved state management.High 8.8 · Oct 26, 2026
- CVE-2026-112427 An authentication issue was addressed with improved state management.High 8.1 · Oct 26, 2026
- CVE-2026-86961 A race condition was addressed with additional validation.High 7.8 · Oct 19, 2026
- CVE-2026-86949 This issue was addressed by enforcing library validation on the affected binaries.High 8.8 · Oct 19, 2026
- CVE-2026-86922 A type confusion issue was addressed with improved state management.High 8.8 · Oct 19, 2026
- CVE-2026-86919 A stack overflow was addressed with improved input validation.High 8.8 · Oct 19, 2026
- CVE-2026-28853 The issue was addressed with improved checks.High 7.8 · Oct 19, 2026
- CVE-2026-86950 Apple Multiple Products Out-of-Bounds WriteExploited · High 8.8 · Sep 28, 2026
- CVE-2026-65388 A remote attacker who controls a container registry may be able to direct a client's token request to a host of the attacker's choice, and disclose the victim'sHigh 7.5 · Sep 16, 2026
- CVE-2026-86917 A permissions issue was addressed with additional restrictions.High 7.8 · Sep 14, 2026
- CVE-2026-86904 A privacy issue was addressed with improved state management.High 7.5 · Sep 14, 2026
Part of our vulnerability database: the whole National Vulnerability Database plus CISA’s exploited list, refreshed twice a day. This is general guidance, not a review of your systems.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.