Apple vulnerabilities
- Apple has 2,529 CVE records published between 28 Oct 2023 and 28 Oct 2026, ranking #7 of 420 vendors on this site by that count.
- Of the 2,201 with a CVSS score, 862 (39.2%) are rated critical or high; 328 (13% of all) have no CVSS score.
- 95 vulnerabilities attributed to Apple are listed in CISA's Known Exploited Vulnerabilities (KEV) catalog; the most recent, CVE-2026-86950, was added on 29 Sep 2026.
- None of them is marked as known to be used in ransomware campaigns.
- For the 95 KEV entries with a published CVE record, the median time from CVE publication to KEV listing is 56 days.
Records are attributed to Apple from the vendor named in the source records. About the data.
CVE records per year
Show data as a table
| Year | CVE records |
|---|---|
| 2017 | 582 |
| 2018 | 178 |
| 2019 | 501 |
| 2020 | 462 |
| 2021 | 561 |
| 2022 | 371 |
| 2023 | 460 |
| 2024 | 592 |
| 2025 | 727 |
| 2026 | 1,175 |
2026 is partial (through 28 Oct 2026), shown in a lighter bar.
| Year | Records | Critical | High | Critical or high | Not scored |
|---|---|---|---|---|---|
| 2026 | 1,175 | 69 | 274 | 39.3% | 25.7% |
| 2025 | 727 | 106 | 179 | 39.2% | 0% |
| 2024 | 592 | 20 | 208 | 38.5% | 0% |
| 2023 | 460 | 9 | 87 | 59.6% | 65% |
| 2022 | 371 | 13 | 127 | 59.3% | 36.4% |
| 2021 | 561 | 2 | 18 | 90.9% | 96.1% |
| 2020 | 462 | 0 | 7 | 63.6% | 97.6% |
| 2019 | 501 | 0 | 8 | 88.9% | 98.2% |
| 2018 | 178 | 0 | 2 | 100% | 98.9% |
| 2017 | 582 | 0 | 0 | 0% | 99.8% |
| Before 2017 | 2,099 | ||||
Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.
Exploited vulnerabilities in CISA's KEV catalog
| CVE | Product | Name | Added | Ransomware |
|---|---|---|---|---|
| CVE-2026-86950 | Multiple Products | Apple Multiple Products Out-of-Bounds Write Vulnerability | 2026-09-29 | Unknown |
| CVE-2026-65400 | macOS | Apple macOS Improper Authentication Vulnerability | 2026-08-18 | Unknown |
| CVE-2025-31277 | Multiple Products | Apple Multiple Products Buffer Overflow Vulnerability | 2026-03-20 | Unknown |
| CVE-2025-43510 | Multiple Products | Apple Multiple Products Improper Locking Vulnerability | 2026-03-20 | Unknown |
| CVE-2025-43520 | Multiple Products | Apple Multiple Products Classic Buffer Overflow Vulnerability | 2026-03-20 | Unknown |
| CVE-2021-30952 | Multiple Products | Apple Multiple Products Integer Overflow or Wraparound Vulnerability | 2026-03-05 | Unknown |
| CVE-2023-41974 | iOS and iPadOS | Apple iOS and iPadOS Use-After-Free Vulnerability | 2026-03-05 | Unknown |
| CVE-2023-43000 | Multiple Products | Apple Multiple products Use-After-Free Vulnerability | 2026-03-05 | Unknown |
| CVE-2026-20700 | Multiple Products | Apple Multiple Buffer Overflow Vulnerability | 2026-02-12 | Unknown |
| CVE-2025-43529 | Multiple Products | Apple Multiple Products Use-After-Free WebKit Vulnerability | 2025-12-15 | Unknown |
| CVE-2022-48503 | Multiple Products | Apple Multiple Products Unspecified Vulnerability | 2025-10-20 | Unknown |
| CVE-2025-43300 | iOS, iPadOS, and macOS | Apple iOS, iPadOS, and macOS Out-of-Bounds Write Vulnerability | 2025-08-21 | Unknown |
| CVE-2025-43200 | Multiple Products | Apple Multiple Products Unspecified Vulnerability | 2025-06-16 | Unknown |
| CVE-2025-31200 | Multiple Products | Apple Multiple Products Memory Corruption Vulnerability | 2025-04-17 | Unknown |
| CVE-2025-31201 | Multiple Products | Apple Multiple Products Arbitrary Read and Write Vulnerability | 2025-04-17 | Unknown |
| CVE-2025-24201 | Multiple Products | Apple Multiple Products WebKit Out-of-Bounds Write Vulnerability | 2025-03-13 | Unknown |
| CVE-2025-24200 | iOS and iPadOS | Apple iOS and iPadOS Incorrect Authorization Vulnerability | 2025-02-12 | Unknown |
| CVE-2025-24085 | Multiple Products | Apple Multiple Products Use-After-Free Vulnerability | 2025-01-29 | Unknown |
| CVE-2024-44308 | Multiple Products | Apple Multiple Products Code Execution Vulnerability | 2024-11-21 | Unknown |
| CVE-2024-44309 | Multiple Products | Apple Multiple Products Cross-Site Scripting (XSS) Vulnerability | 2024-11-21 | Unknown |
| CVE-2024-23225 | Multiple Products | Apple Multiple Products Memory Corruption Vulnerability | 2024-03-06 | Unknown |
| CVE-2024-23296 | Multiple Products | Apple Multiple Products Memory Corruption Vulnerability | 2024-03-06 | Unknown |
| CVE-2022-48618 | Multiple Products | Apple Multiple Products Memory Corruption Vulnerability | 2024-01-31 | Unknown |
| CVE-2024-23222 | Multiple Products | Apple Multiple Products WebKit Type Confusion Vulnerability | 2024-01-23 | Unknown |
| CVE-2023-41990 | Multiple Products | Apple Multiple Products Code Execution Vulnerability | 2024-01-08 | Unknown |
| CVE-2023-42916 | Multiple Products | Apple Multiple Products WebKit Out-of-Bounds Read Vulnerability | 2023-12-04 | Unknown |
| CVE-2023-42917 | Multiple Products | Apple Multiple Products WebKit Memory Corruption Vulnerability | 2023-12-04 | Unknown |
| CVE-2023-42824 | iOS and iPadOS | Apple iOS and iPadOS Kernel Privilege Escalation Vulnerability | 2023-10-05 | Unknown |
| CVE-2023-41991 | Multiple Products | Apple Multiple Products Improper Certificate Validation Vulnerability | 2023-09-25 | Unknown |
| CVE-2023-41992 | Multiple Products | Apple Multiple Products Kernel Privilege Escalation Vulnerability | 2023-09-25 | Unknown |
| CVE-2023-41993 | Multiple Products | Apple Multiple Products WebKit Code Execution Vulnerability | 2023-09-25 | Unknown |
| CVE-2023-41061 | iOS, iPadOS, and watchOS | Apple iOS, iPadOS, and watchOS Wallet Code Execution Vulnerability | 2023-09-11 | Unknown |
| CVE-2023-41064 | iOS, iPadOS, and macOS | Apple iOS, iPadOS, and macOS ImageIO Buffer Overflow Vulnerability | 2023-09-11 | Unknown |
| CVE-2023-38606 | Multiple Products | Apple Multiple Products Kernel Unspecified Vulnerability | 2023-07-26 | Unknown |
| CVE-2023-37450 | Multiple Products | Apple Multiple Products WebKit Code Execution Vulnerability | 2023-07-13 | Unknown |
| CVE-2023-32434 | Multiple Products | Apple Multiple Products Integer Overflow Vulnerability | 2023-06-23 | Unknown |
| CVE-2023-32435 | Multiple Products | Apple Multiple Products WebKit Memory Corruption Vulnerability | 2023-06-23 | Unknown |
| CVE-2023-32439 | Multiple Products | Apple Multiple Products WebKit Type Confusion Vulnerability | 2023-06-23 | Unknown |
| CVE-2023-28204 | Multiple Products | Apple Multiple Products WebKit Out-of-Bounds Read Vulnerability | 2023-05-22 | Unknown |
| CVE-2023-32373 | Multiple Products | Apple Multiple Products WebKit Use-After-Free Vulnerability | 2023-05-22 | Unknown |
| CVE-2023-32409 | Multiple Products | Apple Multiple Products WebKit Sandbox Escape Vulnerability | 2023-05-22 | Unknown |
| CVE-2019-8526 | macOS | Apple macOS Use-After-Free Vulnerability | 2023-04-17 | Unknown |
| CVE-2023-28205 | Multiple Products | Apple Multiple Products WebKit Use-After-Free Vulnerability | 2023-04-10 | Unknown |
| CVE-2023-28206 | iOS, iPadOS, and macOS | Apple iOS, iPadOS, and macOS IOSurfaceAccelerator Out-of-Bounds Write Vulnerability | 2023-04-10 | Unknown |
| CVE-2021-30900 | iOS, iPadOS, and macOS | Apple iOS, iPadOS, and macOS Out-of-Bounds Write Vulnerability | 2023-03-30 | Unknown |
| CVE-2023-23529 | Multiple Products | Apple Multiple Products WebKit Type Confusion Vulnerability | 2023-02-14 | Unknown |
| CVE-2022-42856 | iOS | Apple iOS Type Confusion Vulnerability | 2022-12-14 | Unknown |
| CVE-2022-42827 | iOS and iPadOS | Apple iOS and iPadOS Out-of-Bounds Write Vulnerability | 2022-10-25 | Unknown |
| CVE-2022-32917 | iOS, iPadOS, and macOS | Apple iOS, iPadOS, and macOS Remote Code Execution Vulnerability | 2022-09-14 | Unknown |
| CVE-2020-9934 | iOS, iPadOS, and macOS | Apple iOS, iPadOS, and macOS Input Validation Vulnerability | 2022-09-08 | Unknown |
| CVE-2021-31010 | iOS, macOS, watchOS | Apple iOS, macOS, watchOS Sandbox Bypass Vulnerability | 2022-08-25 | Unknown |
| CVE-2022-32893 | iOS and macOS | Apple iOS and macOS Out-of-Bounds Write Vulnerability | 2022-08-18 | Unknown |
| CVE-2022-32894 | iOS and macOS | Apple iOS and macOS Out-of-Bounds Write Vulnerability | 2022-08-18 | Unknown |
| CVE-2018-4344 | Multiple Products | Apple Multiple Products Memory Corruption Vulnerability | 2022-06-27 | Unknown |
| CVE-2019-8605 | Multiple Products | Apple Multiple Products Use-After-Free Vulnerability | 2022-06-27 | Unknown |
| CVE-2020-3837 | Multiple Products | Apple Multiple Products Memory Corruption Vulnerability | 2022-06-27 | Unknown |
| CVE-2020-9907 | Multiple Products | Apple Multiple Products Memory Corruption Vulnerability | 2022-06-27 | Unknown |
| CVE-2021-30983 | iOS and iPadOS | Apple iOS and iPadOS Buffer Overflow Vulnerability | 2022-06-27 | Unknown |
| CVE-2016-4655 | iOS | Apple iOS Information Disclosure Vulnerability | 2022-05-24 | Unknown |
| CVE-2016-4656 | iOS | Apple iOS Memory Corruption Vulnerability | 2022-05-24 | Unknown |
| CVE-2016-4657 | iOS | Apple iOS Webkit Memory Corruption Vulnerability | 2022-05-24 | Unknown |
| CVE-2019-7286 | Multiple Products | Apple Multiple Products Memory Corruption Vulnerability | 2022-05-23 | Unknown |
| CVE-2019-7287 | iOS | Apple iOS Memory Corruption Vulnerability | 2022-05-23 | Unknown |
| CVE-2021-30883 | Multiple Products | Apple Multiple Products Memory Corruption Vulnerability | 2022-05-23 | Unknown |
| CVE-2019-8506 | Multiple Products | Apple Multiple Products Type Confusion Vulnerability | 2022-05-04 | Unknown |
| CVE-2021-1789 | Multiple Products | Apple Multiple Products Type Confusion Vulnerability | 2022-05-04 | Unknown |
| CVE-2022-22674 | macOS | Apple macOS Out-of-Bounds Read Vulnerability | 2022-04-04 | Unknown |
| CVE-2022-22675 | macOS | Apple macOS Out-of-Bounds Write Vulnerability | 2022-04-04 | Unknown |
| CVE-2022-22620 | iOS, iPadOS, and macOS | Apple iOS, iPadOS, and macOS Webkit Use-After-Free Vulnerability | 2022-02-11 | Unknown |
| CVE-2014-4404 | OS X | Apple OS X Heap-Based Buffer Overflow Vulnerability | 2022-02-10 | Unknown |
| CVE-2015-1130 | OS X | Apple OS X Authentication Bypass Vulnerability | 2022-02-10 | Unknown |
| CVE-2022-22587 | iOS and macOS | Apple Memory Corruption Vulnerability | 2022-01-28 | Unknown |
| CVE-2019-6223 | iOS and macOS | Apple iOS and macOS Group Facetime Vulnerability | 2021-11-03 | Unknown |
| CVE-2020-27930 | Multiple Products | Apple Multiple Products Memory Corruption Vulnerability | 2021-11-03 | Unknown |
| CVE-2020-27932 | Multiple Products | Apple Multiple Products Type Confusion Vulnerability | 2021-11-03 | Unknown |
| CVE-2020-27950 | Multiple Products | Apple Multiple Products Memory Initialization Vulnerability | 2021-11-03 | Unknown |
| CVE-2020-9818 | iOS, iPadOS, and watchOS | Apple iOS, iPadOS, and watchOS Out-of-Bounds Write Vulnerability | 2021-11-03 | Unknown |
| CVE-2020-9819 | iOS, iPadOS, and watchOS | Apple iOS, iPadOS, and watchOS Memory Corruption Vulnerability | 2021-11-03 | Unknown |
| CVE-2020-9859 | Multiple Products | Apple Multiple Products Code Execution Vulnerability | 2021-11-03 | Unknown |
| CVE-2021-1782 | Multiple Products | Apple Multiple Products Race Condition Vulnerability | 2021-11-03 | Unknown |
| CVE-2021-1870 | iOS, iPadOS, and macOS | Apple iOS, iPadOS, and macOS WebKit Remote Code Execution Vulnerability | 2021-11-03 | Unknown |
| CVE-2021-1871 | iOS, iPadOS, and macOS | Apple iOS, iPadOS, and macOS WebKit Remote Code Execution Vulnerability | 2021-11-03 | Unknown |
| CVE-2021-1879 | iOS, iPadOS, and watchOS | Apple iOS, iPadOS, and watchOS WebKit Cross-Site Scripting (XSS) Vulnerability | 2021-11-03 | Unknown |
| CVE-2021-30657 | macOS | Apple macOS Unspecified Vulnerability | 2021-11-03 | Unknown |
| CVE-2021-30661 | Multiple Products | Apple Multiple Products WebKit Storage Use-After-Free Vulnerability | 2021-11-03 | Unknown |
| CVE-2021-30663 | Multiple Products | Apple Multiple Products WebKit Integer Overflow Vulnerability | 2021-11-03 | Unknown |
| CVE-2021-30665 | Multiple Products | Apple Multiple Products WebKit Memory Corruption Vulnerability | 2021-11-03 | Unknown |
| CVE-2021-30666 | iOS | Apple iOS WebKit Buffer Overflow Vulnerability | 2021-11-03 | Unknown |
| CVE-2021-30713 | macOS | Apple macOS Unspecified Vulnerability | 2021-11-03 | Unknown |
| CVE-2021-30761 | iOS | Apple iOS WebKit Memory Corruption Vulnerability | 2021-11-03 | Unknown |
| CVE-2021-30762 | iOS | Apple iOS WebKit Use-After-Free Vulnerability | 2021-11-03 | Unknown |
| CVE-2021-30807 | Multiple Products | Apple Multiple Products Memory Corruption Vulnerability | 2021-11-03 | Unknown |
| CVE-2021-30858 | iOS, iPadOS, and macOS | Apple iOS, iPadOS, macOS Use-After-Free Vulnerability | 2021-11-03 | Unknown |
| CVE-2021-30860 | Multiple Products | Apple Multiple Products Integer Overflow Vulnerability | 2021-11-03 | Unknown |
| CVE-2021-30869 | iOS, iPadOS, and macOS | Apple iOS, iPadOS, and macOS Type Confusion Vulnerability | 2021-11-03 | Unknown |
Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.27, as of 27 Oct 2026. About the data.
Highest exploit-prediction scores (EPSS)
EPSS estimates the probability that a vulnerability is exploited in the next 30 days. These are the 10 highest-scoring Apple records today.
| CVE | EPSS | Percentile | Severity | In KEV |
|---|---|---|---|---|
| CVE-2020-9850 | 77.4% | 99.6% | Not scored | No |
| CVE-2021-30860 | 76% | 99.5% | High | Yes |
| CVE-2019-8900 | 69.5% | 99.4% | Medium | No |
| CVE-2021-30657 | 68.5% | 99.3% | Medium | Yes |
| CVE-2016-4657 | 66.8% | 99.3% | High | Yes |
| CVE-2025-43300 | 65.2% | 99.3% | Critical | Yes |
| CVE-2010-1807 | 61.3% | 99.2% | Not scored | No |
| CVE-2011-0257 | 60.1% | 99.1% | Not scored | No |
| CVE-2018-4233 | 53.8% | 99% | High | No |
| CVE-2023-41064 | 53.4% | 99% | High | Yes |
Source: FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of 28 Oct 2026; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026; CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.27, as of 27 Oct 2026. About the data.
Related vendors
Vendors named on the same CVE records as Apple.
- Canonical (2 shared records)