Vendor
Apple vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 1,828 vulnerabilities in Apple: 8 in the last 7 days and 801 in the last 90 days, 171 of them critical and 120 exploited in the wild. The most recent, CVE-2026-113970, was published on 9 November 2026. 403 vulnerabilities in the last four weeks, up 53% on the four before (263). 1 critical against 15, 1 exploited in the wild against 1. 17 technologies have a page of their own.
- Last 7 days
- 8
- Last 90 days
- 801
- Critical, all time
- 171
- Exploited in the wild
- 120
About Apple
American multinational technology company that designs and manufactures consumer electronics and software products.
Apple technologies
Latest Apple vulnerabilities
- CVE-2026-113970: Apple Bluetooth use-after-free vulnerabilityhighCVSS 8.8
- CVE-2026-113969: Apple iOS, iPadOS, macOS, and related platforms rate limit bypass in AirPlay pairinginfoEPSS 0.2%
- CVE-2026-113968: Apple iOS and iPadOS Bluetooth pairing code rate limit bypassmediumCVSS 5.4EPSS 0.3%
- CVE-2026-113965: Apple iOS/iPadOS Bluetooth pairing bypassmediumCVSS 5.4EPSS 0.3%
- CVE-2026-113964: Apple iOS and iPadOS Bluetooth pairing rate limit bypass in CoreUtilsmediumCVSS 5.4EPSS 0.3%
- CVE-2026-113963: Apple App Intents authorization issue in iOS, iPadOS, visionOS, watchOSmediumCVSS 5.5EPSS 0.1%
- CVE-2026-113961: Apple Messages authorization bypass in iMessage group chathighCVSS 7.5EPSS 0.6%
- CVE-2026-113960: Apple Messages message history disclosure in group chatsinfoEPSS 0.2%
- CVE-2024-27834: Apple iOS, iPadOS, macOS, Safari, tvOS, watchOS pointer authentication bypasscriticalexploited in the wildEPSS 0.6%
- CVE-2026-112605: Apple Xcode symlink handling arbitrary file readinfo
- CVE-2026-112602: Apple Xcode Instruments authorization issueinfo
- CVE-2026-113957: Apple Container digest verification bypass in image pullinfo
- CVE-2026-86983: Swift Crypto P-384 VOPRF denial of service via unbounded input lengthinfo
- CVE-2026-86992: Apple AppleAVD out-of-bounds write in video processinginfo
- CVE-2026-86991: Apple Accelerate Framework buffer overflow in image processinginfo
- CVE-2026-86990: Apple CoreMedia access issue in camera permission bypassinfo
- CVE-2026-86989: Apple iOS authorization issue in App Storeinfo
- CVE-2026-86988: Apple iOS image processing memory disclosureinfo
- CVE-2026-86987: Apple iOS authorization issue in Apple Intelligenceinfo
- CVE-2026-86986: Safari use-after-free in memory managementinfo
- CVE-2026-86985: Apple Safari input validation vulnerabilityinfo
- CVE-2026-86984: Apple macOS file access issue in home folder filesinfo
- CVE-2026-86974: Apple Safari and OS type confusion in WebContent processinginfo
- CVE-2026-86973: Apple Safari out-of-bounds read in web content processinginfo
- CVE-2026-86972: Apple iOS and iPadOS buffer overflow in audio processinginfo
Most severe Apple vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2025-20393: Cisco Secure Email Gateway command injection in Spam Quarantinecriticalexploited in the wildCVSS 10EPSS 5.0%
- CVE-2025-43300: Apple iOS, iPadOS, and macOS out-of-bounds write in Image I/Ocriticalexploited in the wildCVSS 10EPSS 4.5%
- CVE-2025-24201: Apple Multiple Products WebKit Out-of-Bounds Write Vulnerabilitycriticalexploited in the wildCVSS 10
- CVE-2025-24085: Apple Multiple Products Use-After-Free Vulnerabilitycriticalexploited in the wildCVSS 10
- CVE-2022-22536: SAP Multiple Products HTTP Request Smuggling Vulnerabilitycriticalexploited in the wildCVSS 10
- CVE-2017-7921: Hikvision IP Cameras improper authenticationcriticalexploited in the wildCVSS 9.8EPSS 94.2%
- CVE-2010-3765: Mozilla Multiple Products memory corruption in nsCSSFrameConstructorcriticalexploited in the wildCVSS 9.8EPSS 86.6%
- CVE-2021-22681: Rockwell Automation Logix Designer authentication bypass in Logix Controllerscriticalexploited in the wildCVSS 9.8EPSS 18.2%
- CVE-2025-59718: Fortinet Multiple Products auth bypass via improper SAML signature verificationcriticalexploited in the wildCVSS 9.8EPSS 9.5%
- CVE-2025-10585: Google Chrome type confusion in V8 enginecriticalexploited in the wildCVSS 9.8EPSS 5.4%
Vulnerabilities per week
403 vulnerabilities in the last four weeks, up 53% on the four before (263). 1 critical against 15, 1 exploited in the wild against 1. The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 39 | 2 | |
| 24 Aug 2026 | 25 | 8 | |
| 31 Aug 2026 | 18 | 1 | |
| 7 Sep 2026 | 45 | 5 | |
| 14 Sep 2026 | 252 | 8 | |
| 21 Sep 2026 | 10 | 6 | |
| 28 Sep 2026 | 1 | 1 | |
| 5 Oct 2026 | 0 | 0 | |
| 12 Oct 2026 | 33 | 0 | |
| 19 Oct 2026 | 47 | 0 | |
| 26 Oct 2026 | 322 | 0 | |
| 2 Nov 2026 | 1 | 1 | |
| 9 Nov 2026 | 8 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many Apple vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/vendors/apple)<a href="https://junglewise.ai/threats/vendors/apple"><img src="https://junglewise.ai/threats/vendors/apple/badge.svg" alt="Apple vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/vendors/apple.json, and this page as text at https://junglewise.ai/threats/vendors/apple.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Apple vulnerabilities", https://junglewise.ai/threats/vendors/apple, 13 November 2026.