Class familyApple · iOS, iPadOS, and macOS
Apple iOS and macOS input validation flaws, 2021–2026
72 iOS, iPadOS, and macOS CVEs with CWE-20 weaknesses, 24 Aug 2021 to 26 Oct 2026. 12 are in CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it..
CVEs by year
Published each year. Select a CVE to open it.Grouped by product and weakness type (CWE); not proven to share a root cause.
4 2021’21
14 2022’22
1 2023’23
4 2024’24
20 2025’25
29 2026’26
In CISA KEVNot in KEV
20214 CVEs, 4 in KEV
202214 CVEs, 7 in KEV
20231 CVE, 1 in KEV
20244 CVEs
202520 CVEs
202629 CVEs
- CVE-2026-20643
- CVE-2026-20686
- CVE-2026-28852
- CVE-2026-28894
- CVE-2026-28860
- CVE-2026-28907
- CVE-2026-28917
- CVE-2026-28936
- CVE-2026-39868
- CVE-2026-43708
- CVE-2026-43722
- CVE-2026-43724
- CVE-2026-43725
- CVE-2026-43714
- CVE-2026-43777
- CVE-2026-43793
- CVE-2026-43813
- CVE-2026-64781
- CVE-2026-65336
- CVE-2026-65337
- CVE-2026-65340
- CVE-2026-28960
- CVE-2026-86879
- CVE-2026-86885
- CVE-2026-86924
- CVE-2026-86959
- CVE-2026-86963
- CVE-2026-112658
- CVE-2026-113913
CVEs in this family
Table view of the years above| CVE | Published | Title | Linked from | Priority |
|---|---|---|---|---|
| CVE-2021-30860KEV | 24 Aug 2021 | Apple Multiple Products Integer Overflow Vulnerability | Grouped by weakness | 68.4 |
| CVE-2021-30900KEV | 24 Aug 2021 | Apple iOS, iPadOS, and macOS Out-of-Bounds Write Vulnerability | Grouped by weakness | 62.0 |
| CVE-2021-31010KEV | 24 Aug 2021 | Apple iOS, macOS, watchOS Sandbox Bypass Vulnerability | Grouped by weakness | 61.2 |
| CVE-2021-30663KEV | 8 Sep 2021 | Apple Multiple Products WebKit Integer Overflow Vulnerability | Grouped by weakness | 62.0 |
| CVE-2022-22587KEV | 18 Mar 2022 | Apple Memory Corruption Vulnerability | Grouped by weakness | 64.1 |
| CVE-2022-22674KEV | 26 May 2022 | Apple macOS Out-of-Bounds Read Vulnerability | Grouped by weakness | 54.9 |
| CVE-2022-22675KEV | 26 May 2022 | Apple macOS Out-of-Bounds Write Vulnerability | Grouped by weakness | 62.7 |
| CVE-2022-32893KEV | 24 Aug 2022 | Apple iOS and macOS Out-of-Bounds Write Vulnerability | Grouped by weakness | 63.3 |
| CVE-2022-32894KEV | 24 Aug 2022 | Apple iOS and macOS Out-of-Bounds Write Vulnerability | Grouped by weakness | 61.2 |
| CVE-2022-32917KEV | 20 Sep 2022 | Apple iOS, iPadOS, and macOS Remote Code Execution Vulnerability | Grouped by weakness | 62.0 |
| CVE-2022-26707 | 23 Sep 2022 | An issue in the handling of environment variables was addressed with improved validation | Grouped by weakness | 8.3 |
| CVE-2022-32786 | 23 Sep 2022 | An issue in the handling of environment variables was addressed with improved validation | Grouped by weakness | 21.3 |
| CVE-2022-32797 | 23 Sep 2022 | This issue was addressed with improved checks | Grouped by weakness | 17.9 |
| CVE-2022-22658 | 1 Nov 2022 | An input validation issue was addressed with improved input validation | Grouped by weakness | 16.4 |
| CVE-2022-42800 | 1 Nov 2022 | This issue was addressed with improved checks | Grouped by weakness | 11.9 |
| CVE-2022-42827KEV | 1 Nov 2022 | Apple iOS and iPadOS Out-of-Bounds Write Vulnerability | Grouped by weakness | 56.4 |
| CVE-2022-42837 | 15 Dec 2022 | An issue existed in the parsing of URLs | Grouped by weakness | 58.5 |
| CVE-2022-46701 | 15 Dec 2022 | The issue was addressed with improved bounds checks | Grouped by weakness | 10.9 |
| CVE-2023-41061KEV | 7 Sep 2023 | Apple iOS, iPadOS, and watchOS Wallet Code Execution Vulnerability | Grouped by weakness | 61.7 |
| CVE-2023-40394 | 10 Jan 2024 | The issue was addressed with improved validation of environment variables | Grouped by weakness | 4.4 |
| CVE-2024-23246 | 8 Mar 2024 | This issue was addressed by removing the vulnerable code | Grouped by weakness | 16.2 |
| CVE-2024-23263 | 8 Mar 2024 | A logic issue was addressed with improved validation | Grouped by weakness | 20.5 |
| CVE-2024-27805 | 10 Jun 2024 | An issue was addressed with improved validation of environment variables | Grouped by weakness | 7.1 |
| CVE-2025-30471 | 31 Mar 2025 | A validation issue was addressed with improved logic | Grouped by weakness | 20.1 |
| CVE-2023-42977 | 11 Apr 2025 | A path handling issue was addressed with improved validation | Grouped by weakness | 7.5 |
| CVE-2025-31208 | 12 May 2025 | The issue was addressed with improved checks | Grouped by weakness | 19.6 |
| CVE-2025-31215 | 12 May 2025 | The issue was addressed with improved checks | Grouped by weakness | 14.8 |
| CVE-2025-31217 | 12 May 2025 | The issue was addressed with improved input validation | Grouped by weakness | 15.0 |
| CVE-2025-31233 | 12 May 2025 | The issue was addressed with improved input sanitization | Grouped by weakness | 18.4 |
| CVE-2025-31281 | 29 Jul 2025 | An input validation issue was addressed with improved memory handling | Grouped by weakness | 20.4 |
| CVE-2025-43195 | 29 Jul 2025 | An issue existed in the handling of environment variables | Grouped by weakness | 6.2 |
| CVE-2025-43223 | 29 Jul 2025 | A denial-of-service issue was addressed with improved input validation | Grouped by weakness | 18.0 |
| CVE-2025-43234 | 29 Jul 2025 | Multiple memory corruption issues were addressed with improved input validation | Grouped by weakness | 19.7 |
| CVE-2025-43299 | 15 Sep 2025 | A denial-of-service issue was addressed with improved validation | Grouped by weakness | 6.7 |
| CVE-2025-43342 | 15 Sep 2025 | A correctness issue was addressed with improved checks | Grouped by weakness | 18.0 |
| CVE-2025-43347 | 15 Sep 2025 | This issue was addressed by removing the vulnerable code | Grouped by weakness | 18.9 |
| CVE-2025-43372 | 15 Sep 2025 | The issue was addressed with improved input validation | Grouped by weakness | 13.3 |
| CVE-2025-43365 | 4 Nov 2025 | A denial-of-service issue was addressed with improved input validation | Grouped by weakness | 2.5 |
| CVE-2025-43427 | 4 Nov 2025 | This issue was addressed through improved state management | Grouped by weakness | 12.2 |
| CVE-2025-43430 | 4 Nov 2025 | This issue was addressed through improved state management | Grouped by weakness | 16.1 |
| CVE-2025-43458 | 4 Nov 2025 | This issue was addressed through improved state management | Grouped by weakness | 12.9 |
| CVE-2025-43494 | 12 Dec 2025 | A mail header parsing issue was addressed with improved checks | Grouped by weakness | 14.7 |
| CVE-2025-43533 | 17 Dec 2025 | The issue was addressed with improved bounds checks | Grouped by weakness | 8.6 |
| CVE-2026-20643 | 17 Mar 2026 | A cross-origin issue in the Navigation API was addressed with improved input validation | Grouped by weakness | 14.7 |
| CVE-2026-20686 | 25 Mar 2026 | This issue was addressed with improved input validation | Grouped by weakness | 5.7 |
| CVE-2026-28852 | 25 Mar 2026 | A stack overflow was addressed with improved input validation | Grouped by weakness | 6.4 |
| CVE-2026-28894 | 25 Mar 2026 | A denial-of-service issue was addressed with improved input validation | Grouped by weakness | 15.8 |
| CVE-2026-28860 | 11 May 2026 | The issue was addressed with improved input validation | Grouped by weakness | 11.7 |
| CVE-2026-28907 | 11 May 2026 | The issue was addressed with improved input validation | Grouped by weakness | 10.3 |
| CVE-2026-28917 | 11 May 2026 | The issue was addressed with improved input validation | Grouped by weakness | 7.5 |
| CVE-2026-28936 | 11 May 2026 | The issue was addressed with improved checks | Grouped by weakness | 14.5 |
| CVE-2026-39868 | 29 Jun 2026 | This issue was addressed with improved input validation | Grouped by weakness | 16.9 |
| CVE-2026-43708 | 29 Jun 2026 | The issue was addressed with improved input validation | Grouped by weakness | 9.3 |
| CVE-2026-43722 | 29 Jun 2026 | The issue was addressed with improved input sanitization | Grouped by weakness | 4.7 |
| CVE-2026-43724 | 29 Jun 2026 | The issue was addressed with improved input sanitization | Grouped by weakness | 11.6 |
| CVE-2026-43725 | 29 Jun 2026 | The issue was addressed with improved input validation | Grouped by weakness | 17.0 |
| CVE-2026-43714 | 27 Jul 2026 | The issue was addressed with improved input sanitization | Grouped by weakness | 5.0 |
| CVE-2026-43777 | 27 Jul 2026 | This issue was addressed with improved input validation | Grouped by weakness | 15.9 |
| CVE-2026-43793 | 27 Jul 2026 | An issue existed in the handling of environment variables | Grouped by weakness | 16.5 |
| CVE-2026-43813 | 27 Jul 2026 | A validation issue was addressed with improved input sanitization | Grouped by weakness | 11.2 |
| CVE-2026-64781 | 17 Aug 2026 | The issue was addressed with improved input validation | Grouped by weakness | 12.0 |
| CVE-2026-65336 | 17 Aug 2026 | This issue was addressed through improved state management | Grouped by weakness | 10.9 |
| CVE-2026-65337 | 17 Aug 2026 | This issue was addressed through improved state management | Grouped by weakness | 10.9 |
| CVE-2026-65340 | 17 Aug 2026 | This issue was addressed through improved state management | Grouped by weakness | 10.9 |
| CVE-2026-28960 | 14 Sep 2026 | A denial-of-service issue was addressed with improved validation | Grouped by weakness | 14.0 |
| CVE-2026-86879 | 14 Sep 2026 | A denial-of-service issue was addressed with improved input validation | Grouped by weakness | 11.3 |
| CVE-2026-86885 | 14 Sep 2026 | An input validation issue was addressed with improved input validation | Grouped by weakness | 7.8 |
| CVE-2026-86924 | 14 Sep 2026 | A memory corruption issue was addressed with improved input validation | Grouped by weakness | 4.9 |
| CVE-2026-86959 | 20 Oct 2026 | An input validation issue was addressed with improved input validation | Grouped by weakness | 3.9 |
| CVE-2026-86963 | 20 Oct 2026 | A denial-of-service issue was addressed with improved input validation | Grouped by weakness | 9.7 |
| CVE-2026-112658 | 26 Oct 2026 | This issue was addressed with improved input validation | Grouped by weakness | 4.8 |
| CVE-2026-113913 | 26 Oct 2026 | An input validation issue was addressed with improved input validation | Grouped by weakness | 14.4 |