Class familyApple · Multiple Products
Apple iOS and macOS cross-site scripting flaws, 2021–2026
18 Multiple Products CVEs with CWE-79 weaknesses, 2 Apr 2021 to 14 Sep 2026. 2 are in CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it..
CVEs by year
Published each year. Select a CVE to open it.Grouped by product and weakness type (CWE); not proven to share a root cause.
1 2021’21
1 2022’22
2023’23
6 2024’24
7 2025’25
3 2026’26
In CISA KEVNot in KEV
20211 CVE, 1 in KEV
20221 CVE
20246 CVEs, 1 in KEV
20257 CVEs
20263 CVEs
CVEs in this family
Table view of the years above| CVE | Published | Title | Linked from | Priority |
|---|---|---|---|---|
| CVE-2021-1879KEV | 2 Apr 2021 | Apple iOS, iPadOS, and watchOS WebKit Cross-Site Scripting (XSS) Vulnerability | Grouped by weakness | 61.1 |
| CVE-2022-32923 | 1 Nov 2022 | A correctness issue in the JIT was addressed with improved checks | Grouped by weakness | 18.0 |
| CVE-2024-27838 | 10 Jun 2024 | The issue was addressed by adding additional logic | Grouped by weakness | 15.4 |
| CVE-2024-40785 | 29 Jul 2024 | This issue was addressed with improved checks | Grouped by weakness | 15.5 |
| CVE-2024-40845 | 16 Sep 2024 | The issue was addressed with improved memory handling | Grouped by weakness | 10.1 |
| CVE-2024-40846 | 16 Sep 2024 | The issue was addressed with improved memory handling | Grouped by weakness | 13.6 |
| CVE-2024-40857 | 16 Sep 2024 | This issue was addressed through improved state management | Grouped by weakness | 13.5 |
| CVE-2024-44309KEV | 20 Nov 2024 | Apple Multiple Products Cross-Site Scripting (XSS) Vulnerability | Grouped by weakness | 61.9 |
| CVE-2025-24158 | 27 Jan 2025 | The issue was addressed with improved memory handling | Grouped by weakness | 18.9 |
| CVE-2025-24208 | 31 Mar 2025 | A permissions issue was addressed with additional restrictions | Grouped by weakness | 13.8 |
| CVE-2025-30434 | 31 Mar 2025 | The issue was addressed with improved input sanitization | Grouped by weakness | 7.3 |
| CVE-2025-24225 | 12 May 2025 | An injection issue was addressed with improved input validation | Grouped by weakness | 13.4 |
| CVE-2025-43229 | 29 Jul 2025 | This issue was addressed through improved state management | Grouped by weakness | 9.9 |
| CVE-2025-43338 | 4 Nov 2025 | An out-of-bounds access issue was addressed with improved bounds checking | Grouped by weakness | 8.6 |
| CVE-2025-43440 | 4 Nov 2025 | This issue was addressed with improved checks | Grouped by weakness | 13.2 |
| CVE-2026-28861 | 25 Mar 2026 | A logic issue was addressed with improved state management | Grouped by weakness | 8.1 |
| CVE-2026-28871 | 25 Mar 2026 | A logic issue was addressed with improved checks | Grouped by weakness | 7.3 |
| CVE-2026-86898 | 14 Sep 2026 | A logic issue was addressed with improved state management | Grouped by weakness | 9.4 |