Skip to content
~/pwn.watch_

Get notified

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Only used for pwn.watch incident emails. Protected by Cloudflare Turnstile.

Become a sponsor

One slot: pwn.watch, gifs.so, flavors.design, kitze.io, every kitze repo, and an X shout-out.

YearlyBest value · save 44%$999/year$83.25/mo, billed yearly. Save $789 vs monthly (5+ months free).Monthly$149/monthBilled monthly. Cancel anytime.

Secure checkout on Polar. Right after paying you set up your ad on kitze.io.

iOS

Security incidents tagged iOS. Newest first.

9 iOS incidents in the last 12 months

Critical 4 · High 3 · Med 2 · Low 1 · Update ½LessMore
Incidents
32
Live
3
Patched
31
Days without an incident
0
Longest quiet run: 189 days (May 14–Nov 18)
All tags →

Brought to you byTinkerer Club

The private club for people who own their servers, run their own AI, and pay $0/month for software.

  • ClosedPatched

    Apple Multiple Products: WebKit Pointer Authentication bypass (CVE-2024-27834) added to CISA KEV

    Apple iOS, iPadOS, macOS, Safari, tvOS and watchOS contained an improper authentication issue in WebKit that could let an attacker who already had arbitrary read and write capability bypass Pointer Authentication. Apple fixed it in Safari 17.5, iOS/iPadOS 17.5 and 16.7.8, macOS Sonoma 14.5, tvOS 17.5 and watchOS 10.5 (May 2024). CISA added CVE-2024-27834 to the Known Exploited Vulnerabilities catalog on Nov 4 2026 (due Nov 18 2026) based on evidence of active exploitation.

    Apple Multiple Products (WebKit)Closed Nov 4, 2026

  • LiveHighNo patch yet

    Calif Lockdown Mode bypass on iPhone 18 Pro via malicious AirDrop PDF; jailbreak persists through iOS 27.2

    Research group Calif posted a Nov 3 2026 demo of jailbreaking an iPhone 18 Pro with Lockdown Mode enabled. The video shows a malicious PDF delivered over AirDrop that the user accepts and opens; after that, installing iOS 27.2 leaves the jailbreak in place. Calif has not published technical details, says it is disclosing the bugs to Apple, and says it will not release a public jailbreak tool. It is unclear from the demo whether a device already on iOS 27.2 can be newly compromised. Apple had told TechCrunch earlier that it was not aware of successful mercenary spyware attacks against Lockdown Mode-enabled devices.

    Apple iOS (Lockdown Mode) on iPhone 18 Pro / recent iPhonesSince Nov 3, 2026

  • LivePatched

    Hijacked website tags and Instagram ads deliver Coruna and DarkSword spyware to outdated iPhones

    Report URI and iVerify found criminals using 660+ re-registered expired analytics and ad-tag domains (DeadTag), hacked PrestaShop stores and a malicious Instagram ad to silently serve the Coruna (iOS 13 to 17.2.1) and P7 DarkSword (iOS 18.4 to 18.7) exploit kits. Opening an affected page on a vulnerable iPhone is enough; the spyware steals keychain passwords, crypto wallet data and device info. Updated iPhones are protected, so update iOS (or turn on Lockdown Mode if you can't).

    Apple iOS (Safari/WebKit) on out-of-date iPhonesSince Oct 21, 2026

  • ClosedPatched

    Signal calls can stay live after hang-up (RingRTC CVE-2026-113380)

    A bug in RingRTC, the open-source library behind Signal's voice and video calls, lets the other party on a call flood the call's state-machine event queue so a local hang-up gets stuck behind the backlog, and audio (possibly video) keeps flowing to them after the victim thinks the call ended. Affects every Signal client (Android, iOS, Desktop) embedding RingRTC before 2.72.0. Fixed in RingRTC 2.72.0 (released Sep 4 2026, disclosed Oct 20); a conceptual PoC is public, no known exploitation.

    Signal (RingRTC calling library, @signalapp/ringrtc)Closed Oct 22, 2026

Show 28 older incidents

September 2026 1

  • PatchedApple CoreGraphics zero-day CVE-2026-86950

    Apple iOS, iPadOS, macOS (CoreGraphics)

    Apple patched CVE-2026-86950, an out-of-bounds write in CoreGraphics that may lead to arbitrary code execution, and indicated it may have been exploited in a sophisticated targeted attack against earlier iOS versions. Fixed in iOS/iPadOS 26.7.1 and corresponding macOS updates. CISA added to KEV Sept 29.

    Open incident →CVE-2026-86950

August 2026 1

  • LivePatched

    APT29 watering holes hit outdated iPhones and Android Chrome with zero-click n-day exploit chains

    Sekoia reported a large watering-hole campaign it attributes with moderate to high confidence to Russia's APT29. Hacked legitimate sites in the US, Ukraine, Czech Republic and Bulgaria, lookalike domains proxying real sites (America250, Raffles London at The OWO) and a compromised Plerdy analytics tracker (loaded by thousands of mostly Ukrainian sites, Aug 27 to Sep 3 2026) fingerprinted mobile visitors and served exploit chains with no user interaction. iOS 16.7 got a Safari cookie-stealing chain, iOS 18.5 got the DarkSword kit (WhatsApp and Telegram databases, Keychain, location, photos), and Chrome for Android 139 to 145 got AndroSnitch (cookies, saved logins, history, Wi-Fi passwords). Every bug used is already patched and nothing persists after a reboot, so update iOS and Chrome.

    Apple iOS (Safari/WebKit) and Chrome for AndroidSince Aug 27, 2026

March 2026 1

  • PatchedApple Multiple Products: Apple Multiple Products Improper Locking Vulnerability

    Apple Multiple Products

    Apple watchOS, iOS, iPadOS, macOS, visionOS, and tvOS contain an improper locking vulnerability that could allow a malicious application to cause unexpected changes in memory shared between processes. CISA added CVE-2025-43510, CVE-2025-43520, CVE-2025-31277 to the Known Exploited Vulnerabilities catalog on 2026-03-20 based on evidence of active exploitation.

    Open incident →CVE-2025-43510 · CVE-2025-43520 · CVE-2025-31277

February 2026 1

  • PatchedApple Multiple Products: Apple Multiple Buffer Overflow Vulnerability

    Apple Multiple Products

    Apple iOS, macOS, tvOS, watchOS, and visionOS contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow an attacker with memory write the capability to execute arbitrary code. Added to CISA KEV on 2026-02-12.

    Open incident →CVE-2026-20700

December 2025 1

  • PatchedApple Multiple Products: Multiple Products Use-After-Free WebKit Vulnerability

    Apple Multiple Products

    Apple iOS, iPadOS, macOS, and other Apple products contain a use-after-free vulnerability in WebKit. Processing maliciously crafted web content may lead to memory corruption. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. Added to CISA KEV on 2025-12-15.

    Open incident →CVE-2025-43529

October 2025 1

  • PatchedApple Multiple Products: Multiple Products Unspecified Vulnerability

    Apple Multiple Products

    Apple macOS, iOS, tvOS, Safari, and watchOS contain an unspecified vulnerability in JavaScriptCore that when processing web content may lead to arbitrary code execution. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. Added to CISA KEV on 2025-10-20.

    Open incident →CVE-2022-48503

August 2025 1

  • PatchedApple iOS, iPadOS, and macOS: iOS, iPadOS, and macOS Out-of-Bounds Write Vulnerability

    Apple iOS, iPadOS, and macOS

    Apple iOS, iPadOS, and macOS contain an out-of-bounds write vulnerability in the Image I/O framework. Added to CISA KEV on 2025-08-21.

    Open incident →CVE-2025-43300

June 2025 1

  • PatchedApple Multiple Products: Multiple Products Unspecified Vulnerability

    Apple Multiple Products

    Apple iOS, iPadOS, macOS, watchOS, and visionOS, contain an unspecified vulnerability when processing a maliciously crafted photo or video shared via an iCloud Link. Added to CISA KEV on 2025-06-16.

    Open incident →CVE-2025-43200

April 2025 1

  • PatchedApple Multiple Products: 2 exploited vulnerabilities (CVE-2025-31200, CVE-2025-31201)

    Apple Multiple Products

    CVE-2025-31200: Apple iOS, iPadOS, macOS, and other Apple products contain a memory corruption vulnerability that allows for code execution when processing an audio stream in a maliciously crafted media file. CVE-2025-31201: Apple iOS, iPadOS, macOS, and other Apple products contain an arbitrary read and write vulnerability that allows an attacker to bypass Pointer Authentication. Added to CISA KEV on 2025-04-17.

    Open incident →CVE-2025-31200 · CVE-2025-31201

March 2025 1

  • PatchedApple Multiple Products: Multiple Products WebKit Out-of-Bounds Write Vulnerability

    Apple Multiple Products

    Apple iOS, iPadOS, macOS, and other Apple products contain an out-of-bounds write vulnerability in WebKit that may allow maliciously crafted web content to break out of Web Content sandbox. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. Added to CISA KEV on 2025-03-13.

    Open incident →CVE-2025-24201

February 2025 1

  • PatchedApple iOS and iPadOS: iOS and iPadOS Incorrect Authorization Vulnerability

    Apple iOS and iPadOS

    Apple iOS and iPadOS contains an incorrect authorization vulnerability that allows a physical attacker to disable USB Restricted Mode on a locked device. Added to CISA KEV on 2025-02-12.

    Open incident →CVE-2025-24200

January 2025 1

  • PatchedApple Multiple Products: Multiple Products Use-After-Free Vulnerability

    Apple Multiple Products

    Apple iOS, macOS, and other Apple products contain a user-after-free vulnerability that could allow a malicious application to elevate privileges. Added to CISA KEV on 2025-01-29.

    Open incident →CVE-2025-24085

November 2024 1

  • PatchedApple Multiple Products: 2 actively exploited vulnerabilities

    Apple Multiple Products

    CVE-2024-44308: Apple iOS, macOS, and other Apple products contain an unspecified vulnerability when processing maliciously crafted web content that may lead to arbitrary code execution. CVE-2024-44309: Apple iOS, macOS, and other Apple products contain an unspecified vulnerability when processing maliciously crafted web content that may lead to a cross-site scripting (XSS) attack. Added to the CISA KEV catalog on 2024-11-21.

    Open incident →CVE-2024-44308 · CVE-2024-44309

March 2024 1

  • PatchedApple Multiple Products: 2 actively exploited vulnerabilities

    Apple Multiple Products

    CVE-2024-23225: Apple iOS, iPadOS, macOS, tvOS, watchOS, and visionOS kernel contain a memory corruption vulnerability that allows an attacker with arbitrary kernel read and write capability to bypass kernel memory protections. CVE-2024-23296: Apple iOS, iPadOS, macOS, tvOS, and watchOS RTKit contain a memory corruption vulnerability that allows an attacker with arbitrary kernel read and write capability to bypass kernel memory protections. Added to the CISA KEV catalog on 2024-03-06.

    Open incident →CVE-2024-23225 · CVE-2024-23296

January 2024 3

  • PatchedApple Multiple Products WebKit Type Confusion

    Apple Multiple Products

    Apple iOS, iPadOS, macOS, tvOS, and Safari WebKit contain a type confusion vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. Added to the CISA KEV catalog on 2024-01-23.

    Open incident →CVE-2024-23222
  • PatchedApple Multiple Products Memory Corruption

    Apple Multiple Products

    Apple iOS, iPadOS, macOS, tvOS, and watchOS contain a time-of-check/time-of-use (TOCTOU) memory corruption vulnerability that allows an attacker with read and write capabilities to bypass Pointer Authentication. Added to the CISA KEV catalog on 2024-01-31. CVE-2022-48618 was assigned before 2024; the KEV listing came in 2024.

    Open incident →CVE-2022-48618
  • PatchedApple Multiple Products Code Execution

    Apple Multiple Products

    Apple iOS, iPadOS, macOS, tvOS, and watchOS contain an unspecified vulnerability that allows for code execution when processing a font file. Added to the CISA KEV catalog on 2024-01-08. CVE-2023-41990 was assigned before 2024; the KEV listing came in 2024.

    Open incident →CVE-2023-41990

December 2023 1

  • PatchedApple Multiple Products: 2 exploited vulnerabilities (CVE-2023-42916, CVE-2023-42917)

    Apple Multiple Products

    Apple iOS, iPadOS, macOS, and Safari WebKit contain an out-of-bounds read vulnerability that may disclose sensitive information when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. Apple iOS, iPadOS, macOS, and Safari WebKit contain a memory corruption vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. Added to CISA KEV on 2023-12-04.

    Open incident →CVE-2023-42916 · CVE-2023-42917

October 2023 1

  • PatchedApple iOS and iPadOS: Kernel Privilege Escalation (CVE-2023-42824)

    Apple iOS and iPadOS

    Apple iOS and iPadOS contain an unspecified vulnerability that allows for local privilege escalation. Added to CISA KEV on 2023-10-05.

    Open incident →CVE-2023-42824

September 2023 2

  • PatchedApple Multiple Products: 3 exploited vulnerabilities (CVE-2023-41991, CVE-2023-41992, CVE-2023-41993)

    Apple Multiple Products

    Apple iOS, iPadOS, macOS, and watchOS contain an improper certificate validation vulnerability that can allow a malicious app to bypass signature validation. Apple iOS, iPadOS, macOS, and watchOS contain an unspecified vulnerability that allows for local privilege escalation. Apple iOS, iPadOS, macOS, and Safari WebKit contain an unspecified vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. Added to CISA KEV on 2023-09-25.

    Open incident →CVE-2023-41991 · CVE-2023-41992 · CVE-2023-41993
  • PatchedBLASTPASS: NSO zero-click iPhone exploit chain (CVE-2023-41064, CVE-2023-41061)

    Apple iOS, iPadOS, macOS and watchOS

    Citizen Lab caught BLASTPASS, a zero-click iMessage exploit chain that delivered NSO Group's Pegasus through malicious PassKit attachments carrying images. Apple fixed the ImageIO and Wallet bugs in emergency updates the same day.

    Open incident →CVE-2023-41064 · CVE-2023-41061

July 2023 1

  • PatchedApple Multiple Products: WebKit Code Execution (CVE-2023-37450)

    Apple Multiple Products

    Apple iOS, iPadOS, macOS, and Safari WebKit contain an unspecified vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. Added to CISA KEV on 2023-07-13.

    Open incident →CVE-2023-37450

June 2023 2

  • PatchedApple Multiple Products: WebKit Type Confusion (CVE-2023-32439)

    Apple Multiple Products

    Apple iOS, iPadOS, macOS, and Safari WebKit contain a type confusion vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. Added to CISA KEV on 2023-06-23.

    Open incident →CVE-2023-32439
  • PatchedOperation Triangulation: zero-click iMessage spyware on Kaspersky's iPhones

    Apple iOS (and other Apple OSes sharing the bugs)

    Kaspersky found a years-long zero-click iMessage campaign on its own staff's iPhones. The chain used several Apple zero-days, including a bypass of hardware memory protections through undocumented MMIO registers (CVE-2023-38606), which was revealed at 37C3 in December 2023.

    Open incident →CVE-2023-32434 · CVE-2023-32435 · CVE-2023-38606

May 2023 1

  • PatchedApple Multiple Products: 3 exploited vulnerabilities (CVE-2023-28204, CVE-2023-32373, CVE-2023-32409)

    Apple Multiple Products

    Apple iOS, iPadOS, macOS, tvOS, watchOS, and Safari WebKit contain an out-of-bounds read vulnerability that may disclose sensitive information when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. Apple iOS, iPadOS, macOS, tvOS, watchOS, and Safari WebKit contain a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. Apple iOS, iPadOS, macOS, tvOS, watchOS, and Safari WebKit contain an unspecified vulnerability that can allow a remote attacker to break out of the Web Content sandbox. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. Added to CISA KEV on 2023-05-22.

    Open incident →CVE-2023-28204 · CVE-2023-32373 · CVE-2023-32409

April 2023 2

  • PatchedApple iOS, iPadOS, and macOS: IOSurfaceAccelerator Out-of-Bounds Write (CVE-2023-28206)

    Apple iOS, iPadOS, and macOS

    Apple iOS, iPadOS, and macOS IOSurfaceAccelerator contain an out-of-bounds write vulnerability that allows an app to execute code with kernel privileges. Added to CISA KEV on 2023-04-10.

    Open incident →CVE-2023-28206
  • PatchedApple Multiple Products: WebKit Use-After-Free (CVE-2023-28205)

    Apple Multiple Products

    Apple iOS, iPadOS, macOS, and Safari WebKit contain a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. Added to CISA KEV on 2023-04-10.

    Open incident →CVE-2023-28205

February 2023 1

  • PatchedApple Multiple Products: WebKit Type Confusion (CVE-2023-23529)

    Apple Multiple Products

    Apple iOS, MacOS, Safari and iPadOS WebKit contain a type confusion vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. Added to CISA KEV on 2023-02-14.

    Open incident →CVE-2023-23529

Posts 4

Sponsored

Buy sponsor slot · $149/mo