CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (Oct 29, 2026, 5:10 AM ET)

What this means for you

This week: 3,072 CVEs published, 232 critical, and 3 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 3,072; Show in the list
Critical, last 7 days: 232; Show in the list
Healthcare-tagged, last 7 days: 9; Show in the list
Known exploited (CISA KEV): 1,762; Show in the list

Showing CVEs that name the product apple:iphone_os. Show all products

693 CVEs

Showing 1 to 10.

CVE	Severity	Title	Published
CVE-2013-0340	Medium 6.8	expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of s… Assigned by redhat	Jan 21, 2014
CVE-2014-4404 Known exploited	High 7.8	Heap-based buffer overflow in IOHIDFamily in Apple iOS before 8 and Apple TV before 7 allows attackers to execute arbitrary code in a privileged context via an application that provides crafted key-m… Assigned by apple	Sep 18, 2014
CVE-2016-5131	High 8.8	Use-after-free vulnerability in libxml2 through 2.9.4, as used in Google Chrome before 52.0.2743.82, allows remote attackers to cause a denial of service or possibly have unspecified other impact via… Assigned by Chrome	Jul 23, 2016
CVE-2016-4657 Known exploited	High 8.8	WebKit in Apple iOS before 9.3.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site. Assigned by apple	Aug 25, 2016
CVE-2016-4656 Known exploited	High 7.8	The kernel in Apple iOS before 9.3.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app. Assigned by apple	Aug 25, 2016
CVE-2016-4655 Known exploited	Medium 5.5	The kernel in Apple iOS before 9.3.5 allows attackers to obtain sensitive information from memory via a crafted app. Assigned by apple	Aug 25, 2016
CVE-2016-4658	Critical 9.8	xpointer.c in libxml2 before 2.9.5 (as used in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3, and other products) does not forbid namespace nodes in XPointer ranges, wh… Assigned by apple	Sep 25, 2016
CVE-2016-9841	Critical 9.8	inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic. Assigned by microfocus	May 22, 2017
CVE-2016-9840	High 8.8	inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic. Assigned by microfocus	May 22, 2017
CVE-2019-8906	Medium 4.4	do_core_note in readelf.c in libmagic.a in file 5.35 has an out-of-bounds read because memcpy is misused. Assigned by mitre	Feb 18, 2019

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.