{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-22T16:53:33.742Z",
  "tag": {
    "id": "ios",
    "label": "iOS",
    "isStack": false,
    "url": "https://pwn.watch/t/ios",
    "feed": "https://pwn.watch/t/ios/feed.xml"
  },
  "counts": {
    "incidents": 28,
    "live": 0,
    "notFullyPatched": 0,
    "patched": 28
  },
  "incidents": [
    {
      "slug": "signal-ringrtc-cve-2026-113380",
      "title": "Signal calls can stay live after hang-up (RingRTC CVE-2026-113380)",
      "url": "https://pwn.watch/i/signal-ringrtc-cve-2026-113380",
      "json": "https://pwn.watch/i/signal-ringrtc-cve-2026-113380.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Signal (RingRTC calling library, @signalapp/ringrtc)",
      "tags": [
        "rust",
        "npm",
        "ios",
        "android",
        "signal"
      ],
      "cveIds": [
        "CVE-2026-113380"
      ],
      "affectedVersions": [
        "RingRTC before 2.72.0 (Signal Android, iOS and Desktop clients embedding it)"
      ],
      "fixedVersions": [
        "RingRTC 2.72.0 (update Signal on every device)"
      ],
      "startedAt": "2026-10-20",
      "closedAt": "2026-10-22T18:00:43+02:00",
      "updatedAt": "2026-10-22T18:00:43+02:00",
      "summary": "A bug in RingRTC, the open-source library behind Signal's voice and video calls, lets the other party on a call flood the call's state-machine event queue so a local hang-up gets stuck behind the backlog, and audio (possibly video) keeps flowing to them after the victim thinks the call ended. Affects every Signal client (Android, iOS, Desktop) embedding RingRTC before 2.72.0. Fixed in RingRTC 2.72.0 (released Sep 4 2026, disclosed Oct 20); a conceptual PoC is public, no known exploitation.",
      "xPost": null
    },
    {
      "slug": "apple-coregraphics-cve-2026-86950",
      "title": "Apple CoreGraphics zero-day CVE-2026-86950",
      "url": "https://pwn.watch/i/apple-coregraphics-cve-2026-86950",
      "json": "https://pwn.watch/i/apple-coregraphics-cve-2026-86950.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Apple iOS, iPadOS, macOS (CoreGraphics)",
      "tags": [
        "apple",
        "ios",
        "macos",
        "zero-day",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2026-86950"
      ],
      "affectedVersions": [
        "Before iOS/iPadOS 26.7.1 and matching macOS security updates"
      ],
      "fixedVersions": [
        "iOS/iPadOS 26.7.1",
        "macOS security updates per Apple HT149226/149228/149229"
      ],
      "startedAt": "2026-09-29",
      "closedAt": "2026-09-29",
      "updatedAt": "2026-09-29",
      "summary": "Apple patched CVE-2026-86950, an out-of-bounds write in CoreGraphics that may lead to arbitrary code execution, and indicated it may have been exploited in a sophisticated targeted attack against earlier iOS versions. Fixed in iOS/iPadOS 26.7.1 and corresponding macOS updates. CISA added to KEV Sept 29.",
      "xPost": null
    },
    {
      "slug": "apple-multiple-products-cve-2025-43510",
      "title": "Apple Multiple Products: Apple Multiple Products Improper Locking Vulnerability",
      "url": "https://pwn.watch/i/apple-multiple-products-cve-2025-43510",
      "json": "https://pwn.watch/i/apple-multiple-products-cve-2025-43510.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Apple Multiple Products",
      "tags": [
        "apple",
        "ios",
        "macos",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2025-43510",
        "CVE-2025-43520",
        "CVE-2025-31277"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-03-20",
      "closedAt": "2026-03-20",
      "updatedAt": "2026-03-20",
      "summary": "Apple watchOS, iOS, iPadOS, macOS, visionOS, and tvOS contain an improper locking vulnerability that could allow a malicious application to cause unexpected changes in memory shared between processes. CISA added CVE-2025-43510, CVE-2025-43520, CVE-2025-31277 to the Known Exploited Vulnerabilities catalog on 2026-03-20 based on evidence of active exploitation.",
      "xPost": null
    },
    {
      "slug": "apple-multiple-products-cve-2026-20700",
      "title": "Apple Multiple Products: Apple Multiple Buffer Overflow Vulnerability",
      "url": "https://pwn.watch/i/apple-multiple-products-cve-2026-20700",
      "json": "https://pwn.watch/i/apple-multiple-products-cve-2026-20700.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Apple Multiple Products",
      "tags": [
        "apple",
        "ios",
        "macos",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2026-20700"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-02-12",
      "closedAt": "2026-02-12",
      "updatedAt": "2026-02-12",
      "summary": "Apple iOS, macOS, tvOS, watchOS, and visionOS contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow an attacker with memory write the capability to execute arbitrary code. Added to CISA KEV on 2026-02-12.",
      "xPost": null
    },
    {
      "slug": "apple-multiple-products-cve-2025-43529",
      "title": "Apple Multiple Products: Multiple Products Use-After-Free WebKit Vulnerability",
      "url": "https://pwn.watch/i/apple-multiple-products-cve-2025-43529",
      "json": "https://pwn.watch/i/apple-multiple-products-cve-2025-43529.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Apple Multiple Products",
      "tags": [
        "apple",
        "ios",
        "macos",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2025-43529"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2025-12-15",
      "closedAt": "2025-12-15",
      "updatedAt": "2025-12-15",
      "summary": "Apple iOS, iPadOS, macOS, and other Apple products contain a use-after-free vulnerability in WebKit. Processing maliciously crafted web content may lead to memory corruption. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. Added to CISA KEV on 2025-12-15.",
      "xPost": null
    },
    {
      "slug": "apple-multiple-products-cve-2022-48503",
      "title": "Apple Multiple Products: Multiple Products Unspecified Vulnerability",
      "url": "https://pwn.watch/i/apple-multiple-products-cve-2022-48503",
      "json": "https://pwn.watch/i/apple-multiple-products-cve-2022-48503.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Apple Multiple Products",
      "tags": [
        "apple",
        "ios",
        "macos",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2022-48503"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2025-10-20",
      "closedAt": "2025-10-20",
      "updatedAt": "2025-10-20",
      "summary": "Apple macOS, iOS, tvOS, Safari, and watchOS contain an unspecified vulnerability in JavaScriptCore that when processing web content may lead to arbitrary code execution. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. Added to CISA KEV on 2025-10-20.",
      "xPost": null
    },
    {
      "slug": "apple-ios-ipados-and-macos-cve-2025-43300",
      "title": "Apple iOS, iPadOS, and macOS: iOS, iPadOS, and macOS Out-of-Bounds Write Vulnerability",
      "url": "https://pwn.watch/i/apple-ios-ipados-and-macos-cve-2025-43300",
      "json": "https://pwn.watch/i/apple-ios-ipados-and-macos-cve-2025-43300.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Apple iOS, iPadOS, and macOS",
      "tags": [
        "apple",
        "ios",
        "macos",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2025-43300"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2025-08-21",
      "closedAt": "2025-08-21",
      "updatedAt": "2025-08-21",
      "summary": "Apple iOS, iPadOS, and macOS contain an out-of-bounds write vulnerability in the Image I/O framework. Added to CISA KEV on 2025-08-21.",
      "xPost": null
    },
    {
      "slug": "apple-multiple-products-cve-2025-43200",
      "title": "Apple Multiple Products: Multiple Products Unspecified Vulnerability",
      "url": "https://pwn.watch/i/apple-multiple-products-cve-2025-43200",
      "json": "https://pwn.watch/i/apple-multiple-products-cve-2025-43200.json",
      "status": "closed",
      "severity": "medium",
      "patchStatus": "patched",
      "product": "Apple Multiple Products",
      "tags": [
        "apple",
        "ios",
        "macos",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2025-43200"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2025-06-16",
      "closedAt": "2025-06-16",
      "updatedAt": "2025-06-16",
      "summary": "Apple iOS, iPadOS, macOS, watchOS, and visionOS, contain an unspecified vulnerability when processing a maliciously crafted photo or video shared via an iCloud Link. Added to CISA KEV on 2025-06-16.",
      "xPost": null
    },
    {
      "slug": "apple-multiple-products-cve-2025-31200",
      "title": "Apple Multiple Products: 2 exploited vulnerabilities (CVE-2025-31200, CVE-2025-31201)",
      "url": "https://pwn.watch/i/apple-multiple-products-cve-2025-31200",
      "json": "https://pwn.watch/i/apple-multiple-products-cve-2025-31200.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Apple Multiple Products",
      "tags": [
        "apple",
        "ios",
        "macos",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2025-31200",
        "CVE-2025-31201"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2025-04-17",
      "closedAt": "2025-04-17",
      "updatedAt": "2025-04-17",
      "summary": "CVE-2025-31200: Apple iOS, iPadOS, macOS, and other Apple products contain a memory corruption vulnerability that allows for code execution when processing an audio stream in a maliciously crafted media file. CVE-2025-31201: Apple iOS, iPadOS, macOS, and other Apple products contain an arbitrary read and write vulnerability that allows an attacker to bypass Pointer Authentication. Added to CISA KEV on 2025-04-17.",
      "xPost": null
    },
    {
      "slug": "apple-multiple-products-cve-2025-24201",
      "title": "Apple Multiple Products: Multiple Products WebKit Out-of-Bounds Write Vulnerability",
      "url": "https://pwn.watch/i/apple-multiple-products-cve-2025-24201",
      "json": "https://pwn.watch/i/apple-multiple-products-cve-2025-24201.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Apple Multiple Products",
      "tags": [
        "apple",
        "ios",
        "macos",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2025-24201"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2025-03-13",
      "closedAt": "2025-03-13",
      "updatedAt": "2025-03-13",
      "summary": "Apple iOS, iPadOS, macOS, and other Apple products contain an out-of-bounds write vulnerability in WebKit that may allow maliciously crafted web content to break out of Web Content sandbox. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. Added to CISA KEV on 2025-03-13.",
      "xPost": null
    },
    {
      "slug": "apple-ios-and-ipados-cve-2025-24200",
      "title": "Apple iOS and iPadOS: iOS and iPadOS Incorrect Authorization Vulnerability",
      "url": "https://pwn.watch/i/apple-ios-and-ipados-cve-2025-24200",
      "json": "https://pwn.watch/i/apple-ios-and-ipados-cve-2025-24200.json",
      "status": "closed",
      "severity": "medium",
      "patchStatus": "patched",
      "product": "Apple iOS and iPadOS",
      "tags": [
        "apple",
        "ios",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2025-24200"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2025-02-12",
      "closedAt": "2025-02-12",
      "updatedAt": "2025-02-12",
      "summary": "Apple iOS and iPadOS contains an incorrect authorization vulnerability that allows a physical attacker to disable USB Restricted Mode on a locked device. Added to CISA KEV on 2025-02-12.",
      "xPost": null
    },
    {
      "slug": "apple-multiple-products-cve-2025-24085",
      "title": "Apple Multiple Products: Multiple Products Use-After-Free Vulnerability",
      "url": "https://pwn.watch/i/apple-multiple-products-cve-2025-24085",
      "json": "https://pwn.watch/i/apple-multiple-products-cve-2025-24085.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Apple Multiple Products",
      "tags": [
        "apple",
        "ios",
        "macos",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2025-24085"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2025-01-29",
      "closedAt": "2025-01-29",
      "updatedAt": "2025-01-29",
      "summary": "Apple iOS, macOS, and other Apple products contain a user-after-free vulnerability that could allow a malicious application to elevate privileges. Added to CISA KEV on 2025-01-29.",
      "xPost": null
    },
    {
      "slug": "apple-multiple-products-cve-2024-44308-44309",
      "title": "Apple Multiple Products: 2 actively exploited vulnerabilities",
      "url": "https://pwn.watch/i/apple-multiple-products-cve-2024-44308-44309",
      "json": "https://pwn.watch/i/apple-multiple-products-cve-2024-44308-44309.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Apple Multiple Products",
      "tags": [
        "apple",
        "cisa-kev",
        "ios",
        "macos"
      ],
      "cveIds": [
        "CVE-2024-44308",
        "CVE-2024-44309"
      ],
      "affectedVersions": [
        "See vendor advisory (versions are not listed in the KEV record)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2024-11-19",
      "closedAt": "2024-11-21",
      "updatedAt": "2024-11-21",
      "summary": "CVE-2024-44308: Apple iOS, macOS, and other Apple products contain an unspecified vulnerability when processing maliciously crafted web content that may lead to arbitrary code execution. CVE-2024-44309: Apple iOS, macOS, and other Apple products contain an unspecified vulnerability when processing maliciously crafted web content that may lead to a cross-site scripting (XSS) attack. Added to the CISA KEV catalog on 2024-11-21.",
      "xPost": null
    },
    {
      "slug": "apple-multiple-products-cve-2024-23225-23296",
      "title": "Apple Multiple Products: 2 actively exploited vulnerabilities",
      "url": "https://pwn.watch/i/apple-multiple-products-cve-2024-23225-23296",
      "json": "https://pwn.watch/i/apple-multiple-products-cve-2024-23225-23296.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Apple Multiple Products",
      "tags": [
        "apple",
        "cisa-kev",
        "ios",
        "macos"
      ],
      "cveIds": [
        "CVE-2024-23225",
        "CVE-2024-23296"
      ],
      "affectedVersions": [
        "See vendor advisory (versions are not listed in the KEV record)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2024-03-05",
      "closedAt": "2024-03-06",
      "updatedAt": "2024-03-06",
      "summary": "CVE-2024-23225: Apple iOS, iPadOS, macOS, tvOS, watchOS, and visionOS kernel contain a memory corruption vulnerability that allows an attacker with arbitrary kernel read and write capability to bypass kernel memory protections. CVE-2024-23296: Apple iOS, iPadOS, macOS, tvOS, and watchOS RTKit contain a memory corruption vulnerability that allows an attacker with arbitrary kernel read and write capability to bypass kernel memory protections. Added to the CISA KEV catalog on 2024-03-06.",
      "xPost": null
    },
    {
      "slug": "apple-multiple-products-cve-2024-23222",
      "title": "Apple Multiple Products WebKit Type Confusion",
      "url": "https://pwn.watch/i/apple-multiple-products-cve-2024-23222",
      "json": "https://pwn.watch/i/apple-multiple-products-cve-2024-23222.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Apple Multiple Products",
      "tags": [
        "apple",
        "cisa-kev",
        "ios",
        "macos"
      ],
      "cveIds": [
        "CVE-2024-23222"
      ],
      "affectedVersions": [
        "See vendor advisory (versions are not listed in the KEV record)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2024-01-23",
      "closedAt": "2024-01-23",
      "updatedAt": "2024-01-23",
      "summary": "Apple iOS, iPadOS, macOS, tvOS, and Safari WebKit contain a type confusion vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. Added to the CISA KEV catalog on 2024-01-23.",
      "xPost": null
    },
    {
      "slug": "apple-multiple-products-cve-2022-48618",
      "title": "Apple Multiple Products Memory Corruption",
      "url": "https://pwn.watch/i/apple-multiple-products-cve-2022-48618",
      "json": "https://pwn.watch/i/apple-multiple-products-cve-2022-48618.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Apple Multiple Products",
      "tags": [
        "apple",
        "cisa-kev",
        "ios",
        "macos"
      ],
      "cveIds": [
        "CVE-2022-48618"
      ],
      "affectedVersions": [
        "See vendor advisory (versions are not listed in the KEV record)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2024-01-09",
      "closedAt": "2024-01-31",
      "updatedAt": "2024-01-31",
      "summary": "Apple iOS, iPadOS, macOS, tvOS, and watchOS contain a time-of-check/time-of-use (TOCTOU) memory corruption vulnerability that allows an attacker with read and write capabilities to bypass Pointer Authentication. Added to the CISA KEV catalog on 2024-01-31. CVE-2022-48618 was assigned before 2024; the KEV listing came in 2024.",
      "xPost": null
    },
    {
      "slug": "apple-multiple-products-cve-2023-41990",
      "title": "Apple Multiple Products Code Execution",
      "url": "https://pwn.watch/i/apple-multiple-products-cve-2023-41990",
      "json": "https://pwn.watch/i/apple-multiple-products-cve-2023-41990.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Apple Multiple Products",
      "tags": [
        "apple",
        "cisa-kev",
        "ios",
        "macos"
      ],
      "cveIds": [
        "CVE-2023-41990"
      ],
      "affectedVersions": [
        "See vendor advisory (versions are not listed in the KEV record)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2024-01-08",
      "closedAt": "2024-01-08",
      "updatedAt": "2024-01-08",
      "summary": "Apple iOS, iPadOS, macOS, tvOS, and watchOS contain an unspecified vulnerability that allows for code execution when processing a font file. Added to the CISA KEV catalog on 2024-01-08. CVE-2023-41990 was assigned before 2024; the KEV listing came in 2024.",
      "xPost": null
    },
    {
      "slug": "apple-multiple-products-cve-2023-42916-42917",
      "title": "Apple Multiple Products: 2 exploited vulnerabilities (CVE-2023-42916, CVE-2023-42917)",
      "url": "https://pwn.watch/i/apple-multiple-products-cve-2023-42916-42917",
      "json": "https://pwn.watch/i/apple-multiple-products-cve-2023-42916-42917.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Apple Multiple Products",
      "tags": [
        "apple",
        "ios",
        "macos",
        "cisa-kev",
        "safari",
        "webkit"
      ],
      "cveIds": [
        "CVE-2023-42916",
        "CVE-2023-42917"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2023-12-04",
      "closedAt": "2023-12-04",
      "updatedAt": "2023-12-04",
      "summary": "Apple iOS, iPadOS, macOS, and Safari WebKit contain an out-of-bounds read vulnerability that may disclose sensitive information when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. Apple iOS, iPadOS, macOS, and Safari WebKit contain a memory corruption vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. Added to CISA KEV on 2023-12-04.",
      "xPost": null
    },
    {
      "slug": "apple-ios-and-ipados-cve-2023-42824",
      "title": "Apple iOS and iPadOS: Kernel Privilege Escalation (CVE-2023-42824)",
      "url": "https://pwn.watch/i/apple-ios-and-ipados-cve-2023-42824",
      "json": "https://pwn.watch/i/apple-ios-and-ipados-cve-2023-42824.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Apple iOS and iPadOS",
      "tags": [
        "apple",
        "ios",
        "cisa-kev",
        "privilege-escalation"
      ],
      "cveIds": [
        "CVE-2023-42824"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2023-10-05",
      "closedAt": "2023-10-05",
      "updatedAt": "2023-10-05",
      "summary": "Apple iOS and iPadOS contain an unspecified vulnerability that allows for local privilege escalation. Added to CISA KEV on 2023-10-05.",
      "xPost": null
    },
    {
      "slug": "apple-multiple-products-cve-2023-41991-41992-41993",
      "title": "Apple Multiple Products: 3 exploited vulnerabilities (CVE-2023-41991, CVE-2023-41992, CVE-2023-41993)",
      "url": "https://pwn.watch/i/apple-multiple-products-cve-2023-41991-41992-41993",
      "json": "https://pwn.watch/i/apple-multiple-products-cve-2023-41991-41992-41993.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Apple Multiple Products",
      "tags": [
        "apple",
        "ios",
        "macos",
        "cisa-kev",
        "safari",
        "webkit",
        "privilege-escalation"
      ],
      "cveIds": [
        "CVE-2023-41991",
        "CVE-2023-41992",
        "CVE-2023-41993"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2023-09-25",
      "closedAt": "2023-09-25",
      "updatedAt": "2023-09-25",
      "summary": "Apple iOS, iPadOS, macOS, and watchOS contain an improper certificate validation vulnerability that can allow a malicious app to bypass signature validation. Apple iOS, iPadOS, macOS, and watchOS contain an unspecified vulnerability that allows for local privilege escalation. Apple iOS, iPadOS, macOS, and Safari WebKit contain an unspecified vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. Added to CISA KEV on 2023-09-25.",
      "xPost": null
    },
    {
      "slug": "apple-blastpass-cve-2023-41064-41061",
      "title": "BLASTPASS: NSO zero-click iPhone exploit chain (CVE-2023-41064, CVE-2023-41061)",
      "url": "https://pwn.watch/i/apple-blastpass-cve-2023-41064-41061",
      "json": "https://pwn.watch/i/apple-blastpass-cve-2023-41064-41061.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Apple iOS, iPadOS, macOS and watchOS",
      "tags": [
        "apple",
        "ios",
        "macos",
        "nso-group",
        "pegasus",
        "spyware",
        "zero-click",
        "zero-day",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2023-41064",
        "CVE-2023-41061"
      ],
      "affectedVersions": [
        "See vendor advisory"
      ],
      "fixedVersions": [
        "iOS 16.6.1 and iPadOS 16.6.1",
        "iOS 15.7.9 and iPadOS 15.7.9",
        "macOS Ventura 13.5.2",
        "macOS Monterey 12.6.9",
        "macOS Big Sur 11.7.10",
        "watchOS 9.6.2"
      ],
      "startedAt": "2023-09-07",
      "closedAt": "2023-09-11",
      "updatedAt": "2023-09-11",
      "summary": "Citizen Lab caught BLASTPASS, a zero-click iMessage exploit chain that delivered NSO Group's Pegasus through malicious PassKit attachments carrying images. Apple fixed the ImageIO and Wallet bugs in emergency updates the same day.",
      "xPost": null
    },
    {
      "slug": "apple-multiple-products-cve-2023-37450",
      "title": "Apple Multiple Products: WebKit Code Execution (CVE-2023-37450)",
      "url": "https://pwn.watch/i/apple-multiple-products-cve-2023-37450",
      "json": "https://pwn.watch/i/apple-multiple-products-cve-2023-37450.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Apple Multiple Products",
      "tags": [
        "apple",
        "ios",
        "macos",
        "cisa-kev",
        "safari",
        "webkit"
      ],
      "cveIds": [
        "CVE-2023-37450"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2023-07-13",
      "closedAt": "2023-07-13",
      "updatedAt": "2023-07-13",
      "summary": "Apple iOS, iPadOS, macOS, and Safari WebKit contain an unspecified vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. Added to CISA KEV on 2023-07-13.",
      "xPost": null
    },
    {
      "slug": "apple-multiple-products-cve-2023-32439",
      "title": "Apple Multiple Products: WebKit Type Confusion (CVE-2023-32439)",
      "url": "https://pwn.watch/i/apple-multiple-products-cve-2023-32439",
      "json": "https://pwn.watch/i/apple-multiple-products-cve-2023-32439.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Apple Multiple Products",
      "tags": [
        "apple",
        "ios",
        "macos",
        "cisa-kev",
        "safari",
        "webkit"
      ],
      "cveIds": [
        "CVE-2023-32439"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2023-06-23",
      "closedAt": "2023-06-23",
      "updatedAt": "2023-06-23",
      "summary": "Apple iOS, iPadOS, macOS, and Safari WebKit contain a type confusion vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. Added to CISA KEV on 2023-06-23.",
      "xPost": null
    },
    {
      "slug": "operation-triangulation-ios-zero-click-2023",
      "title": "Operation Triangulation: zero-click iMessage spyware on Kaspersky's iPhones",
      "url": "https://pwn.watch/i/operation-triangulation-ios-zero-click-2023",
      "json": "https://pwn.watch/i/operation-triangulation-ios-zero-click-2023.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Apple iOS (and other Apple OSes sharing the bugs)",
      "tags": [
        "apple",
        "ios",
        "kaspersky",
        "spyware",
        "zero-click",
        "zero-day",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2023-32434",
        "CVE-2023-32435",
        "CVE-2023-38606"
      ],
      "affectedVersions": [
        "Exploited against iOS versions before iOS 15.7 / 15.7.1 (NVD)"
      ],
      "fixedVersions": [
        "CVE-2023-32434: iOS 16.5.1, iOS 15.7.7, macOS Ventura 13.4.1, Monterey 12.6.7, Big Sur 11.7.8, watchOS 9.5.2, 8.8.1 (NVD)",
        "CVE-2023-32435: iOS 16.4, iOS 15.7.7, macOS Ventura 13.3, Safari 16.4 (NVD)",
        "CVE-2023-38606: iOS 16.6, iOS 15.7.8, macOS Ventura 13.5, Monterey 12.6.8, Big Sur 11.7.9, tvOS 16.6, watchOS 9.6 (NVD)"
      ],
      "startedAt": "2023-06-01",
      "closedAt": "2023-12-27",
      "updatedAt": "2023-12-27",
      "summary": "Kaspersky found a years-long zero-click iMessage campaign on its own staff's iPhones. The chain used several Apple zero-days, including a bypass of hardware memory protections through undocumented MMIO registers (CVE-2023-38606), which was revealed at 37C3 in December 2023.",
      "xPost": null
    },
    {
      "slug": "apple-multiple-products-cve-2023-28204-32373-32409",
      "title": "Apple Multiple Products: 3 exploited vulnerabilities (CVE-2023-28204, CVE-2023-32373, CVE-2023-32409)",
      "url": "https://pwn.watch/i/apple-multiple-products-cve-2023-28204-32373-32409",
      "json": "https://pwn.watch/i/apple-multiple-products-cve-2023-28204-32373-32409.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Apple Multiple Products",
      "tags": [
        "apple",
        "ios",
        "macos",
        "cisa-kev",
        "safari",
        "webkit"
      ],
      "cveIds": [
        "CVE-2023-28204",
        "CVE-2023-32373",
        "CVE-2023-32409"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2023-05-22",
      "closedAt": "2023-05-22",
      "updatedAt": "2023-05-22",
      "summary": "Apple iOS, iPadOS, macOS, tvOS, watchOS, and Safari WebKit contain an out-of-bounds read vulnerability that may disclose sensitive information when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. Apple iOS, iPadOS, macOS, tvOS, watchOS, and Safari WebKit contain a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. Apple iOS, iPadOS, macOS, tvOS, watchOS, and Safari WebKit contain an unspecified vulnerability that can allow a remote attacker to break out of the Web Content sandbox. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. Added to CISA KEV on 2023-05-22.",
      "xPost": null
    },
    {
      "slug": "apple-ios-ipados-and-macos-cve-2023-28206",
      "title": "Apple iOS, iPadOS, and macOS: IOSurfaceAccelerator Out-of-Bounds Write (CVE-2023-28206)",
      "url": "https://pwn.watch/i/apple-ios-ipados-and-macos-cve-2023-28206",
      "json": "https://pwn.watch/i/apple-ios-ipados-and-macos-cve-2023-28206.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Apple iOS, iPadOS, and macOS",
      "tags": [
        "apple",
        "ios",
        "macos",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2023-28206"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2023-04-10",
      "closedAt": "2023-04-10",
      "updatedAt": "2023-04-10",
      "summary": "Apple iOS, iPadOS, and macOS IOSurfaceAccelerator contain an out-of-bounds write vulnerability that allows an app to execute code with kernel privileges. Added to CISA KEV on 2023-04-10.",
      "xPost": null
    },
    {
      "slug": "apple-multiple-products-cve-2023-28205",
      "title": "Apple Multiple Products: WebKit Use-After-Free (CVE-2023-28205)",
      "url": "https://pwn.watch/i/apple-multiple-products-cve-2023-28205",
      "json": "https://pwn.watch/i/apple-multiple-products-cve-2023-28205.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Apple Multiple Products",
      "tags": [
        "apple",
        "ios",
        "macos",
        "cisa-kev",
        "safari",
        "webkit"
      ],
      "cveIds": [
        "CVE-2023-28205"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2023-04-10",
      "closedAt": "2023-04-10",
      "updatedAt": "2023-04-10",
      "summary": "Apple iOS, iPadOS, macOS, and Safari WebKit contain a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. Added to CISA KEV on 2023-04-10.",
      "xPost": null
    },
    {
      "slug": "apple-multiple-products-cve-2023-23529",
      "title": "Apple Multiple Products: WebKit Type Confusion (CVE-2023-23529)",
      "url": "https://pwn.watch/i/apple-multiple-products-cve-2023-23529",
      "json": "https://pwn.watch/i/apple-multiple-products-cve-2023-23529.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Apple Multiple Products",
      "tags": [
        "apple",
        "ios",
        "macos",
        "cisa-kev",
        "safari",
        "webkit"
      ],
      "cveIds": [
        "CVE-2023-23529"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2023-02-14",
      "closedAt": "2023-02-14",
      "updatedAt": "2023-02-14",
      "summary": "Apple iOS, MacOS, Safari and iPadOS WebKit contain a type confusion vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. Added to CISA KEV on 2023-02-14.",
      "xPost": null
    }
  ],
  "posts": [
    {
      "authorName": "Cybersecurity News Everyday",
      "handle": "TweetThreatNews",
      "avatarUrl": "https://pbs.twimg.com/profile_images/2043130207125848064/YaxtN2hq_bigger.jpg",
      "text": "CVE-2026-113380 affects RingRTC versions before 2.72.0 and could let a call participant keep hearing audio after hang-up. No in-the-wild exploitation is known; users are advised to update Signal.",
      "date": "2026-10-21T22:48:16.000Z",
      "url": "https://x.com/TweetThreatNews/status/2113039694753636745",
      "media": [],
      "incident": "signal-ringrtc-cve-2026-113380"
    },
    {
      "authorName": "tsn_hub",
      "handle": "tsnmediahub",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1892172141111496704/d_EnIiZO_bigger.jpg",
      "text": "📵 Update Signal. A critical flaw in its RingRTC calling library could stop a call ending when you hang up, leaving audio and perhaps video running, per its CVE record. RingRTC 2.72.0 fixes it. There's no report of exploitation.\n\nSource: CVE-2026-113380 record",
      "date": "2026-10-21T18:52:01.000Z",
      "url": "https://x.com/tsnmediahub/status/2112980243162026149",
      "media": [],
      "incident": "signal-ringrtc-cve-2026-113380"
    }
  ],
  "changes": [
    {
      "incident": "signal-ringrtc-cve-2026-113380",
      "incidentTitle": "Signal calls can stay live after hang-up (RingRTC CVE-2026-113380)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-10-22",
      "title": "No known exploitation; CISA has not added it to KEV and NVD lists it as awaiting analysis.",
      "body": null,
      "sourceUrl": "https://www.helpnetsecurity.com/2026/10/22/signal-ringrtc-vulnerability-cve-2026-113380/",
      "url": "https://pwn.watch/i/signal-ringrtc-cve-2026-113380"
    },
    {
      "incident": "signal-ringrtc-cve-2026-113380",
      "incidentTitle": "Signal calls can stay live after hang-up (RingRTC CVE-2026-113380)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-10-22",
      "title": "SecurityWeek: the hang-up was queued behind peer events with no rate limit or priority; the fix makes call termination bypass the queue. Users should update Signal and check the call indicator after hanging up.",
      "body": null,
      "sourceUrl": "https://www.securityweek.com/signal-vulnerability-lets-malicious-callers-block-hang-ups/",
      "url": "https://pwn.watch/i/signal-ringrtc-cve-2026-113380"
    },
    {
      "incident": "signal-ringrtc-cve-2026-113380",
      "incidentTitle": "Signal calls can stay live after hang-up (RingRTC CVE-2026-113380)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-10-22",
      "title": "Closed on pwn.watch: the fix shipped Sep 4 (RingRTC 2.72.0), there is still no known exploitation and no new developments, so this is now a patch-and-move-on item. Make sure Signal is updated on every device.",
      "body": null,
      "sourceUrl": "https://www.securityweek.com/signal-vulnerability-lets-malicious-callers-block-hang-ups/",
      "url": "https://pwn.watch/i/signal-ringrtc-cve-2026-113380"
    },
    {
      "incident": "signal-ringrtc-cve-2026-113380",
      "incidentTitle": "Signal calls can stay live after hang-up (RingRTC CVE-2026-113380)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-10-21",
      "title": "Researcher Imahian's write-up and conceptual PoC circulate; press coverage begins.",
      "body": null,
      "sourceUrl": "https://www.theregister.com/security/2026/10/21/signal-bug-could-keep-your-mic-and-camera-on-after-hangup/5304528",
      "url": "https://pwn.watch/i/signal-ringrtc-cve-2026-113380"
    },
    {
      "incident": "signal-ringrtc-cve-2026-113380",
      "incidentTitle": "Signal calls can stay live after hang-up (RingRTC CVE-2026-113380)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-10-20",
      "title": "CVE-2026-113380 published by MITRE (CVSS 4.0 9.3); fix is RingRTC 2.72.0.",
      "body": null,
      "sourceUrl": "https://www.cve.org/CVERecord?id=CVE-2026-113380",
      "url": "https://pwn.watch/i/signal-ringrtc-cve-2026-113380"
    },
    {
      "incident": "signal-ringrtc-cve-2026-113380",
      "incidentTitle": "Signal calls can stay live after hang-up (RingRTC CVE-2026-113380)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-09-04",
      "title": "Signal quietly fixes the bug in RingRTC 2.72.0 (commit \"Ensure calls terminate completely in corner cases\"), about six weeks before disclosure.",
      "body": null,
      "sourceUrl": "https://github.com/signalapp/ringrtc/commit/4b1b6fa53c9f30c87c8ea78e44675d4a13e1e4d3",
      "url": "https://pwn.watch/i/signal-ringrtc-cve-2026-113380"
    },
    {
      "incident": "apple-multiple-products-cve-2025-43510",
      "incidentTitle": "Apple Multiple Products: Apple Multiple Products Improper Locking Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-03-20",
      "title": "CISA added CVE-2025-43510, CVE-2025-43520, CVE-2025-31277 to the KEV catalog (due 2026-04-03).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/apple-multiple-products-cve-2025-43510"
    },
    {
      "incident": "apple-multiple-products-cve-2026-20700",
      "incidentTitle": "Apple Multiple Products: Apple Multiple Buffer Overflow Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-02-12",
      "title": "CISA added CVE-2026-20700 to the KEV catalog (due 2026-03-05).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/apple-multiple-products-cve-2026-20700"
    },
    {
      "incident": "apple-multiple-products-cve-2025-43529",
      "incidentTitle": "Apple Multiple Products: Multiple Products Use-After-Free WebKit Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-12-15",
      "title": "CISA added CVE-2025-43529 to the KEV catalog (due 2026-01-05).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/apple-multiple-products-cve-2025-43529"
    },
    {
      "incident": "apple-multiple-products-cve-2022-48503",
      "incidentTitle": "Apple Multiple Products: Multiple Products Unspecified Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-10-20",
      "title": "CISA added CVE-2022-48503 to the KEV catalog (due 2025-11-10).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/apple-multiple-products-cve-2022-48503"
    },
    {
      "incident": "apple-ios-ipados-and-macos-cve-2025-43300",
      "incidentTitle": "Apple iOS, iPadOS, and macOS: iOS, iPadOS, and macOS Out-of-Bounds Write Vulnerability",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-08-21",
      "title": "CISA added CVE-2025-43300 to the KEV catalog (due 2025-09-11).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/apple-ios-ipados-and-macos-cve-2025-43300"
    },
    {
      "incident": "apple-multiple-products-cve-2025-43200",
      "incidentTitle": "Apple Multiple Products: Multiple Products Unspecified Vulnerability",
      "severity": "medium",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-06-16",
      "title": "CISA added CVE-2025-43200 to the KEV catalog (due 2025-07-07).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/apple-multiple-products-cve-2025-43200"
    },
    {
      "incident": "apple-multiple-products-cve-2025-31200",
      "incidentTitle": "Apple Multiple Products: 2 exploited vulnerabilities (CVE-2025-31200, CVE-2025-31201)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-04-17",
      "title": "CISA added CVE-2025-31200 to the KEV catalog (due 2025-05-08).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/apple-multiple-products-cve-2025-31200"
    },
    {
      "incident": "apple-multiple-products-cve-2025-31200",
      "incidentTitle": "Apple Multiple Products: 2 exploited vulnerabilities (CVE-2025-31200, CVE-2025-31201)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-04-17",
      "title": "CISA added CVE-2025-31201 to the KEV catalog (due 2025-05-08).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/apple-multiple-products-cve-2025-31200"
    },
    {
      "incident": "apple-multiple-products-cve-2025-24201",
      "incidentTitle": "Apple Multiple Products: Multiple Products WebKit Out-of-Bounds Write Vulnerability",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-03-13",
      "title": "CISA added CVE-2025-24201 to the KEV catalog (due 2025-04-03).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/apple-multiple-products-cve-2025-24201"
    },
    {
      "incident": "apple-ios-and-ipados-cve-2025-24200",
      "incidentTitle": "Apple iOS and iPadOS: iOS and iPadOS Incorrect Authorization Vulnerability",
      "severity": "medium",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-02-12",
      "title": "CISA added CVE-2025-24200 to the KEV catalog (due 2025-03-05).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/apple-ios-and-ipados-cve-2025-24200"
    },
    {
      "incident": "apple-multiple-products-cve-2025-24085",
      "incidentTitle": "Apple Multiple Products: Multiple Products Use-After-Free Vulnerability",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-01-29",
      "title": "CISA added CVE-2025-24085 to the KEV catalog (due 2025-02-19).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/apple-multiple-products-cve-2025-24085"
    },
    {
      "incident": "apple-multiple-products-cve-2024-44308-44309",
      "incidentTitle": "Apple Multiple Products: 2 actively exploited vulnerabilities",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-11-21",
      "title": "CISA added CVE-2024-44308 to the KEV catalog (federal deadline 2024-12-12)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/apple-multiple-products-cve-2024-44308-44309"
    },
    {
      "incident": "apple-multiple-products-cve-2024-44308-44309",
      "incidentTitle": "Apple Multiple Products: 2 actively exploited vulnerabilities",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-11-21",
      "title": "CISA added CVE-2024-44309 to the KEV catalog (federal deadline 2024-12-12)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/apple-multiple-products-cve-2024-44308-44309"
    },
    {
      "incident": "apple-multiple-products-cve-2024-44308-44309",
      "incidentTitle": "Apple Multiple Products: 2 actively exploited vulnerabilities",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-11-19",
      "title": "CVE-2024-44308 published",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-44308",
      "url": "https://pwn.watch/i/apple-multiple-products-cve-2024-44308-44309"
    },
    {
      "incident": "apple-multiple-products-cve-2024-44308-44309",
      "incidentTitle": "Apple Multiple Products: 2 actively exploited vulnerabilities",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-11-19",
      "title": "CVE-2024-44309 published",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-44309",
      "url": "https://pwn.watch/i/apple-multiple-products-cve-2024-44308-44309"
    },
    {
      "incident": "apple-multiple-products-cve-2024-23225-23296",
      "incidentTitle": "Apple Multiple Products: 2 actively exploited vulnerabilities",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-03-06",
      "title": "CISA added CVE-2024-23225 to the KEV catalog (federal deadline 2024-03-27)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/apple-multiple-products-cve-2024-23225-23296"
    },
    {
      "incident": "apple-multiple-products-cve-2024-23225-23296",
      "incidentTitle": "Apple Multiple Products: 2 actively exploited vulnerabilities",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-03-06",
      "title": "CISA added CVE-2024-23296 to the KEV catalog (federal deadline 2024-03-27)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/apple-multiple-products-cve-2024-23225-23296"
    },
    {
      "incident": "apple-multiple-products-cve-2024-23225-23296",
      "incidentTitle": "Apple Multiple Products: 2 actively exploited vulnerabilities",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-03-05",
      "title": "CVE-2024-23225 published",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-23225",
      "url": "https://pwn.watch/i/apple-multiple-products-cve-2024-23225-23296"
    },
    {
      "incident": "apple-multiple-products-cve-2024-23225-23296",
      "incidentTitle": "Apple Multiple Products: 2 actively exploited vulnerabilities",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-03-05",
      "title": "CVE-2024-23296 published",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-23296",
      "url": "https://pwn.watch/i/apple-multiple-products-cve-2024-23225-23296"
    },
    {
      "incident": "apple-multiple-products-cve-2022-48618",
      "incidentTitle": "Apple Multiple Products Memory Corruption",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-01-31",
      "title": "CISA added CVE-2022-48618 to the KEV catalog (federal deadline 2024-02-21)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/apple-multiple-products-cve-2022-48618"
    },
    {
      "incident": "apple-multiple-products-cve-2024-23222",
      "incidentTitle": "Apple Multiple Products WebKit Type Confusion",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-01-23",
      "title": "CVE-2024-23222 published",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-23222",
      "url": "https://pwn.watch/i/apple-multiple-products-cve-2024-23222"
    },
    {
      "incident": "apple-multiple-products-cve-2024-23222",
      "incidentTitle": "Apple Multiple Products WebKit Type Confusion",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-01-23",
      "title": "CISA added CVE-2024-23222 to the KEV catalog (federal deadline 2024-02-13)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/apple-multiple-products-cve-2024-23222"
    },
    {
      "incident": "apple-multiple-products-cve-2022-48618",
      "incidentTitle": "Apple Multiple Products Memory Corruption",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-01-09",
      "title": "CVE-2022-48618 published",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2022-48618",
      "url": "https://pwn.watch/i/apple-multiple-products-cve-2022-48618"
    },
    {
      "incident": "apple-multiple-products-cve-2023-41990",
      "incidentTitle": "Apple Multiple Products Code Execution",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-01-08",
      "title": "CISA added CVE-2023-41990 to the KEV catalog (federal deadline 2024-01-29)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/apple-multiple-products-cve-2023-41990"
    },
    {
      "incident": "operation-triangulation-ios-zero-click-2023",
      "incidentTitle": "Operation Triangulation: zero-click iMessage spyware on Kaspersky's iPhones",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-12-27",
      "title": "At 37C3, Kaspersky details the hardware-feature bypass behind CVE-2023-38606",
      "body": null,
      "sourceUrl": "https://securelist.com/operation-triangulation-the-last-hardware-mystery/111669/",
      "url": "https://pwn.watch/i/operation-triangulation-ios-zero-click-2023"
    },
    {
      "incident": "apple-multiple-products-cve-2023-42916-42917",
      "incidentTitle": "Apple Multiple Products: 2 exploited vulnerabilities (CVE-2023-42916, CVE-2023-42917)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-12-04",
      "title": "CISA added CVE-2023-42916 to the KEV catalog (due 2023-12-25).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/apple-multiple-products-cve-2023-42916-42917"
    },
    {
      "incident": "apple-multiple-products-cve-2023-42916-42917",
      "incidentTitle": "Apple Multiple Products: 2 exploited vulnerabilities (CVE-2023-42916, CVE-2023-42917)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-12-04",
      "title": "CISA added CVE-2023-42917 to the KEV catalog (due 2023-12-25).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/apple-multiple-products-cve-2023-42916-42917"
    },
    {
      "incident": "apple-ios-and-ipados-cve-2023-42824",
      "incidentTitle": "Apple iOS and iPadOS: Kernel Privilege Escalation (CVE-2023-42824)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-10-05",
      "title": "CISA added CVE-2023-42824 to the KEV catalog (due 2023-10-26).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/apple-ios-and-ipados-cve-2023-42824"
    },
    {
      "incident": "apple-multiple-products-cve-2023-41991-41992-41993",
      "incidentTitle": "Apple Multiple Products: 3 exploited vulnerabilities (CVE-2023-41991, CVE-2023-41992, CVE-2023-41993)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-09-25",
      "title": "CISA added CVE-2023-41991 to the KEV catalog (due 2023-10-16).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/apple-multiple-products-cve-2023-41991-41992-41993"
    },
    {
      "incident": "apple-multiple-products-cve-2023-41991-41992-41993",
      "incidentTitle": "Apple Multiple Products: 3 exploited vulnerabilities (CVE-2023-41991, CVE-2023-41992, CVE-2023-41993)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-09-25",
      "title": "CISA added CVE-2023-41992 to the KEV catalog (due 2023-10-16).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/apple-multiple-products-cve-2023-41991-41992-41993"
    },
    {
      "incident": "apple-multiple-products-cve-2023-41991-41992-41993",
      "incidentTitle": "Apple Multiple Products: 3 exploited vulnerabilities (CVE-2023-41991, CVE-2023-41992, CVE-2023-41993)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-09-25",
      "title": "CISA added CVE-2023-41993 to the KEV catalog (due 2023-10-16).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/apple-multiple-products-cve-2023-41991-41992-41993"
    },
    {
      "incident": "apple-blastpass-cve-2023-41064-41061",
      "incidentTitle": "BLASTPASS: NSO zero-click iPhone exploit chain (CVE-2023-41064, CVE-2023-41061)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-09-11",
      "title": "CISA adds both CVEs to the KEV catalog",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/apple-blastpass-cve-2023-41064-41061"
    },
    {
      "incident": "apple-blastpass-cve-2023-41064-41061",
      "incidentTitle": "BLASTPASS: NSO zero-click iPhone exploit chain (CVE-2023-41064, CVE-2023-41061)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-09-07",
      "title": "Citizen Lab discloses BLASTPASS; Apple ships iOS 16.6.1 and related updates",
      "body": null,
      "sourceUrl": "https://citizenlab.ca/2023/09/blastpass-nso-group-iphone-zero-click-zero-day-exploit-captured-in-the-wild/",
      "url": "https://pwn.watch/i/apple-blastpass-cve-2023-41064-41061"
    },
    {
      "incident": "operation-triangulation-ios-zero-click-2023",
      "incidentTitle": "Operation Triangulation: zero-click iMessage spyware on Kaspersky's iPhones",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-07-24",
      "title": "Apple fixes CVE-2023-38606 (iOS 16.6); KEV entry follows on July 26",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2023-38606",
      "url": "https://pwn.watch/i/operation-triangulation-ios-zero-click-2023"
    },
    {
      "incident": "apple-multiple-products-cve-2023-37450",
      "incidentTitle": "Apple Multiple Products: WebKit Code Execution (CVE-2023-37450)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-07-13",
      "title": "CISA added CVE-2023-37450 to the KEV catalog (due 2023-08-03).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/apple-multiple-products-cve-2023-37450"
    },
    {
      "incident": "apple-multiple-products-cve-2023-32439",
      "incidentTitle": "Apple Multiple Products: WebKit Type Confusion (CVE-2023-32439)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-06-23",
      "title": "CISA added CVE-2023-32439 to the KEV catalog (due 2023-07-14).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/apple-multiple-products-cve-2023-32439"
    },
    {
      "incident": "operation-triangulation-ios-zero-click-2023",
      "incidentTitle": "Operation Triangulation: zero-click iMessage spyware on Kaspersky's iPhones",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-06-21",
      "title": "Apple fixes CVE-2023-32434 and CVE-2023-32435; CISA adds them to KEV on June 23",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2023-32434",
      "url": "https://pwn.watch/i/operation-triangulation-ios-zero-click-2023"
    },
    {
      "incident": "operation-triangulation-ios-zero-click-2023",
      "incidentTitle": "Operation Triangulation: zero-click iMessage spyware on Kaspersky's iPhones",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-06-01",
      "title": "Kaspersky discloses Operation Triangulation",
      "body": null,
      "sourceUrl": "https://securelist.com/operation-triangulation/109842/",
      "url": "https://pwn.watch/i/operation-triangulation-ios-zero-click-2023"
    },
    {
      "incident": "apple-multiple-products-cve-2023-28204-32373-32409",
      "incidentTitle": "Apple Multiple Products: 3 exploited vulnerabilities (CVE-2023-28204, CVE-2023-32373, CVE-2023-32409)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-05-22",
      "title": "CISA added CVE-2023-28204 to the KEV catalog (due 2023-06-12).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/apple-multiple-products-cve-2023-28204-32373-32409"
    },
    {
      "incident": "apple-multiple-products-cve-2023-28204-32373-32409",
      "incidentTitle": "Apple Multiple Products: 3 exploited vulnerabilities (CVE-2023-28204, CVE-2023-32373, CVE-2023-32409)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-05-22",
      "title": "CISA added CVE-2023-32373 to the KEV catalog (due 2023-06-12).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/apple-multiple-products-cve-2023-28204-32373-32409"
    },
    {
      "incident": "apple-multiple-products-cve-2023-28204-32373-32409",
      "incidentTitle": "Apple Multiple Products: 3 exploited vulnerabilities (CVE-2023-28204, CVE-2023-32373, CVE-2023-32409)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-05-22",
      "title": "CISA added CVE-2023-32409 to the KEV catalog (due 2023-06-12).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/apple-multiple-products-cve-2023-28204-32373-32409"
    },
    {
      "incident": "apple-ios-ipados-and-macos-cve-2023-28206",
      "incidentTitle": "Apple iOS, iPadOS, and macOS: IOSurfaceAccelerator Out-of-Bounds Write (CVE-2023-28206)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-04-10",
      "title": "CISA added CVE-2023-28206 to the KEV catalog (due 2023-05-01).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/apple-ios-ipados-and-macos-cve-2023-28206"
    },
    {
      "incident": "apple-multiple-products-cve-2023-28205",
      "incidentTitle": "Apple Multiple Products: WebKit Use-After-Free (CVE-2023-28205)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-04-10",
      "title": "CISA added CVE-2023-28205 to the KEV catalog (due 2023-05-01).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/apple-multiple-products-cve-2023-28205"
    },
    {
      "incident": "apple-multiple-products-cve-2023-23529",
      "incidentTitle": "Apple Multiple Products: WebKit Type Confusion (CVE-2023-23529)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-02-14",
      "title": "CISA added CVE-2023-23529 to the KEV catalog (due 2023-03-07).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/apple-multiple-products-cve-2023-23529"
    }
  ]
}