Apple Ipad OS vulnerabilities

89 CVEs affecting Apple Ipad OS, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-42977, published 2025-04-11.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-3897, published 2020-04-01. High severity, CVSS 8.8. EPSS: 4.7% chance of exploitation in the next 30 days. A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 13.4 and iPadOS 13.4, tvOS 13.4, watchOS 6.2, Safari 13.1, iTunes for Windows 12.10.5, iCloud for…
CVE-2020-3899, published 2020-04-01. High severity, CVSS 8.8. EPSS: 4.1% chance of exploitation in the next 30 days. A memory consumption issue was addressed with improved memory handling. This issue is fixed in iOS 13.4 and iPadOS 13.4, tvOS 13.4, watchOS 6.2, Safari 13.1, iTunes for Windows 12.10.5, iCloud for…
CVE-2021-1818, published 2021-04-02. Critical severity, CVSS 9.8. EPSS: 2.9% chance of exploitation in the next 30 days. A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, watchOS 7.3, tvOS 14.4, iOS…
CVE-2020-3895, published 2020-04-01. High severity, CVSS 8.8. EPSS: 2.6% chance of exploitation in the next 30 days. A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 13.4 and iPadOS 13.4, tvOS 13.4, watchOS 6.2, Safari 13.1, iTunes for Windows 12.10.5, iCloud for…
CVE-2021-1794, published 2021-04-02. Critical severity, CVSS 9.8. EPSS: 2.1% chance of exploitation in the next 30 days. An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 14.4 and iPadOS 14.4. A remote attacker may be able to cause arbitrary code execution.
CVE-2021-1795, published 2021-04-02. Critical severity, CVSS 9.8. EPSS: 2.1% chance of exploitation in the next 30 days. An out-of-bounds write was addressed with improved input validation. This issue is fixed in iOS 14.4 and iPadOS 14.4. A remote attacker may be able to cause arbitrary code execution.
CVE-2021-1761, published 2021-04-02. High severity, CVSS 7.5. EPSS: 2.1% chance of exploitation in the next 30 days. This issue was addressed with improved checks. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, watchOS 7.3, tvOS 14.4, iOS 14.4 and…
CVE-2021-1796, published 2021-04-02. Critical severity, CVSS 9.8. EPSS: 2% chance of exploitation in the next 30 days. An out-of-bounds write was addressed with improved input validation. This issue is fixed in iOS 14.4 and iPadOS 14.4. A remote attacker may be able to cause arbitrary code execution.
CVE-2020-3900, published 2020-04-01. High severity, CVSS 8.8. EPSS: 1.9% chance of exploitation in the next 30 days. A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 13.4 and iPadOS 13.4, tvOS 13.4, watchOS 6.2, Safari 13.1, iTunes for Windows 12.10.5, iCloud for…
CVE-2020-3901, published 2020-04-01. High severity, CVSS 8.8. EPSS: 1.9% chance of exploitation in the next 30 days. A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 13.4 and iPadOS 13.4, tvOS 13.4, watchOS 6.2, Safari 13.1, iTunes for Windows 12.10.5, iCloud for…

Latest

CVE-2023-42977, published 2025-04-11. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. A path handling issue was addressed with improved validation. This issue is fixed in iOS 17 and iPadOS 17, macOS Sonoma 14. An app may be able to break out of its sandbox.
CVE-2025-24203, published 2025-03-31. Medium severity, CVSS 5.0. EPSS: 0.6% chance of exploitation in the next 30 days. The issue was addressed with improved checks. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.4, visionOS 2.4,…
CVE-2024-44297, published 2024-10-28. Medium severity, CVSS 6.5. EPSS: 0.9% chance of exploitation in the next 30 days. The issue was addressed with improved bounds checks. This issue is fixed in iOS 17.7.1 and iPadOS 17.7.1, iOS 18.1 and iPadOS 18.1, macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1, tvOS…
CVE-2024-44139, published 2024-09-17. Low severity, CVSS 2.4. EPSS: 0.2% chance of exploitation in the next 30 days. The issue was addressed with improved checks. This issue is fixed in iOS 18 and iPadOS 18. An attacker with physical access may be able to access contacts from the lock screen.
CVE-2023-42974, published 2024-03-28. High severity, CVSS 7.0. EPSS: 0.1% chance of exploitation in the next 30 days. A race condition was addressed with improved state handling. This issue is fixed in macOS Monterey 12.7.2, macOS Ventura 13.6.3, iOS 17.2 and iPadOS 17.2, iOS 16.7.3 and iPadOS 16.7.3, macOS Sonoma…
CVE-2024-23297, published 2024-03-08. Medium severity, CVSS 5.5. EPSS: 0.3% chance of exploitation in the next 30 days. The issue was addressed with improved checks. This issue is fixed in iOS 17.4 and iPadOS 17.4, tvOS 17.4, watchOS 10.4. A malicious application may be able to access private information.
CVE-2024-23293, published 2024-03-08. Medium severity, CVSS 4.6. EPSS: 0.4% chance of exploitation in the next 30 days. This issue was addressed through improved state management. This issue is fixed in iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4, tvOS 17.4, watchOS 10.4. An attacker with physical access may be able…
CVE-2024-23280, published 2024-03-08. Medium severity, CVSS 6.5. EPSS: 1.3% chance of exploitation in the next 30 days. An injection issue was addressed with improved validation. This issue is fixed in Safari 17.4, iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4, tvOS 17.4, watchOS 10.4. A maliciously crafted webpage may…
CVE-2024-23277, published 2024-03-08. Medium severity, CVSS 5.9. EPSS: 0.7% chance of exploitation in the next 30 days. The issue was addressed with improved checks. This issue is fixed in iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4. An attacker in a privileged network position may be able to inject keystrokes by…
CVE-2024-23273, published 2024-03-08. Medium severity, CVSS 4.3. EPSS: 0.7% chance of exploitation in the next 30 days. This issue was addressed through improved state management. This issue is fixed in Safari 17.4, iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4. Private Browsing tabs may be accessed without…