Every Apple security release, newest first — with the entries that matter flagged. Counts are Apple's published CVE listings per release.
Source: Apple security releases.
iOS 27.2 (163 CVEs) · macOS Golden Gate 27.2 (263) · macOS Tahoe 26.7.2 (213) · macOS Sequoia 15.8.2 (197) · iOS 26.7.2 (134) · visionOS 27.2 (125) · tvOS 27.2 (72) · watchOS 27.2 (62) · Safari 27.2 (33). Flagged: iOS 18.7.11 backports the exploited CoreGraphics flaw CVE-2026-86950 to iPhone XS/XR and iPad 7th generation — Apple says it may have been exploited in an extremely sophisticated attack against specific targeted individuals on iOS versions before iOS 27.
The first fix for the CoreGraphics out-of-bounds write CVE-2026-86950, later backported to iOS 18 in the October wave above.
The 26.7/27 launch wave. Includes the Bluetooth fixes CVE-2026-65406 (out-of-bounds write) and CVE-2026-65399 (Core Bluetooth authorization) — the two CVEs under study in this blog's security research.
Feed last updated 27 Oct 2026 from Apple's security releases page. Apple revises its advisories after publication, so counts can grow — the source page is the authority.