According to this CNET article, by sending a certain file in an iMessage an attacker could gain access to stuff like passwords on the victim's iPhone. The good news is that Apple is on top of things and this vulnerability was apparently fixed in iOS 9.3.3, however I (and many others) am running the iOS 10 Public Beta. So where does this leave us? Was this fixed in iOS 10 Public Beta 1, 2, or not at all?
I haven't officially verified that the bug is not present in the iOS 10 beta, but iOS 9.3.3 was in developer beta for quite awhile before iOS 10 was even announced, so it wouldn't be reasonable for a newer OS, albeit a beta, to not have this patch as well.
If that's not enough, consider that Apple generally does not discuss security vulnerabilities until they are safely patched. CNET only discovered this because Apple posted it in their security report for iOS 9.3.3. It's not likely that Apple would publicize it if there was still publicly available software that was still vulnerable.