Vulnerabilities

Tracked app vulnerabilities

393 CVEs affect a tracked app or OS (all severities, all platforms). 286 of them are in the CISA KEV catalog, meaning exploitation is confirmed.

Matching CVEs: 393
Actively exploited: 286
Publication window: 2004-08-06 → 2026-05-04

All CVEs 16,427 CISA KEV 286 Public exploit 393 All severities Critical High Medium Low Hide N/A

All platforms iOS Android macOS Windows

Chronological sort: newest to oldest. Use the KEV / severity filters above to prioritize.

393 entries Public exploit Clear all

CVE	Severity	KEV	Apps	Published
CVE-2026-23918 HIGH 8.8 2026-05-04 Double Free and possible RCE vulnerability in Apache HTTP Server with the HTTP/2 protocol. This issue affects Apache HTTP Server: 2.4.66. Users are recommend…	HIGH 8.8	—	—	2026-05-04
CVE-2026-33829 MEDIUM 4.3 2026-04-14 Exposure of sensitive information to an unauthorized actor in Windows Snipping Tool allows an unauthorized attacker to perform spoofing over a network.	MEDIUM 4.3	—	—	2026-04-14
CVE-2026-32202 MEDIUM 4.3 KEV 2026-04-14 Protection mechanism failure in Windows Shell allows an unauthorized attacker to perform spoofing over a network.	MEDIUM 4.3	KEV	—	2026-04-14
CVE-2026-21250 HIGH 7.8 2026-02-10 Windows HTTP.sys Elevation of Privilege Vulnerability	HIGH 7.8	—	—	2026-02-10
CVE-2026-21248 HIGH 7.3 2026-02-10 Windows Hyper-V Remote Code Execution Vulnerability	HIGH 7.3	—	—	2026-02-10
CVE-2026-21244 HIGH 7.3 2026-02-10 Windows Hyper-V Remote Code Execution Vulnerability	HIGH 7.3	—	—	2026-02-10
CVE-2025-11001 HIGH 7.8 1 app 2025-11-19 7-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affecte…	HIGH 7.8	—	7-Zip	2025-11-19
CVE-2025-59287 CRITICAL 9.8 KEV 2025-10-14 Windows Server Update Service (WSUS) Remote Code Execution Vulnerability	CRITICAL 9.8	KEV	—	2025-10-14
CVE-2025-59254 HIGH 7.8 2025-10-14 Microsoft DWM Core Library Elevation of Privilege Vulnerability	HIGH 7.8	—	—	2025-10-14
CVE-2025-50154 HIGH 6.5 2025-08-12 Microsoft Windows File Explorer Spoofing Vulnerability	HIGH 6.5	—	—	2025-08-12
CVE-2025-6965 HIGH 7.7 2025-07-15 There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns available. This could lead…	HIGH 7.7	—	—	2025-07-15
CVE-2025-49744 HIGH 7.0 2025-07-08 Windows Graphics Component Elevation of Privilege Vulnerability	HIGH 7.0	—	—	2025-07-08
CVE-2025-49730 HIGH 7.8 2025-07-08 Microsoft Windows QoS Scheduler Driver Elevation of Privilege Vulnerability	HIGH 7.8	—	—	2025-07-08
CVE-2025-49683 HIGH 7.8 2025-07-08 Microsoft Virtual Hard Disk Remote Code Execution Vulnerability	HIGH 7.8	—	—	2025-07-08
CVE-2025-49677 HIGH 7.0 2025-07-08 Microsoft Brokering File System Elevation of Privilege Vulnerability	HIGH 7.0	—	—	2025-07-08
CVE-2025-47987 HIGH 7.8 2025-07-08 Credential Security Support Provider Protocol (CredSSP) Elevation of Privilege Vulnerability	HIGH 7.8	—	—	2025-07-08
CVE-2025-32462 LOW 2.8 2025-06-30 Sudo before 1.9.17p1, when used with a sudoers file that specifies a host that is neither the current host nor ALL, allows listed users to execute commands on …	LOW 2.8	—	—	2025-06-30
CVE-2025-33073 HIGH 8.8 KEV 2025-06-10 Windows SMB Client Elevation of Privilege Vulnerability	HIGH 8.8	KEV	—	2025-06-10
CVE-2025-30397 HIGH 7.5 KEV 2025-05-13 Scripting Engine Memory Corruption Vulnerability	HIGH 7.5	KEV	—	2025-05-13
CVE-2025-26633 HIGH 7.0 KEV 2025-03-11 Improper neutralization in Microsoft Management Console allows an unauthorized attacker to bypass a security feature locally.	HIGH 7.0	KEV	—	2025-03-11
CVE-2025-24076 HIGH 7.3 2025-03-11 Microsoft Windows Cross Device Service Elevation of Privilege Vulnerability	HIGH 7.3	—	—	2025-03-11
CVE-2025-24071 HIGH 6.5 2025-03-11 Microsoft Windows File Explorer Spoofing Vulnerability	HIGH 6.5	—	—	2025-03-11
CVE-2025-24054 HIGH 6.5 KEV 2025-03-11 NTLM Hash Disclosure Spoofing Vulnerability	HIGH 6.5	KEV	—	2025-03-11
CVE-2025-24085 CRITICAL 10.0 KEV 2025-01-27 A use after free issue was addressed with improved memory management. This issue is fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.6, macOS Sequoia 15.3, macOS…	CRITICAL 10.0	KEV	—	2025-01-27
CVE-2025-21333 HIGH 7.8 KEV 2025-01-14 Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability	HIGH 7.8	KEV	—	2025-01-14
CVE-2024-49138 HIGH 7.8 KEV 2024-12-10 Windows Common Log File System Driver Elevation of Privilege Vulnerability	HIGH 7.8	KEV	—	2024-12-10
CVE-2023-48795 MEDIUM 5.9 2024-11-12 Microsoft Security Update Guide entry — NVD enrichira.	MEDIUM 5.9	—	—	2024-11-12
CVE-2024-38193 HIGH 7.8 KEV 2024-08-13 Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	HIGH 7.8	KEV	—	2024-08-13
CVE-2024-6387 CRITICAL 8.1 2024-07-09 RedHat Openssh: CVE-2024-6387 Remote Code Execution Due To A Race Condition In Signal Handling	CRITICAL 8.1	—	—	2024-07-09
CVE-2024-4367 HIGH 8.8 1 app 2024-05-14 A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. This vulnerability affects Fire…	HIGH 8.8	—	Mozilla Thunderbird	2024-05-14
CVE-2024-21338 HIGH 7.8 KEV 2024-02-13 Windows Kernel Elevation of Privilege Vulnerability	HIGH 7.8	KEV	—	2024-02-13
CVE-2024-21320 HIGH 6.5 2024-01-09 Windows Themes Spoofing Vulnerability	HIGH 6.5	—	—	2024-01-09
CVE-2023-44487 HIGH 7.5 KEV 2023-10-10 The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the w…	HIGH 7.5	KEV	—	2023-10-10
CVE-2023-29336 HIGH 7.8 KEV 2023-05-09 Win32k Elevation of Privilege Vulnerability	HIGH 7.8	KEV	—	2023-05-09
CVE-2022-0847 HIGH 7.8 KEV 2023-05-01 Indexed via Android Security Bulletin; full NVD metadata pending.	HIGH 7.8	KEV	—	2023-05-01
CVE-2023-28293 HIGH 7.8 2023-04-11 Windows Kernel Elevation of Privilege Vulnerability	HIGH 7.8	—	—	2023-04-11
CVE-2023-21752 HIGH 7.1 2023-01-10 Windows Backup Service Elevation of Privilege Vulnerability	HIGH 7.1	—	—	2023-01-10
CVE-2022-21907 CRITICAL 9.8 2022-01-11 HTTP Protocol Stack Remote Code Execution Vulnerability	CRITICAL 9.8	—	—	2022-01-11
CVE-2021-44228 CRITICAL 10.0 KEV 1 app 2021-12-10 Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameter…	CRITICAL 10.0	KEV	Xcode	2021-12-10
CVE-2017-14491 HIGH 2021-03-01 Indexed via Android Security Bulletin; full NVD metadata pending.	HIGH	—	—	2021-03-01
CVE-2020-1472 CRITICAL 10.0 KEV 2020-08-11 Netlogon Elevation of Privilege Vulnerability	CRITICAL 10.0	KEV	—	2020-08-11
CVE-2020-0796 CRITICAL 10.0 KEV 2020-03-12 A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests, aka 'Windows S…	CRITICAL 10.0	KEV	—	2020-03-12
CVE-2019-17026 HIGH 8.8 KEV 1 app 2020-03-02 Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion. We are aware of targeted attacks in the wild a…	HIGH 8.8	KEV	Mozilla Thunderbird	2020-03-02
CVE-2014-4650 CRITICAL 9.8 1 app 2020-02-20 The CGIHTTPServer module in Python 2.7.5 and 3.3.4 does not properly handle URLs in which URL encoding is used for path separators, which allows remote attacke…	CRITICAL 9.8	—	Python	2020-02-20
CVE-2020-0683 HIGH 7.0 KEV 2020-02-11 Windows Installer Elevation of Privilege Vulnerability	HIGH 7.0	KEV	—	2020-02-11
CVE-2019-11599 HIGH 2020-02-01 Indexed via Android Security Bulletin; full NVD metadata pending.	HIGH	—	—	2020-02-01
CVE-2019-18426 HIGH 8.2 KEV 1 app 2020-01-21 A vulnerability in WhatsApp Desktop versions prior to 0.3.9309 when paired with WhatsApp for iPhone versions prior to 2.20.10 allows cross-site scripting and l…	HIGH 8.2	KEV	WhatsApp	2020-01-21
CVE-2020-0610 CRITICAL 9.8 2020-01-14 Windows Remote Desktop Gateway (RD Gateway) Remote Code Execution Vulnerability	CRITICAL 9.8	—	—	2020-01-14
CVE-2020-0609 CRITICAL 9.8 2020-01-14 Windows Remote Desktop Gateway (RD Gateway) Remote Code Execution Vulnerability	CRITICAL 9.8	—	—	2020-01-14
CVE-2020-0601 HIGH 8.1 KEV 2020-01-14 Windows CryptoAPI Spoofing Vulnerability	HIGH 8.1	KEV	—	2020-01-14