Vulnerabilities
Tracked app vulnerabilities
639 CVEs affect a tracked app or OS (all severities, all platforms). 373 of them are in the CISA KEV catalog, meaning exploitation is confirmed.
- Matching CVEs
- 639
- Actively exploited
- 373
- Publication window
- 1999-11-11 → 2026-05-04
Chronological sort: newest to oldest. Use the KEV / severity filters above to prioritize.
| CVE |
|---|
|
CVE-2026-23918
HIGH 8.8
Double Free and possible RCE vulnerability in Apache HTTP Server with the HTTP/2 protocol. This issue affects Apache HTTP Server: 2.4.66. Users are recommend… |
|
CVE-2026-33829
MEDIUM 4.3
Exposure of sensitive information to an unauthorized actor in Windows Snipping Tool allows an unauthorized attacker to perform spoofing over a network. |
|
CVE-2026-32202
Protection mechanism failure in Windows Shell allows an unauthorized attacker to perform spoofing over a network. |
|
CVE-2026-2441
HIGH 8.8
KEV
Use after free in CSS in Google Chrome prior to 145.0.7632.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Ch… |
|
CVE-2026-21250
HIGH · vendor
Windows HTTP.sys Elevation of Privilege Vulnerability |
|
CVE-2026-21248
HIGH · vendor
Windows Hyper-V Remote Code Execution Vulnerability |
|
CVE-2026-21244
HIGH · vendor
Windows Hyper-V Remote Code Execution Vulnerability |
|
CVE-2025-11001
HIGH 7.8
7-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affecte… |
|
CVE-2025-59287
Windows Server Update Service (WSUS) Remote Code Execution Vulnerability |
|
CVE-2025-59254
HIGH · vendor
Microsoft DWM Core Library Elevation of Privilege Vulnerability |
|
CVE-2025-50154
HIGH · vendor
Microsoft Windows File Explorer Spoofing Vulnerability |
|
CVE-2025-6965
There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns available. This could lead… |
|
CVE-2025-49744
HIGH · vendor
Windows Graphics Component Elevation of Privilege Vulnerability |
|
CVE-2025-49730
HIGH · vendor
Microsoft Windows QoS Scheduler Driver Elevation of Privilege Vulnerability |
|
CVE-2025-49683
HIGH · vendor
Microsoft Virtual Hard Disk Remote Code Execution Vulnerability |
|
CVE-2025-49677
HIGH · vendor
Microsoft Brokering File System Elevation of Privilege Vulnerability |
|
CVE-2025-47987
HIGH · vendor
Credential Security Support Provider Protocol (CredSSP) Elevation of Privilege Vulnerability |
|
CVE-2025-32462
LOW 2.8
Sudo before 1.9.17p1, when used with a sudoers file that specifies a host that is neither the current host nor ALL, allows listed users to execute commands on … |
|
CVE-2025-47175
HIGH 7.8
Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally. |
|
CVE-2025-47171
MEDIUM 6.7
Improper input validation in Microsoft Office Outlook allows an authorized attacker to execute code locally. |
|
CVE-2025-47165
HIGH 7.8
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
|
CVE-2025-33073
Windows SMB Client Elevation of Privilege Vulnerability |
|
CVE-2025-30397
Scripting Engine Memory Corruption Vulnerability |
|
CVE-2025-27751
HIGH 7.8
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
|
CVE-2025-2783
HIGH 8.3
KEV
Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 134.0.6998.177 allowed a remote attacker to perform a sandb… |
|
CVE-2025-26633
Improper neutralization in Microsoft Management Console allows an unauthorized attacker to bypass a security feature locally. |
|
CVE-2025-24076
HIGH · vendor
Microsoft Windows Cross Device Service Elevation of Privilege Vulnerability |
|
CVE-2025-24071
HIGH · vendor
Microsoft Windows File Explorer Spoofing Vulnerability |
|
CVE-2025-24054
NTLM Hash Disclosure Spoofing Vulnerability |
|
CVE-2025-24085
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.6, macOS Sequoia 15.3, macOS… |
|
CVE-2025-21333
Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability |
|
CVE-2024-49138
Windows Common Log File System Driver Elevation of Privilege Vulnerability |
|
CVE-2023-48795
MEDIUM · vendor
Microsoft Security Update Guide entry — NVD enrichira. |
|
CVE-2024-38193
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability |
|
CVE-2024-6387
HIGH 8.1
A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an uns… |
|
CVE-2024-4367
HIGH 8.8
A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. This vulnerability affects Fire… |
|
CVE-2024-21338
Windows Kernel Elevation of Privilege Vulnerability |
|
CVE-2024-21320
HIGH · vendor
Windows Themes Spoofing Vulnerability |
|
CVE-2023-44487
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the w… |
|
CVE-2023-33131
HIGH 8.8
Microsoft Outlook Remote Code Execution Vulnerability |
|
CVE-2023-29336
Win32k Elevation of Privilege Vulnerability |
|
CVE-2022-0847
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2023-28293
HIGH · vendor
Windows Kernel Elevation of Privilege Vulnerability |
|
CVE-2023-23399
HIGH 7.8
Microsoft Excel Remote Code Execution Vulnerability |
|
CVE-2023-21752
HIGH · vendor
Windows Backup Service Elevation of Privilege Vulnerability |
|
CVE-2019-5797
HIGH 7.5
Double free in DOMStorage in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
|
CVE-2022-21907
CRITICAL · vendor
HTTP Protocol Stack Remote Code Execution Vulnerability |
|
CVE-2021-44228
Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameter… |
|
CVE-2017-14491
HIGH · vendor
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2020-16040
MEDIUM 6.5
Insufficient data validation in V8 in Google Chrome prior to 87.0.4280.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML p… |
Manage your fleet with Appaloosa
Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.