Vulnerabilities
Tracked app vulnerabilities
564 CVEs affect a tracked app or OS (all severities, Windows). 303 of them are in the CISA KEV catalog, meaning exploitation is confirmed.
- Matching CVEs
- 564
- Actively exploited
- 303
- Publication window
- 1999-11-11 → 2026-04-14
Chronological sort: newest to oldest. Use the KEV / severity filters above to prioritize.
| CVE |
|---|
|
CVE-2019-1019
HIGH · vendor
Microsoft Windows Security Feature Bypass Vulnerability |
|
CVE-2019-0959
HIGH · vendor
Windows Common Log File System Driver Elevation of Privilege Vulnerability |
|
CVE-2019-0948
MEDIUM · vendor
Windows Event Viewer Information Disclosure Vulnerability |
|
CVE-2019-0943
HIGH · vendor
Windows ALPC Elevation of Privilege Vulnerability |
|
CVE-2019-5796
HIGH 7.5
Data race in extensions guest view in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML p… |
|
CVE-2019-5789
HIGH 8.8
An integer overflow that leads to a use-after-free in WebMIDI in Google Chrome on Windows prior to 73.0.3683.75 allowed a remote attacker who had compromised t… |
|
CVE-2019-5788
HIGH 8.8
An integer overflow that leads to a use-after-free in Blink Storage in Google Chrome on Linux prior to 73.0.3683.75 allowed a remote attacker who had compromis… |
|
CVE-2019-0881
HIGH · vendor
Windows Kernel Elevation of Privilege Vulnerability |
|
CVE-2019-0863
Windows Error Reporting Elevation of Privilege Vulnerability |
|
CVE-2019-9813
HIGH 8.8
Incorrect handling of __proto__ mutations may lead to type confusion in IonMonkey JIT code and can be leveraged for arbitrary memory read and write. This vulne… |
|
CVE-2019-9810
HIGH 8.8
Incorrect alias information in IonMonkey JIT compiler for Array.prototype.slice method may lead to missing bounds check and a buffer overflow. This vulnerabili… |
|
CVE-2019-9792
CRITICAL 9.8
The IonMonkey just-in-time (JIT) compiler can leak an internal JS_OPTIMIZED_OUT magic value to the running script during a bailout. This magic value can then b… |
|
CVE-2019-9791
CRITICAL 9.8
The type inference system allows the compilation of functions that can cause type confusions between arbitrary objects when compiled through the IonMonkey just… |
|
CVE-2019-0841
Windows Elevation of Privilege Vulnerability |
|
CVE-2019-0836
HIGH · vendor
Windows Elevation of Privilege Vulnerability |
|
CVE-2019-0805
HIGH · vendor
Windows Elevation of Privilege Vulnerability |
|
CVE-2019-0803
Win32k Elevation of Privilege Vulnerability |
|
CVE-2019-0796
HIGH · vendor
Windows Elevation of Privilege Vulnerability |
|
CVE-2019-0735
HIGH · vendor
Windows CSRSS Elevation of Privilege Vulnerability |
|
CVE-2019-0732
HIGH · vendor
Windows Security Feature Bypass Vulnerability |
|
CVE-2019-0731
HIGH · vendor
Windows Elevation of Privilege Vulnerability |
|
CVE-2019-0730
HIGH · vendor
Windows Elevation of Privilege Vulnerability |
|
CVE-2019-0612
MEDIUM 5.3
A security feature bypass vulnerability exists when Click2Play protection in Microsoft Edge improperly handles flash objects. By itself, this bypass vulnerabil… |
|
CVE-2018-20250
In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field of the ACE format (in UNACEV2.dll). When… |
|
CVE-2018-6126
HIGH 8.8
A precision error in Skia in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. |
|
CVE-2018-6084
HIGH 7.8
Insufficiently sanitized distributed objects in Updater in Google Chrome on macOS prior to 66.0.3359.117 allowed a local attacker to execute arbitrary code via… |
|
CVE-2018-16083
HIGH 8.8
An out of bounds read in forward error correction code in WebRTC in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to perform an out of bounds m… |
|
CVE-2018-16071
HIGH 8.8
A use after free in WebRTC in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to potentially exploit heap corruption via a crafted video file. |
|
CVE-2016-9651
HIGH 8.8
A missing check for whether a property of a JS object is private in V8 in Google Chrome prior to 55.0.2883.75 allowed a remote attacker to execute arbitrary co… |
|
CVE-2019-0568
HIGH 7.5
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Eng… |
|
CVE-2019-0567
HIGH 7.5
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Eng… |
|
CVE-2019-0566
HIGH 8.8
An elevation of privilege vulnerability exists in Microsoft Edge Browser Broker COM object, aka "Microsoft Edge Elevation of Privilege Vulnerability." This aff… |
|
CVE-2019-0539
HIGH 7.5
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Eng… |
|
CVE-2019-0574
HIGH · vendor
Windows Data Sharing Service Elevation of Privilege Vulnerability |
|
CVE-2019-0573
HIGH · vendor
Windows Data Sharing Service Elevation of Privilege Vulnerability |
|
CVE-2019-0572
HIGH · vendor
Windows Data Sharing Service Elevation of Privilege Vulnerability |
|
CVE-2019-0571
HIGH · vendor
Windows Data Sharing Service Elevation of Privilege Vulnerability |
|
CVE-2019-0570
HIGH · vendor
Windows Runtime Elevation of Privilege Vulnerability |
|
CVE-2019-0555
HIGH · vendor
Microsoft XmlDocument Elevation of Privilege Vulnerability |
|
CVE-2019-0552
HIGH · vendor
Windows COM Elevation of Privilege Vulnerability |
|
CVE-2019-0543
Microsoft Windows Elevation of Privilege Vulnerability |
|
CVE-2018-8617
HIGH 7.5
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Eng… |
|
CVE-2018-6092
HIGH 8.8
An integer overflow on 32-bit systems in WebAssembly in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code inside a sandb… |
|
CVE-2018-6065
HIGH 8.8
Integer overflow in computing the required allocation size when instantiating a new javascript object in V8 in Google Chrome prior to 65.0.3325.146 allowed a r… |
|
CVE-2018-6064
HIGH 8.8
Type Confusion in the implementation of __defineGetter__ in V8 in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to potentially exploit heap co… |
|
CVE-2018-17463
HIGH 8.8
Incorrect side effect annotation in V8 in Google Chrome prior to 70.0.3538.64 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafte… |
|
CVE-2018-8584
HIGH · vendor
Windows ALPC Elevation of Privilege Vulnerability |
|
CVE-2018-8550
HIGH · vendor
Windows COM Elevation of Privilege Vulnerability |
|
CVE-2018-8544
CRITICAL · vendor
Windows VBScript Engine Remote Code Execution Vulnerability |
|
CVE-2018-8453
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Elevation of Privil… |
Manage your fleet with Appaloosa
Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.