Vulnerabilities
Tracked app vulnerabilities
357 CVEs affect a tracked app or OS (High, Windows). 245 of them are in the CISA KEV catalog, meaning exploitation is confirmed.
- Matching CVEs
- 357
- Actively exploited
- 245
- Publication window
- 2009-10-13 → 2026-02-13
Chronological sort: newest to oldest. Use the KEV / severity filters above to prioritize.
| CVE |
|---|
|
CVE-2026-2441
HIGH 8.8
KEV
Use after free in CSS in Google Chrome prior to 145.0.7632.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Ch… |
|
CVE-2026-21250
HIGH · vendor
Windows HTTP.sys Elevation of Privilege Vulnerability |
|
CVE-2026-21248
HIGH · vendor
Windows Hyper-V Remote Code Execution Vulnerability |
|
CVE-2026-21244
HIGH · vendor
Windows Hyper-V Remote Code Execution Vulnerability |
|
CVE-2025-11001
HIGH 7.8
7-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affecte… |
|
CVE-2025-59254
HIGH · vendor
Microsoft DWM Core Library Elevation of Privilege Vulnerability |
|
CVE-2025-50154
HIGH · vendor
Microsoft Windows File Explorer Spoofing Vulnerability |
|
CVE-2025-6965
There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns available. This could lead… |
|
CVE-2025-49744
HIGH · vendor
Windows Graphics Component Elevation of Privilege Vulnerability |
|
CVE-2025-49730
HIGH · vendor
Microsoft Windows QoS Scheduler Driver Elevation of Privilege Vulnerability |
|
CVE-2025-49683
HIGH · vendor
Microsoft Virtual Hard Disk Remote Code Execution Vulnerability |
|
CVE-2025-49677
HIGH · vendor
Microsoft Brokering File System Elevation of Privilege Vulnerability |
|
CVE-2025-47987
HIGH · vendor
Credential Security Support Provider Protocol (CredSSP) Elevation of Privilege Vulnerability |
|
CVE-2025-47175
HIGH 7.8
Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally. |
|
CVE-2025-47165
HIGH 7.8
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
|
CVE-2025-33073
Windows SMB Client Elevation of Privilege Vulnerability |
|
CVE-2025-30397
Scripting Engine Memory Corruption Vulnerability |
|
CVE-2025-27751
HIGH 7.8
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
|
CVE-2025-2783
HIGH 8.3
KEV
Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 134.0.6998.177 allowed a remote attacker to perform a sandb… |
|
CVE-2025-26633
Improper neutralization in Microsoft Management Console allows an unauthorized attacker to bypass a security feature locally. |
|
CVE-2025-24076
HIGH · vendor
Microsoft Windows Cross Device Service Elevation of Privilege Vulnerability |
|
CVE-2025-24071
HIGH · vendor
Microsoft Windows File Explorer Spoofing Vulnerability |
|
CVE-2025-24054
NTLM Hash Disclosure Spoofing Vulnerability |
|
CVE-2025-21333
Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability |
|
CVE-2024-49138
Windows Common Log File System Driver Elevation of Privilege Vulnerability |
|
CVE-2024-38193
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability |
|
CVE-2024-4367
HIGH 8.8
A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. This vulnerability affects Fire… |
|
CVE-2024-21338
Windows Kernel Elevation of Privilege Vulnerability |
|
CVE-2024-21320
HIGH · vendor
Windows Themes Spoofing Vulnerability |
|
CVE-2023-44487
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the w… |
|
CVE-2023-33131
HIGH 8.8
Microsoft Outlook Remote Code Execution Vulnerability |
|
CVE-2023-29336
Win32k Elevation of Privilege Vulnerability |
|
CVE-2023-28293
HIGH · vendor
Windows Kernel Elevation of Privilege Vulnerability |
|
CVE-2023-23399
HIGH 7.8
Microsoft Excel Remote Code Execution Vulnerability |
|
CVE-2023-21752
HIGH · vendor
Windows Backup Service Elevation of Privilege Vulnerability |
|
CVE-2019-5797
HIGH 7.5
Double free in DOMStorage in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
|
CVE-2020-6507
HIGH 8.8
Out of bounds write in V8 in Google Chrome prior to 83.0.4103.106 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
|
CVE-2019-17026
HIGH 8.8
KEV
Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion. We are aware of targeted attacks in the wild a… |
|
CVE-2020-6418
HIGH 8.8
Type confusion in V8 in Google Chrome prior to 80.0.3987.122 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
|
CVE-2020-0683
Windows Installer Elevation of Privilege Vulnerability |
|
CVE-2020-0601
Windows CryptoAPI Spoofing Vulnerability |
|
CVE-2019-1458
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privil… |
|
CVE-2019-1476
HIGH · vendor
Windows Elevation of Privilege Vulnerability |
|
CVE-2019-13720
HIGH 8.8
Use after free in WebAudio in Google Chrome prior to 78.0.3904.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
|
CVE-2019-1405
An elevation of privilege vulnerability exists when the Windows Universal Plug and Play (UPnP) service improperly allows COM object creation, aka 'Windows UPnP… |
|
CVE-2019-1347
HIGH · vendor
Windows Denial of Service Vulnerability |
|
CVE-2019-1346
HIGH · vendor
Windows Denial of Service Vulnerability |
|
CVE-2019-1345
HIGH · vendor
Windows Kernel Information Disclosure Vulnerability |
|
CVE-2019-1344
HIGH · vendor
Windows Code Integrity Module Information Disclosure Vulnerability |
|
CVE-2019-1343
HIGH · vendor
Windows Denial of Service Vulnerability |
Manage your fleet with Appaloosa
Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.