Vulnerabilities
Tracked app vulnerabilities
18,214 CVEs affect a tracked app or OS (High, all platforms). 296 of them are in the CISA KEV catalog, meaning exploitation is confirmed.
- Matching CVEs
- 18,214
- Actively exploited
- 296
- Publication window
- 2004-07-27 → 2026-11-11
Chronological sort: newest to oldest. Use the KEV / severity filters above to prioritize.
| CVE |
|---|
|
CVE-2026-6315
HIGH 8.8
Use after free in Permissions in Google Chrome on Android prior to 147.0.7727.101 allowed a remote attacker who convinced a user to engage in specific UI gestu… |
|
CVE-2026-6314
HIGH 8.3
Out of bounds write in GPU in Google Chrome prior to 147.0.7727.101 allowed a remote attacker who had compromised the GPU process to potentially perform a sand… |
|
CVE-2026-6311
HIGH 8.3
Uninitialized Use in Accessibility in Google Chrome on Windows prior to 147.0.7727.101 allowed a remote attacker who had compromised the renderer process to po… |
|
CVE-2026-6310
HIGH 8.3
Use after free in Dawn in Google Chrome prior to 147.0.7727.101 allowed a remote attacker who had compromised the renderer process to potentially perform a san… |
|
CVE-2026-6309
HIGH 8.3
Use after free in Viz in Google Chrome prior to 147.0.7727.101 allowed a remote attacker who had compromised the renderer process to potentially perform a sand… |
|
CVE-2026-6308
HIGH 7.5
Out of bounds read in Media in Google Chrome prior to 147.0.7727.101 allowed a remote attacker who convinced a user to engage in specific UI gestures to execut… |
|
CVE-2026-6307
HIGH 8.8
Type Confusion in Turbofan in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML pag… |
|
CVE-2026-6306
HIGH 8.8
Heap buffer overflow in PDFium in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF … |
|
CVE-2026-6305
HIGH 8.8
Heap buffer overflow in PDFium in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF … |
|
CVE-2026-6304
HIGH 8.3
Use after free in Graphite in Google Chrome prior to 147.0.7727.101 allowed a remote attacker who had compromised the renderer process to potentially perform a… |
|
CVE-2026-6303
HIGH 8.8
Use after free in Codecs in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.… |
|
CVE-2026-6302
HIGH 8.8
Use after free in Video in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. … |
|
CVE-2026-6301
HIGH 8.8
Type Confusion in Turbofan in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML pag… |
|
CVE-2026-6300
HIGH 8.8
Use after free in CSS in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (C… |
|
CVE-2026-6299
HIGH 8.8
Use after free in Prerender in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium sec… |
|
CVE-2026-6297
HIGH 8.3
Use after free in Proxy in Google Chrome prior to 147.0.7727.101 allowed an attacker in a privileged network position to potentially perform a sandbox escape v… |
|
CVE-2026-33827
HIGH 8.1
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows TCP/IP allows an unauthorized attacker to execute code o… |
|
CVE-2026-33826
HIGH 8.0
Improper input validation in Windows Active Directory allows an authorized attacker to execute code over an adjacent network. |
|
CVE-2026-33115
HIGH 8.4
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally. |
|
CVE-2026-33114
HIGH 8.4
Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code locally. |
|
CVE-2026-33104
HIGH 7.0
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K - GRFX allows an authorized attacker to elevate p… |
|
CVE-2026-33101
HIGH 7.8
Use after free in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-33100
HIGH 7.0
Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-33099
HIGH 7.0
Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-33098
HIGH 7.8
Use after free in Windows Container Isolation FS Filter Driver allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-33096
HIGH 7.5
Out-of-bounds read in Windows HTTP.sys allows an unauthorized attacker to deny service over a network. |
|
CVE-2026-33095
HIGH 7.8
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally. |
|
CVE-2026-32225
HIGH 8.8
Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security featu… |
|
CVE-2026-32224
HIGH 7.0
Use after free in Windows Server Update Service allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-32222
HIGH 7.8
Untrusted pointer dereference in Windows Win32K - ICOMP allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-32221
HIGH 8.4
Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code locally. |
|
CVE-2026-32219
HIGH 7.0
Double free in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-32200
HIGH 7.8
Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally. |
|
CVE-2026-32199
HIGH 7.8
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
|
CVE-2026-32198
HIGH 7.8
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
|
CVE-2026-32197
HIGH 7.8
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
|
CVE-2026-32195
HIGH 7.0
Stack-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-32190
HIGH 8.4
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. |
|
CVE-2026-32189
HIGH 7.8
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
|
CVE-2026-32188
HIGH 7.1
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. |
|
CVE-2026-32183
HIGH 7.8
Improper neutralization of special elements used in a command ('command injection') in Windows Snipping Tool allows an unauthorized attacker to execute code lo… |
|
CVE-2026-32165
HIGH 7.8
Use after free in Windows User Interface Core allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-32164
HIGH 7.8
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows User Interface Core allows an authorized attacker to ele… |
|
CVE-2026-32163
HIGH 7.8
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows User Interface Core allows an authorized attacker to ele… |
|
CVE-2026-32162
HIGH 8.4
Acceptance of extraneous untrusted data with trusted data in Windows COM allows an unauthorized attacker to elevate privileges locally. |
|
CVE-2026-32160
HIGH 7.8
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Push Notifications allows an authorized attacker to elev… |
|
CVE-2026-32159
HIGH 7.8
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Push Notifications allows an authorized attacker to elev… |
|
CVE-2026-32158
HIGH 7.8
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Push Notifications allows an authorized attacker to elev… |
|
CVE-2026-32157
HIGH 8.8
Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network. |
|
CVE-2026-32156
HIGH 7.4
Use after free in Windows Universal Plug and Play (UPnP) Device Host allows an unauthorized attacker to execute code locally. |
Manage your fleet with Appaloosa
Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.