Vulnerabilities
Tracked app vulnerabilities
18,214 CVEs affect a tracked app or OS (High, all platforms). 296 of them are in the CISA KEV catalog, meaning exploitation is confirmed.
- Matching CVEs
- 18,214
- Actively exploited
- 296
- Publication window
- 2004-07-27 → 2026-11-11
Chronological sort: newest to oldest. Use the KEV / severity filters above to prioritize.
| CVE |
|---|
|
CVE-2026-24285
HIGH · vendor
Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-33636
HIGH · vendor
LIBPNG has ARM NEON Palette Expansion Out-of-Bounds Read on AArch64 |
|
CVE-2026-26132
HIGH · vendor
Windows Kernel Elevation of Privilege Vulnerability |
|
CVE-2026-26128
HIGH · vendor
Windows SMB Server Elevation of Privilege Vulnerability |
|
CVE-2026-26111
HIGH · vendor
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability |
|
CVE-2026-25190
HIGH · vendor
Windows GDI Remote Code Execution Vulnerability |
|
CVE-2026-25189
HIGH · vendor
Windows DWM Core Library Elevation of Privilege Vulnerability |
|
CVE-2026-25188
HIGH · vendor
Windows Telephony Service Elevation of Privilege Vulnerability |
|
CVE-2026-25187
HIGH · vendor
Winlogon Elevation of Privilege Vulnerability |
|
CVE-2026-25186
HIGH · vendor
Windows Accessibility Infrastructure (ATBroker.exe) Information Disclosure Vulnerability |
|
CVE-2026-25185
HIGH · vendor
Windows Shell Link Processing Spoofing Vulnerability |
|
CVE-2026-25181
HIGH · vendor
GDI+ Information Disclosure Vulnerability |
|
CVE-2026-25179
HIGH · vendor
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability |
|
CVE-2026-25178
HIGH · vendor
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability |
|
CVE-2026-25177
HIGH · vendor
Active Directory Domain Services Elevation of Privilege Vulnerability |
|
CVE-2026-25176
HIGH · vendor
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability |
|
CVE-2026-25175
HIGH · vendor
Windows NTFS Elevation of Privilege Vulnerability |
|
CVE-2026-25174
HIGH · vendor
Windows Extensible File Allocation Table Elevation of Privilege Vulnerability |
|
CVE-2026-25173
HIGH · vendor
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability |
|
CVE-2026-25172
HIGH · vendor
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability |
|
CVE-2026-25171
HIGH · vendor
Windows Authentication Elevation of Privilege Vulnerability |
|
CVE-2026-25170
HIGH · vendor
Windows Hyper-V Elevation of Privilege Vulnerability |
|
CVE-2026-25169
HIGH · vendor
Windows Graphics Component Denial of Service Vulnerability |
|
CVE-2026-25168
HIGH · vendor
Windows Graphics Component Denial of Service Vulnerability |
|
CVE-2026-25167
HIGH · vendor
Microsoft Brokering File System Elevation of Privilege Vulnerability |
|
CVE-2026-25165
HIGH · vendor
Performance Counters for Windows Elevation of Privilege Vulnerability |
|
CVE-2026-24297
HIGH · vendor
Windows Kerberos Security Feature Bypass Vulnerability |
|
CVE-2026-24296
HIGH · vendor
Windows Device Association Service Elevation of Privilege Vulnerability |
|
CVE-2026-24295
HIGH · vendor
Windows Device Association Service Elevation of Privilege Vulnerability |
|
CVE-2026-24292
HIGH · vendor
Windows Connected Devices Platform Service Elevation of Privilege Vulnerability |
|
CVE-2026-24291
HIGH · vendor
Windows Accessibility Infrastructure (ATBroker.exe) Elevation of Privilege Vulnerability |
|
CVE-2026-24290
HIGH · vendor
Windows Projected File System Elevation of Privilege Vulnerability |
|
CVE-2026-24288
HIGH · vendor
Windows Mobile Broadband Driver Remote Code Execution Vulnerability |
|
CVE-2026-24287
HIGH · vendor
Windows Kernel Elevation of Privilege Vulnerability |
|
CVE-2026-24283
HIGH · vendor
Multiple UNC Provider Kernel Driver Elevation of Privilege Vulnerability |
|
CVE-2026-24282
HIGH · vendor
Push message Routing Service Elevation of Privilege Vulnerability |
|
CVE-2026-23674
HIGH · vendor
MapUrlToZone Security Feature Bypass Vulnerability |
|
CVE-2026-23673
HIGH · vendor
Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability |
|
CVE-2026-23672
HIGH · vendor
Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability |
|
CVE-2026-23671
HIGH · vendor
Windows Bluetooth RFCOM Protocol Driver Elevation of Privilege Vulnerability |
|
CVE-2026-23669
HIGH · vendor
RPC Runtime Library Remote Code Execution Vulnerability |
|
CVE-2026-23668
HIGH · vendor
Windows Graphics Component Elevation of Privilege Vulnerability |
|
CVE-2026-23667
HIGH · vendor
Broadcast DVR Elevation of Privilege Vulnerability |
|
CVE-2026-3544
HIGH 8.8
Heap buffer overflow in WebCodecs in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to perform an out of bounds memory write via a crafted HTM… |
|
CVE-2026-3543
HIGH 8.8
Inappropriate implementation in V8 in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to potentially perform out of bounds memory access via a … |
|
CVE-2026-3542
HIGH 8.8
Inappropriate implementation in WebAssembly in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to perform out of bounds memory access via a cra… |
|
CVE-2026-3541
HIGH 8.8
Inappropriate implementation in CSS in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to perform an out of bounds memory read via a crafted HT… |
|
CVE-2026-3540
HIGH 8.8
Inappropriate implementation in WebAudio in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to perform out of bounds memory access via a crafte… |
|
CVE-2026-3538
HIGH 8.8
Integer overflow in Skia in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HT… |
|
CVE-2026-3537
HIGH 8.8
Object lifecycle issue in PowerVR in Google Chrome on Android prior to 145.0.7632.159 allowed a remote attacker to potentially exploit heap corruption via a cr… |
Manage your fleet with Appaloosa
Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.