Vulnerabilities
Tracked app vulnerabilities
18,214 CVEs affect a tracked app or OS (High, all platforms). 296 of them are in the CISA KEV catalog, meaning exploitation is confirmed.
- Matching CVEs
- 18,214
- Actively exploited
- 296
- Publication window
- 2004-07-27 → 2026-11-11
Chronological sort: newest to oldest. Use the KEV / severity filters above to prioritize.
| CVE |
|---|
|
CVE-2025-50175
HIGH · vendor
Windows Digital Media Elevation of Privilege Vulnerability |
|
CVE-2025-50152
HIGH · vendor
Windows Kernel Elevation of Privilege Vulnerability |
|
CVE-2025-48813
HIGH · vendor
Virtual Secure Mode Spoofing Vulnerability |
|
CVE-2025-48004
HIGH · vendor
Microsoft Brokering File System Elevation of Privilege Vulnerability |
|
CVE-2025-47827
MITRE CVE-2025-47827: Secure Boot bypass in IGEL OS before 11 |
|
CVE-2025-25004
HIGH · vendor
PowerShell Elevation of Privilege Vulnerability |
|
CVE-2025-24990
Windows Agere Modem Driver Elevation of Privilege Vulnerability |
|
CVE-2025-24052
HIGH · vendor
Windows Agere Modem Driver Elevation of Privilege Vulnerability |
|
CVE-2025-31718
HIGH 7.5
In modem, there is a possible system crash due to improper input validation. This could lead to remote escalation of privilege with no additional execution pri… |
|
CVE-2025-31717
HIGH 7.5
In modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privilege… |
|
CVE-2025-47354
HIGH 7.8
Memory corruption while allocating buffers in DSP service. |
|
CVE-2025-47351
HIGH 7.8
Memory corruption while processing user buffers. |
|
CVE-2025-27054
HIGH 7.8
Memory corruption while processing a malformed license file during reboot. |
|
CVE-2025-27053
HIGH 7.8
Memory corruption during PlayReady APP usecase while processing TA commands. |
|
CVE-2025-10892
HIGH 8.8
Integer overflow in V8 in Google Chrome prior to 140.0.7339.207 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chro… |
|
CVE-2025-10891
HIGH 8.8
Integer overflow in V8 in Google Chrome prior to 140.0.7339.207 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chro… |
|
CVE-2025-10502
HIGH 8.8
Heap buffer overflow in ANGLE in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap corruption via malicious network t… |
|
CVE-2025-10501
HIGH 8.8
Use after free in WebRTC in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Ch… |
|
CVE-2025-10500
HIGH 8.8
Use after free in Dawn in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chro… |
|
CVE-2025-21488
HIGH 8.2
Information disclosure while decoding this RTP packet headers received by UE from the network when the padding bit is set. |
|
CVE-2025-21487
HIGH 8.2
Information disclosure while decoding RTP packet received by UE from the network, when payload length mentioned is greater than the available buffer length. |
|
CVE-2025-21484
HIGH 8.2
Information disclosure when UE receives the RTP packet from the network, while decoding and reassembling the fragments from RTP packet. |
|
CVE-2025-21482
HIGH 7.1
Cryptographic issue while performing RSA PKCS padding decoding. |
|
CVE-2025-59216
HIGH 7.0
Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Graphics Component allows an authorized attacker to el… |
|
CVE-2025-59215
HIGH 7.0
Use after free in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally. |
|
CVE-2025-10537
HIGH 8.8
Memory safety bugs present in Firefox ESR 140.2, Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142. Some of these bugs showed evidence of memory corruptio… |
|
CVE-2025-10534
HIGH 8.1
Spoofing issue in the Site Permissions component. This vulnerability was fixed in Firefox 143 and Thunderbird 143. |
|
CVE-2025-10533
HIGH 8.8
Integer overflow in the SVG component. This vulnerability was fixed in Firefox 143, Firefox ESR 115.28, Firefox ESR 140.3, Thunderbird 143, and Thunderbird 140… |
|
CVE-2025-10528
HIGH 7.3
Sandbox escape due to undefined behavior, invalid pointer in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 143, Firefox ESR 140.3, … |
|
CVE-2025-10527
HIGH 7.1
Sandbox escape due to use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 143, Firefox ESR 140.3, Thunderbird 143, and … |
|
CVE-2025-43372
The issue was addressed with improved input validation. This issue is fixed in iOS 26 and iPadOS 26, macOS Sonoma 14.8.2, macOS Tahoe 26, tvOS 26, visionOS 26,… |
|
CVE-2025-43371
HIGH 8.2
This issue was addressed with improved checks. This issue is fixed in Xcode 26. An app may be able to break out of its sandbox. |
|
CVE-2025-43358
A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in iOS 18.7 and iPadOS 18.7, iOS 26 and iPadOS 26, macOS Sequoia 15… |
|
CVE-2025-43341
HIGH 7.8
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sonoma 14.8, macOS Tahoe 26. An app may be able to gain root privi… |
|
CVE-2025-43340
HIGH 7.8
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26. An app may be able to break out of its sandbox. |
|
CVE-2025-43333
HIGH 7.8
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26. An app may be able to gain root privileges. |
|
CVE-2025-43330
HIGH 8.2
This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.7, macOS Tahoe 26. An app may be able to break out of its san… |
|
CVE-2025-43329
A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26 and iPadOS 26, macOS Tahoe 26, tvOS 26, watchOS 26. An app may be… |
|
CVE-2025-43316
HIGH 7.8
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26, visionOS 26. A malicious app may be able to gain root pr… |
|
CVE-2025-43304
HIGH 7.0
A race condition was addressed with improved state handling. This issue is fixed in macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26. An app may be able t… |
|
CVE-2025-43298
HIGH 7.8
A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Sequoia 15.7, macOS Sonoma 14.8, m… |
|
CVE-2025-43287
HIGH 7.1
The issue was addressed with improved memory handling. This issue is fixed in macOS Tahoe 26. Processing a maliciously crafted image may corrupt process memory. |
|
CVE-2025-43286
HIGH 7.8
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26. An app may be abl… |
|
CVE-2025-43263
HIGH 7.1
The issue was addressed with improved checks. This issue is fixed in Xcode 26. An app may be able to read and write files outside of its sandbox. |
|
CVE-2025-43204
HIGH 7.8
This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Tahoe 26. An app may be able to break out of its sandbox. |
|
CVE-2025-31271
HIGH 7.5
This issue was addressed through improved state management. This issue is fixed in macOS Tahoe 26. Incoming FaceTime calls can appear or be accepted on a locke… |
|
CVE-2025-24088
HIGH 7.5
The issue was addressed by adding additional logic. This issue is fixed in macOS Tahoe 26. An app may be able to override MDM-enforced settings from profiles. |
|
CVE-2025-59375
libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing. |
|
CVE-2025-9086
1. A cookie is set using the `secure` keyword for `https://target` 2. curl is redirected to or otherwise made to speak with `http://target` (same hostname, … |
|
CVE-2025-10201
HIGH 8.8
Inappropriate implementation in Mojo in Google Chrome on Android, Linux, ChromeOS prior to 140.0.7339.127 allowed a remote attacker to bypass site isolation vi… |
Manage your fleet with Appaloosa
Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.