Vulnerabilities
Tracked app vulnerabilities
27,728 CVEs affect a tracked app or OS (all severities, all platforms). 377 of them are in the CISA KEV catalog, meaning exploitation is confirmed.
- Matching CVEs
- 27,728
- Actively exploited
- 377
- Publication window
- 2004-07-27 → 2026-11-11
Chronological sort: newest to oldest. Use the KEV / severity filters above to prioritize.
| CVE |
|---|
|
CVE-2026-6319
HIGH 7.5
Use after free in Payments in Google Chrome on Android prior to 147.0.7727.101 allowed a remote attacker who convinced a user to engage in specific UI gestures… |
|
CVE-2026-6318
HIGH 8.8
Use after free in Codecs in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.… |
|
CVE-2026-6317
HIGH 8.8
Use after free in Cast in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security… |
|
CVE-2026-6316
HIGH 8.8
Use after free in Forms in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. … |
|
CVE-2026-6315
HIGH 8.8
Use after free in Permissions in Google Chrome on Android prior to 147.0.7727.101 allowed a remote attacker who convinced a user to engage in specific UI gestu… |
|
CVE-2026-6314
HIGH 8.3
Out of bounds write in GPU in Google Chrome prior to 147.0.7727.101 allowed a remote attacker who had compromised the GPU process to potentially perform a sand… |
|
CVE-2026-6313
LOW 3.1
Insufficient policy enforcement in CORS in Google Chrome prior to 147.0.7727.101 allowed a remote attacker who had compromised the renderer process to leak cro… |
|
CVE-2026-6312
LOW 3.1
Insufficient policy enforcement in Passwords in Google Chrome prior to 147.0.7727.101 allowed a remote attacker who had compromised the renderer process to lea… |
|
CVE-2026-6311
HIGH 8.3
Uninitialized Use in Accessibility in Google Chrome on Windows prior to 147.0.7727.101 allowed a remote attacker who had compromised the renderer process to po… |
|
CVE-2026-6310
HIGH 8.3
Use after free in Dawn in Google Chrome prior to 147.0.7727.101 allowed a remote attacker who had compromised the renderer process to potentially perform a san… |
|
CVE-2026-6309
HIGH 8.3
Use after free in Viz in Google Chrome prior to 147.0.7727.101 allowed a remote attacker who had compromised the renderer process to potentially perform a sand… |
|
CVE-2026-6308
HIGH 7.5
Out of bounds read in Media in Google Chrome prior to 147.0.7727.101 allowed a remote attacker who convinced a user to engage in specific UI gestures to execut… |
|
CVE-2026-6307
HIGH 8.8
Type Confusion in Turbofan in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML pag… |
|
CVE-2026-6306
HIGH 8.8
Heap buffer overflow in PDFium in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF … |
|
CVE-2026-6305
HIGH 8.8
Heap buffer overflow in PDFium in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF … |
|
CVE-2026-6304
HIGH 8.3
Use after free in Graphite in Google Chrome prior to 147.0.7727.101 allowed a remote attacker who had compromised the renderer process to potentially perform a… |
|
CVE-2026-6303
HIGH 8.8
Use after free in Codecs in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.… |
|
CVE-2026-6302
HIGH 8.8
Use after free in Video in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. … |
|
CVE-2026-6301
HIGH 8.8
Type Confusion in Turbofan in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML pag… |
|
CVE-2026-6300
HIGH 8.8
Use after free in CSS in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (C… |
|
CVE-2026-6299
HIGH 8.8
Use after free in Prerender in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium sec… |
|
CVE-2026-6298
MEDIUM 4.3
Heap buffer overflow in Skia in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to obtain potentially sensitive information from process memory… |
|
CVE-2026-6297
HIGH 8.3
Use after free in Proxy in Google Chrome prior to 147.0.7727.101 allowed an attacker in a privileged network position to potentially perform a sandbox escape v… |
|
CVE-2026-6296
CRITICAL 9.6
Heap buffer overflow in ANGLE in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML pag… |
|
CVE-2026-33829
MEDIUM 4.3
Exposure of sensitive information to an unauthorized actor in Windows Snipping Tool allows an unauthorized attacker to perform spoofing over a network. |
|
CVE-2026-33827
HIGH 8.1
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows TCP/IP allows an unauthorized attacker to execute code o… |
|
CVE-2026-33826
HIGH 8.0
Improper input validation in Windows Active Directory allows an authorized attacker to execute code over an adjacent network. |
|
CVE-2026-33824
Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network. |
|
CVE-2026-33822
MEDIUM 6.1
Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information locally. |
|
CVE-2026-33115
HIGH 8.4
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally. |
|
CVE-2026-33114
HIGH 8.4
Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code locally. |
|
CVE-2026-33104
HIGH 7.0
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K - GRFX allows an authorized attacker to elevate p… |
|
CVE-2026-33101
HIGH 7.8
Use after free in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-33100
HIGH 7.0
Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-33099
HIGH 7.0
Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-33098
HIGH 7.8
Use after free in Windows Container Isolation FS Filter Driver allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-33096
HIGH 7.5
Out-of-bounds read in Windows HTTP.sys allows an unauthorized attacker to deny service over a network. |
|
CVE-2026-33095
HIGH 7.8
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally. |
|
CVE-2026-32225
HIGH 8.8
Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security featu… |
|
CVE-2026-32224
HIGH 7.0
Use after free in Windows Server Update Service allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-32223
MEDIUM 6.8
Heap-based buffer overflow in Windows USB Print Driver allows an unauthorized attacker to elevate privileges with a physical attack. |
|
CVE-2026-32222
HIGH 7.8
Untrusted pointer dereference in Windows Win32K - ICOMP allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-32221
HIGH 8.4
Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code locally. |
|
CVE-2026-32220
MEDIUM 4.4
Improper access control in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to bypass a security feature locally. |
|
CVE-2026-32219
HIGH 7.0
Double free in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-32218
MEDIUM 5.5
Insertion of sensitive information into log file in Windows Kernel allows an authorized attacker to disclose information locally. |
|
CVE-2026-32217
MEDIUM 5.5
Insertion of sensitive information into log file in Windows Kernel allows an authorized attacker to disclose information locally. |
|
CVE-2026-32216
MEDIUM 5.5
Null pointer dereference in Windows Redirected Drive Buffering allows an authorized attacker to deny service locally. |
|
CVE-2026-32215
MEDIUM 5.5
Insertion of sensitive information into log file in Windows Kernel allows an authorized attacker to disclose information locally. |
|
CVE-2026-32214
MEDIUM 5.5
Improper access control in Universal Plug and Play (upnp.dll) allows an authorized attacker to disclose information locally. |
Manage your fleet with Appaloosa
Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.