Tracked app vulnerabilities

Use of uninitialized resource in Kernel Transaction Manager allows an authorized attacker to disclose information locally.

Use of uninitialized resource in Windows Program Compatibility Assistant Service allows an authorized attacker to disclose information locally.

Out-of-bounds read in Windows iSCSI allows an authorized attacker to disclose information over a network.

Buffer over-read in Windows Performance Counters allows an authorized attacker to disclose information locally.

Use of uninitialized resource in Windows Graphics Kernel allows an authorized attacker to disclose information locally.

Use after free in Windows Filtering Platform (WFP) allows an authorized attacker to elevate privileges locally.

Out-of-bounds read in Graphic Fonts allows an authorized attacker to disclose information over a network.

Improper authentication in Windows SSDP Service allows an authorized attacker to elevate privileges locally.

Processor optimization removal or modification of security-critical code in AMD Zen allows an authorized attacker to disclose information locally.

Processor optimization removal or modification of security-critical code in AMD Zen allows an authorized attacker to disclose information locally.

Out-of-bounds read in HID Parser Library allows an unauthorized attacker to elevate privileges with a physical attack.

Time-of-check time-of-use (toctou) race condition in Windows Security Account Manager allows an unauthorized attacker to bypass a security feature over a netwo…

Use of uninitialized resource in Kernel Transaction Manager allows an authorized attacker to disclose information locally.

Heap-based buffer overflow in HID Parser Library allows an unauthorized attacker to elevate privileges with a physical attack.

Heap-based buffer overflow in Windows USB Driver allows an unauthorized attacker to elevate privileges with a physical attack.

Integer underflow (wrap or wraparound) in Windows Update Stack allows an authorized attacker to disclose information locally.

Improper access control in Windows BitLocker allows an authorized attacker to bypass a security feature with a physical attack.

Improper access control in Windows DHCP Server allows an unauthorized attacker to perform spoofing over a network.

Improper access control in Windows FileCrypt Driver allows an authorized attacker to disclose information locally.

Improper access control in Windows FileCrypt Driver allows an authorized attacker to bypass a security feature over a network.

Improper access control in Windows FileCrypt Driver allows an authorized attacker to disclose information locally.

Improper access control in Windows Composite Image File System allows an authorized attacker to disclose information locally.

Improper access control in Windows Cloud Files Mini Filter Driver allows an authorized attacker to disclose information locally.

MEDIUM 4.7

2026-11-10

Uninitialized resource in WebGL in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (…

MEDIUM 4.7

2026-11-10

Uninitialized resource in GPU in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Ch…

MEDIUM 4.3

Mozilla Firefox

2026-11-10

Information disclosure in the Marionette component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.

MEDIUM 4.3

2026-11-10

Information disclosure in the Security: RLBox component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.

MEDIUM 4.3

2026-11-10

Information disclosure in the Address Bar component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.

MEDIUM 4.3

2026-11-10

Information disclosure in the Layout: Form Controls component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird…

MEDIUM 4.3

Mozilla Firefox

2026-11-10

Information disclosure in the Layout component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.

MEDIUM 4.3

2026-11-10

Information disclosure in the Private Browsing component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.…

A logic issue was addressed with improved state management. This issue is fixed in iOS 18.7.12 and iPadOS 18.7.12, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and…

This issue was addressed with improved checks. This issue is fixed in iOS 18.7.12 and iPadOS 18.7.12, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.…

A logic issue was addressed with improved state management. This issue is fixed in iOS 18.7.12 and iPadOS 18.7.12, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and…

An authorization issue was addressed with improved state management. This issue is fixed in iOS 27.2.1 and iPadOS 27.2.1, visionOS 27.2.1, watchOS 27.2.1. An a…

MEDIUM 5.4

2026-11-03

Incorrect authorization in Blink in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromi…

MEDIUM 6.5

2026-11-03

Incorrect authorization in Autofill AI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (…

MEDIUM 6.5

2026-11-03

Information leak in Select in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium…

MEDIUM 6.5

2026-11-03

Incorrect authorization in API in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via a crafted Chrome exte…

MEDIUM 5.3

2026-11-03

Race condition in Autofill in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially obtain sensitive information via a crafted HTML pag…

MEDIUM 5.4

2026-11-03

UI misrepresentation in FileAPI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a craf…

MEDIUM 6.5

2026-11-03

Information leak in Frames in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium…

MEDIUM 6.5

2026-11-03

Improper input validation in WebPackaging in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via crafted network tra…

MEDIUM 4.3

2026-11-03

Improper input validation in Variations in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via crafted netw…

MEDIUM 6.5

2026-11-03

Information leak in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium secur…

MEDIUM 6.5

2026-11-03

Improper state validation in FileSystem in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access…

MEDIUM 6.5

2026-11-03

Information leak in Paint in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium …

MEDIUM 5.1

2026-11-03

Incorrect authorization in Core in Google Chrome prior to 157.0.8103.38 allowed a local attacker leveraging social engineering to obtain sensitive information …

MEDIUM 6.5

2026-11-03

Incorrect authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via a crafted HTML p…

MEDIUM 6.5

2026-11-03

Incorrect authorization in Permissions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access …