Vulnerabilities
Tracked app vulnerabilities
2,721 CVEs affect a tracked app or OS (Critical, all platforms). 48 of them are in the CISA KEV catalog, meaning exploitation is confirmed.
- Matching CVEs
- 2,721
- Actively exploited
- 48
- Publication window
- 2007-08-28 → 2026-11-10
Chronological sort: newest to oldest. Use the KEV / severity filters above to prioritize.
| CVE |
|---|
|
CVE-2026-0906
CRITICAL 9.8
Incorrect security UI in Google Chrome on Android prior to 144.0.7559.59 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafte… |
|
CVE-2026-0905
CRITICAL 9.8
Insufficient policy enforcement in Network in Google Chrome prior to 144.0.7559.59 allowed an attack who obtained a network log file to potentially obtain pote… |
|
CVE-2026-0892
CRITICAL 9.8
Memory safety bugs present in Firefox 146 and Thunderbird 146. Some of these bugs showed evidence of memory corruption and we presume that with enough effort s… |
|
CVE-2026-0884
CRITICAL 9.8
Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 147, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7. |
|
CVE-2026-0881
CRITICAL 10.0
Sandbox escape in the Messaging System component. This vulnerability was fixed in Firefox 147 and Thunderbird 147. |
|
CVE-2026-0879
CRITICAL 9.8
Sandbox escape due to incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 147, Firefox ESR 115.32, Firefox ESR 140… |
|
CVE-2025-14860
CRITICAL 9.8
Use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 146.0.1. |
|
CVE-2025-43526
This issue was addressed with improved URL validation. This issue is fixed in Safari 26.2, macOS Tahoe 26.2. On a Mac with Lockdown Mode enabled, web content o… |
|
CVE-2025-43428
A configuration issue was addressed with additional restrictions. This issue is fixed in iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, visionOS 26.2. Photos in t… |
|
CVE-2025-14330
CRITICAL 9.8
JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 14… |
|
CVE-2025-14326
CRITICAL 9.8
Use-after-free in the Audio/Video: GMP component. This vulnerability was fixed in Firefox 146 and Thunderbird 146. |
|
CVE-2025-14324
CRITICAL 9.8
JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 146, Firefox ESR 115.31, Firefox ESR 140.6, Thunderbird 146… |
|
CVE-2025-14321
CRITICAL 9.8
Use-after-free in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6. |
|
CVE-2025-48626
CRITICAL 9.8
In multiple locations, there is a possible way to launch an application from the background due to a precondition check failure. This could lead to remote esca… |
|
CVE-2025-47372
CRITICAL · vendor
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2025-47319
CRITICAL · vendor
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2025-60724
CRITICAL · vendor
Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network. |
|
CVE-2025-13026
CRITICAL 9.8
Sandbox escape due to incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 145 and Thunderbird 145. |
|
CVE-2025-13024
CRITICAL 9.8
JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 145 and Thunderbird 145. |
|
CVE-2025-13023
CRITICAL 9.8
Sandbox escape due to incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 145 and Thunderbird 145. |
|
CVE-2025-13022
CRITICAL 9.8
Incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 145 and Thunderbird 145. |
|
CVE-2025-13021
CRITICAL 9.8
Incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 145 and Thunderbird 145. |
|
CVE-2025-60716
CRITICAL · vendor
DirectX Graphics Kernel Elevation of Privilege Vulnerability |
|
CVE-2025-12380
CRITICAL 9.8
Starting with Firefox 142, it was possible for a compromised child process to trigger a use-after-free in the GPU or browser process using WebGPU-related IPC c… |
|
CVE-2025-54957
An issue was discovered in Dolby UDC 4.5 through 4.13. A crash of the DD+ decoder process can occur when a malformed DD+ bitstream is processed. When Evolution… |
|
CVE-2025-11721
CRITICAL 9.8
Memory safety bug present in Firefox 143 and Thunderbird 143. This bug showed evidence of memory corruption and we presume that with enough effort this could h… |
|
CVE-2025-11719
CRITICAL 9.8
Starting in Thunderbird 143, the use of the native messaging API by web extensions on Windows could lead to crashes caused by use-after-free memory corruption.… |
|
CVE-2025-11717
CRITICAL 9.1
When switching between Android apps using the card carousel Firefox shows a black screen as its card image when a password-related screen was the last one bein… |
|
CVE-2025-11710
CRITICAL 9.8
A compromised web process using malicious IPC messages could have caused the privileged browser process to reveal blocks of its memory to the compromised proce… |
|
CVE-2025-11709
CRITICAL 9.8
A compromised web process was able to trigger out of bounds reads and writes in a more privileged process using manipulated WebGL textures. This vulnerability … |
|
CVE-2025-11708
CRITICAL 9.8
Use-after-free in MediaTrackGraphImpl::GetInstance(). This vulnerability was fixed in Firefox 144, Firefox ESR 140.4, Thunderbird 144, and Thunderbird 140.4. |
|
CVE-2025-59287
Windows Server Update Service (WSUS) Remote Code Execution Vulnerability |
|
CVE-2025-49708
CRITICAL · vendor
Microsoft Graphics Component Elevation of Privilege Vulnerability |
|
CVE-2025-39946
CRITICAL 9.8
In the Linux kernel, the following vulnerability has been resolved: tls: make sure to abort the stream if headers are bogus Normally we wait for the socket t… |
|
CVE-2025-10890
CRITICAL 9.1
Side-channel information leakage in V8 in Google Chrome prior to 140.0.7339.207 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (C… |
|
CVE-2025-10585
CRITICAL 9.8
KEV
Type confusion in V8 in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromi… |
|
CVE-2025-43362
CRITICAL 9.8
The issue was addressed with improved checks. This issue is fixed in iOS 18.7 and iPadOS 18.7, iOS 26 and iPadOS 26. An app may be able to monitor keystrokes w… |
|
CVE-2025-43359
A logic issue was addressed with improved state management. This issue is fixed in iOS 18.7 and iPadOS 18.7, iOS 26 and iPadOS 26, macOS Sequoia 15.7, macOS So… |
|
CVE-2025-43347
This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 26 and iPadOS 26, macOS Tahoe 26, tvOS 26, visionOS 26, watchOS 26. An inp… |
|
CVE-2025-43343
The issue was addressed with improved memory handling. This issue is fixed in Safari 26, iOS 26 and iPadOS 26, macOS Tahoe 26, tvOS 26, visionOS 26, watchOS 26… |
|
CVE-2025-43342
A correctness issue was addressed with improved checks. This issue is fixed in Safari 26, iOS 18.7 and iPadOS 18.7, iOS 26 and iPadOS 26, macOS Tahoe 26, tvOS … |
|
CVE-2025-31255
An authorization issue was addressed with improved state management. This issue is fixed in iOS 26 and iPadOS 26, macOS Sequoia 15.7, macOS Sonoma 14.8, macOS … |
|
CVE-2025-53799
CRITICAL · vendor
Use of uninitialized resource in Windows Imaging Component allows an unauthorized attacker to disclose information locally. |
|
CVE-2025-55236
CRITICAL · vendor
Graphics Kernel Remote Code Execution Vulnerability |
|
CVE-2025-55228
CRITICAL · vendor
Windows Graphics Component Remote Code Execution Vulnerability |
|
CVE-2025-55226
CRITICAL · vendor
Graphics Kernel Remote Code Execution Vulnerability |
|
CVE-2025-55224
CRITICAL · vendor
Windows Hyper-V Remote Code Execution Vulnerability |
|
CVE-2025-54918
CRITICAL · vendor
Windows NTLM Elevation of Privilege Vulnerability |
|
CVE-2025-53800
CRITICAL · vendor
Windows Graphics Component Elevation of Privilege Vulnerability |
|
CVE-2025-39682
In the Linux kernel, the following vulnerability has been resolved: tls: fix handling of zero-length records on the rx_list Each recvmsg() call must process … |
Manage your fleet with Appaloosa
Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.