Vulnerabilities
Tracked app vulnerabilities
18,849 CVEs affect a tracked app or OS (all severities, Windows). 305 of them are in the CISA KEV catalog, meaning exploitation is confirmed.
- Matching CVEs
- 18,849
- Actively exploited
- 305
- Publication window
- 2004-07-27 → 2026-11-11
Chronological sort: newest to oldest. Use the KEV / severity filters above to prioritize.
| CVE |
|---|
|
CVE-2024-43627
HIGH · vendor
Windows Telephony Service Remote Code Execution Vulnerability |
|
CVE-2024-43626
HIGH · vendor
Windows Telephony Service Elevation of Privilege Vulnerability |
|
CVE-2024-43625
CRITICAL · vendor
Microsoft Windows VMSwitch Elevation of Privilege Vulnerability |
|
CVE-2024-43624
HIGH · vendor
Windows Hyper-V Shared Virtual Disk Elevation of Privilege Vulnerability |
|
CVE-2024-43623
HIGH · vendor
Windows NT OS Kernel Elevation of Privilege Vulnerability |
|
CVE-2024-43622
HIGH · vendor
Windows Telephony Service Remote Code Execution Vulnerability |
|
CVE-2024-43621
HIGH · vendor
Windows Telephony Service Remote Code Execution Vulnerability |
|
CVE-2024-43620
HIGH · vendor
Windows Telephony Service Remote Code Execution Vulnerability |
|
CVE-2024-43530
HIGH · vendor
Windows Update Stack Elevation of Privilege Vulnerability |
|
CVE-2024-43452
HIGH · vendor
Windows Registry Elevation of Privilege Vulnerability |
|
CVE-2024-43451
NTLM Hash Disclosure Spoofing Vulnerability |
|
CVE-2024-43450
HIGH · vendor
Windows DNS Spoofing Vulnerability |
|
CVE-2024-43449
HIGH · vendor
Windows USB Video Class System Driver Elevation of Privilege Vulnerability |
|
CVE-2024-43447
HIGH · vendor
Windows SMBv3 Server Remote Code Execution Vulnerability |
|
CVE-2024-38264
HIGH · vendor
Microsoft Virtual Hard Disk (VHDX) Denial of Service Vulnerability |
|
CVE-2024-38203
HIGH · vendor
Windows Package Library Manager Information Disclosure Vulnerability |
|
CVE-2024-10827
HIGH 8.8
Use after free in Serial in Google Chrome prior to 130.0.6723.116 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Ch… |
|
CVE-2024-10826
HIGH 8.8
Use after free in Family Experiences in Google Chrome on Android prior to 130.0.6723.116 allowed a remote attacker to potentially exploit heap corruption via a… |
|
CVE-2024-10488
HIGH 8.8
Use after free in WebRTC in Google Chrome prior to 130.0.6723.92 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chr… |
|
CVE-2024-10487
HIGH 8.8
Out of bounds write in Dawn in Google Chrome prior to 130.0.6723.92 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (… |
|
CVE-2024-10468
MEDIUM 5.3
Potential race conditions in IndexedDB could have caused memory corruption, leading to a potentially exploitable crash. This vulnerability affects Firefox < 13… |
|
CVE-2024-10467
HIGH 8.8
Memory safety bugs present in Firefox 131, Firefox ESR 128.3, and Thunderbird 128.3. Some of these bugs showed evidence of memory corruption and we presume tha… |
|
CVE-2024-10466
HIGH 7.5
By sending a specially crafted push message, a remote server could have hung the parent process, causing the browser to become unresponsive. This vulnerability… |
|
CVE-2024-10465
MEDIUM 6.5
A clipboard "paste" button could persist across tabs which allowed a spoofing attack. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Thunderbir… |
|
CVE-2024-10464
MEDIUM 6.5
Repeated writes to history interface attributes could have been used to cause a Denial of Service condition in the browser. This was addressed by introducing r… |
|
CVE-2024-10463
MEDIUM 6.5
Video frames could have been leaked between origins in some situations. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Firefox ESR < 115.17, Th… |
|
CVE-2024-10462
MEDIUM 6.5
Truncation of a long URL could have allowed origin spoofing in a permission prompt. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Thunderbird … |
|
CVE-2024-10461
MEDIUM 6.1
In multipart/x-mixed-replace responses, `Content-Disposition: attachment` in the response header was not respected and did not force a download, which could al… |
|
CVE-2024-10460
MEDIUM 5.3
The origin of an external protocol handler prompt could have been obscured using a data: URL within an `iframe`. This vulnerability affects Firefox < 132, Fire… |
|
CVE-2024-10459
HIGH 7.5
An attacker could have caused a use-after-free when accessibility was enabled, leading to a potentially exploitable crash. This vulnerability affects Firefox <… |
|
CVE-2024-10458
HIGH 7.5
A permission leak could have occurred from a trusted site to an untrusted site via `embed` or `object` elements. This vulnerability affects Firefox < 132, Fire… |
|
CVE-2024-10231
HIGH 8.8
Type Confusion in V8 in Google Chrome prior to 130.0.6723.69 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromiu… |
|
CVE-2024-10230
HIGH 8.8
Type Confusion in V8 in Google Chrome prior to 130.0.6723.69 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromiu… |
|
CVE-2024-10229
HIGH 8.1
Inappropriate implementation in Extensions in Google Chrome prior to 130.0.6723.69 allowed a remote attacker to bypass site isolation via a crafted Chrome Exte… |
|
CVE-2024-9287
HIGH 7.8
A vulnerability has been found in the CPython `venv` module and CLI where path names provided when creating a virtual environment were not quoted properly, all… |
|
CVE-2024-9966
MEDIUM 5.3
Inappropriate implementation in Navigations in Google Chrome prior to 130.0.6723.58 allowed a remote attacker to bypass content security policy via a crafted H… |
|
CVE-2024-9965
HIGH 8.8
Insufficient data validation in DevTools in Google Chrome on Windows prior to 130.0.6723.58 allowed a remote attacker who convinced a user to engage in specifi… |
|
CVE-2024-9964
MEDIUM 4.3
Inappropriate implementation in Payments in Google Chrome prior to 130.0.6723.58 allowed a remote attacker who convinced a user to engage in specific UI gestur… |
|
CVE-2024-9963
MEDIUM 4.3
Insufficient data validation in Downloads in Google Chrome prior to 130.0.6723.58 allowed a remote attacker who convinced a user to engage in specific UI gestu… |
|
CVE-2024-9962
MEDIUM 4.3
Inappropriate implementation in Permissions in Google Chrome prior to 130.0.6723.58 allowed a remote attacker who convinced a user to engage in specific UI ges… |
|
CVE-2024-9961
HIGH 8.8
Use after free in ParcelTracking in Google Chrome on iOS prior to 130.0.6723.58 allowed a remote attacker who convinced a user to engage in specific UI gesture… |
|
CVE-2024-9960
HIGH 7.5
Use after free in Dawn in Google Chrome prior to 130.0.6723.58 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chrom… |
|
CVE-2024-9959
HIGH 8.8
Use after free in DevTools in Google Chrome prior to 130.0.6723.58 allowed a remote attacker who had compromised the renderer process to potentially exploit he… |
|
CVE-2024-9958
MEDIUM 4.3
Inappropriate implementation in PictureInPicture in Google Chrome prior to 130.0.6723.58 allowed a remote attacker to perform UI spoofing via a crafted HTML pa… |
|
CVE-2024-9957
HIGH 8.8
Use after free in UI in Google Chrome on iOS prior to 130.0.6723.58 allowed a remote attacker who convinced a user to engage in specific UI gestures to potenti… |
|
CVE-2024-9956
HIGH 7.8
Inappropriate implementation in WebAuthentication in Google Chrome on Android prior to 130.0.6723.58 allowed a local attacker to perform privilege escalation v… |
|
CVE-2024-9955
HIGH 8.8
Use after free in WebAuthentication in Google Chrome prior to 130.0.6723.58 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML… |
|
CVE-2024-9954
HIGH 8.8
Use after free in AI in Google Chrome prior to 130.0.6723.58 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromiu… |
|
CVE-2024-44157
MEDIUM 5.5
A stack buffer overflow was addressed through improved input validation. This issue is fixed in Apple TV 1.5.0.152 for Windows, iTunes 12.13.3 for Windows. Par… |
|
CVE-2024-9859
HIGH 8.8
Type confusion in WebAssembly in Google Chrome prior to 126.0.6478.126 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium s… |
Manage your fleet with Appaloosa
Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.