Vulnerabilities
Tracked app vulnerabilities
27,728 CVEs affect a tracked app or OS (all severities, all platforms). 377 of them are in the CISA KEV catalog, meaning exploitation is confirmed.
- Matching CVEs
- 27,728
- Actively exploited
- 377
- Publication window
- 2004-07-27 → 2026-11-11
Chronological sort: newest to oldest. Use the KEV / severity filters above to prioritize.
| CVE |
|---|
|
CVE-2026-0885
MEDIUM 6.5
Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 147, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7. |
|
CVE-2026-0884
CRITICAL 9.8
Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 147, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7. |
|
CVE-2026-0883
MEDIUM 5.3
Information disclosure in the Networking component. This vulnerability was fixed in Firefox 147, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7. |
|
CVE-2026-0882
HIGH 8.8
Use-after-free in the IPC component. This vulnerability was fixed in Firefox 147, Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7. |
|
CVE-2026-0881
CRITICAL 10.0
Sandbox escape in the Messaging System component. This vulnerability was fixed in Firefox 147 and Thunderbird 147. |
|
CVE-2026-0880
HIGH 8.8
Sandbox escape due to integer overflow in the Graphics component. This vulnerability was fixed in Firefox 147, Firefox ESR 115.32, Firefox ESR 140.7, Thunderbi… |
|
CVE-2026-0879
CRITICAL 9.8
Sandbox escape due to incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 147, Firefox ESR 115.32, Firefox ESR 140… |
|
CVE-2026-0878
HIGH 8.0
Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 147, Firefox ESR 140.7, Thu… |
|
CVE-2026-0877
HIGH 8.1
Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 147, Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird 147, and Thun… |
|
CVE-2026-20833
HIGH · vendor
Windows Kerberos Information Disclosure Vulnerability |
|
CVE-2026-20830
HIGH · vendor
Capability Access Management Service (camsvc) Elevation of Privilege Vulnerability |
|
CVE-2026-20818
HIGH · vendor
Windows Kernel Information Disclosure Vulnerability |
|
CVE-2026-20810
HIGH · vendor
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability |
|
CVE-2026-0386
HIGH · vendor
Windows Deployment Services Remote Code Execution Vulnerability |
|
CVE-2024-55414
HIGH · vendor
Windows Motorola Soft Modem Driver Elevation of Privilege Vulnerability |
|
CVE-2023-31096
HIGH · vendor
MITRE: CVE-2023-31096 Windows Agere Soft Modem Driver Elevation of Privilege Vulnerability |
|
CVE-2025-46299
A memory initialization issue was addressed with improved memory handling. This issue is fixed in Safari 26.2, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, tvOS… |
|
CVE-2025-46298
The issue was addressed with improved memory handling. This issue is fixed in Safari 26.2, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, tvOS 26.2, visionOS 26.2… |
|
CVE-2025-46297
MEDIUM 5.5
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26.2. An app may be able to access protected files within an… |
|
CVE-2025-46286
MEDIUM 4.3
A logic issue was addressed with improved validation. This issue is fixed in iOS 26.2 and iPadOS 26.2. Restoring from a backup may prevent passcode from being … |
|
CVE-2025-14524
When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a cross-protocol redirect to a second URL that uses an IMAP, LDAP, POP3… |
|
CVE-2025-62224
MEDIUM 5.5
User interface (ui) misrepresentation of critical information in Microsoft Edge for Android allows an authorized attacker to perform spoofing over a network. |
|
CVE-2026-0628
HIGH 8.8
Insufficient policy enforcement in WebView tag in Google Chrome prior to 143.0.7499.192 allowed an attacker who convinced a user to install a malicious extensi… |
|
CVE-2025-47396
HIGH 7.8
Memory corruption occurs when a secure application is launched on a device with insufficient memory. |
|
CVE-2025-47395
MEDIUM 6.5
Transient DOS while parsing a WLAN management frame with a Vendor Specific Information Element. |
|
CVE-2025-47394
HIGH 7.8
Memory corruption when copying overlapping buffers during memory operations due to incorrect offset calculations. |
|
CVE-2025-47388
HIGH 7.8
Memory corruption while passing pages to DSP with an unaligned starting address. |
|
CVE-2025-47348
HIGH 7.8
Memory corruption while processing identity credential operations in the trusted application. |
|
CVE-2025-47346
HIGH 7.8
Memory corruption while processing a secure logging command in the trusted application. |
|
CVE-2025-47339
HIGH 7.8
Memory corruption while deinitializing a HDCP session. |
|
CVE-2025-20795
HIGH 7.8
In KeyInstall, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has… |
|
CVE-2025-20794
MEDIUM 6.5
In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service, if a UE has connected to a rogue base… |
|
CVE-2025-20793
MEDIUM 6.5
In Modem, there is a possible system crash due to incorrect error handling. This could lead to remote denial of service, if a UE has connected to a rogue base … |
|
CVE-2025-20762
MEDIUM 6.5
In Modem, there is a possible system crash due to incorrect error handling. This could lead to remote denial of service, if a UE has connected to a rogue base … |
|
CVE-2025-20761
MEDIUM 6.5
In Modem, there is a possible system crash due to incorrect error handling. This could lead to remote denial of service, if a UE has connected to a rogue base … |
|
CVE-2025-20760
MEDIUM 6.5
In Modem, there is a possible read of uninitialized heap data due to an uncaught exception. This could lead to remote denial of service, if a UE has connected … |
|
CVE-2025-14861
HIGH 8.8
Memory safety bugs present in Firefox 146. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could h… |
|
CVE-2025-14860
CRITICAL 9.8
Use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 146.0.1. |
|
CVE-2025-14744
MEDIUM 6.5
Unicode RTLO characters could allow malicious websites to spoof filenames in the downloads UI for Firefox for iOS, potentially tricking users into saving files… |
|
CVE-2025-47323
HIGH 7.8
Memory corruption while routing GPR packets between user and root when handling large data packet. |
|
CVE-2025-46292
MEDIUM 5.5
This issue was addressed with additional entitlement checks. This issue is fixed in iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2. An app may be able … |
|
CVE-2025-46291
HIGH 7.8
A logic issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.7.4, macOS Tahoe 26.2. An app may bypass Gatekeeper checks. |
|
CVE-2025-46288
A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, visionOS 26.2, watchOS 26.2.… |
|
CVE-2025-46283
MEDIUM 5.5
A logic issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.2. An app may be able to… |
|
CVE-2025-46282
The issue was addressed with additional permissions checks. This issue is fixed in Safari 26.2, macOS Tahoe 26.2. An app may be able to access sensitive user d… |
|
CVE-2025-46281
HIGH 8.8
A logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.2. An app may be able to bre… |
|
CVE-2025-46279
A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2… |
|
CVE-2025-46278
MEDIUM 5.5
The issue was addressed with improved handling of caches. This issue is fixed in macOS Tahoe 26.2. An app may be able to access protected user data. |
|
CVE-2025-46277
A logging issue was addressed with improved data redaction. This issue is fixed in iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, watchOS 26.2. An app may be able… |
|
CVE-2025-43541
A type confusion issue was addressed with improved state handling. This issue is fixed in Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, … |
Manage your fleet with Appaloosa
Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.