Vulnerabilities
Tracked app vulnerabilities
27,728 CVEs affect a tracked app or OS (all severities, all platforms). 377 of them are in the CISA KEV catalog, meaning exploitation is confirmed.
- Matching CVEs
- 27,728
- Actively exploited
- 377
- Publication window
- 2004-07-27 → 2026-11-11
Chronological sort: newest to oldest. Use the KEV / severity filters above to prioritize.
| CVE |
|---|
|
CVE-2025-43335
MEDIUM 5.5
The issue was addressed by adding additional logic. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1. An app may be able to a… |
|
CVE-2025-43334
MEDIUM 5.5
This issue was addressed with additional entitlement checks. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1. An app may be … |
|
CVE-2025-43323
This issue was addressed with additional entitlement checks. This issue is fixed in iOS 26 and iPadOS 26, macOS Tahoe 26, tvOS 26, visionOS 26, watchOS 26. An … |
|
CVE-2025-43322
MEDIUM 5.5
A logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1. An app may be able to acc… |
|
CVE-2025-43309
LOW 2.4
A logic issue was addressed with improved checks. This issue is fixed in iOS 26 and iPadOS 26. An attacker with physical access to an iOS device may be able to… |
|
CVE-2025-43288
MEDIUM 5.5
This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Sequoia 15.7, macOS Tahoe 26. An app may be able to bypass Privacy … |
|
CVE-2025-6442
HIGH · vendor
[Apple Ruby] Multiple issues in ruby |
|
CVE-2025-53906
MEDIUM · vendor
[Apple Vim] A path handling issue was addressed with improved validation |
|
CVE-2024-49761
HIGH · vendor
[Apple Ruby] Multiple issues in ruby |
|
CVE-2024-43398
MEDIUM · vendor
[Apple Ruby] Multiple issues in ruby |
|
CVE-2025-6075
MEDIUM 5.5
If the value passed to os.path.expandvars() is user-controlled a performance degradation is possible when expanding environment variables. |
|
CVE-2025-12380
CRITICAL 9.8
Starting with Firefox 142, it was possible for a compromised child process to trigger a use-after-free in the GPU or browser process using WebGPU-related IPC c… |
|
CVE-2025-54957
An issue was discovered in Dolby UDC 4.5 through 4.13. A crash of the DD+ decoder process can occur when a malformed DD+ bitstream is processed. When Evolution… |
|
CVE-2025-43313
MEDIUM 5.5
A logic issue was addressed with improved restrictions. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app may be abl… |
|
CVE-2025-43282
A double free issue was addressed with improved memory management. This issue is fixed in iOS 18.6 and iPadOS 18.6, iPadOS 17.7.9, macOS Sequoia 15.6, macOS So… |
|
CVE-2025-43281
HIGH 7.8
The issue was addressed with improved authentication. This issue is fixed in macOS Sequoia 15.6. A local attacker may be able to elevate their privileges. |
|
CVE-2025-43280
MEDIUM 4.7
The issue was resolved by not loading remote images. This issue is fixed in iOS 18.6 and iPadOS 18.6. Forwarding an email could display remote images in Mail i… |
|
CVE-2025-59284
LOW 3.3
Exposure of sensitive information to an unauthorized actor in Windows NTLM allows an unauthorized attacker to perform spoofing locally. |
|
CVE-2025-59257
MEDIUM 6.5
Improper validation of specified type of input in Windows Local Session Manager (LSM) allows an authorized attacker to deny service over a network. |
|
CVE-2025-59243
HIGH 7.8
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
|
CVE-2025-59241
HIGH 7.8
Improper link resolution before file access ('link following') in Windows Health and Optimized Experiences Service allows an authorized attacker to elevate pri… |
|
CVE-2025-59238
HIGH 7.8
Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally. |
|
CVE-2025-59236
HIGH 8.4
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
|
CVE-2025-59235
HIGH 7.1
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. |
|
CVE-2025-59234
HIGH 7.8
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. |
|
CVE-2025-59233
HIGH 7.8
Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
|
CVE-2025-59232
HIGH 7.1
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. |
|
CVE-2025-59231
HIGH 7.8
Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
|
CVE-2025-59229
MEDIUM 5.5
Uncaught exception in Microsoft Office allows an unauthorized attacker to deny service locally. |
|
CVE-2025-59227
HIGH 7.8
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. |
|
CVE-2025-59226
HIGH 7.8
Use after free in Microsoft Office Visio allows an unauthorized attacker to execute code locally. |
|
CVE-2025-59225
HIGH 7.8
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
|
CVE-2025-59224
HIGH 7.8
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
|
CVE-2025-59223
HIGH 7.8
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
|
CVE-2025-59222
HIGH 7.8
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally. |
|
CVE-2025-59221
HIGH 7.0
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally. |
|
CVE-2025-59210
HIGH 7.4
Windows Resilient File System (ReFS) Deduplication Service Elevation of Privilege Vulnerability |
|
CVE-2025-59206
HIGH 7.4
Windows Resilient File System (ReFS) Deduplication Service Elevation of Privilege Vulnerability |
|
CVE-2025-59189
HIGH 7.4
Use after free in Microsoft Brokering File System allows an unauthorized attacker to elevate privileges locally. |
|
CVE-2025-55698
HIGH 7.7
Null pointer dereference in Windows DirectX allows an authorized attacker to deny service over a network. |
|
CVE-2025-55697
HIGH 7.8
Heap-based buffer overflow in Azure Local allows an authorized attacker to elevate privileges locally. |
|
CVE-2025-55694
HIGH 7.8
Improper access control in Windows Error Reporting allows an authorized attacker to elevate privileges locally. |
|
CVE-2025-55693
HIGH 7.4
Use after free in Windows Kernel allows an unauthorized attacker to elevate privileges locally. |
|
CVE-2025-55691
HIGH 7.0
Use after free in Windows PrintWorkflowUserSvc allows an authorized attacker to elevate privileges locally. |
|
CVE-2025-55690
HIGH 7.0
Use after free in Windows PrintWorkflowUserSvc allows an authorized attacker to elevate privileges locally. |
|
CVE-2025-55689
HIGH 7.0
Use after free in Windows PrintWorkflowUserSvc allows an authorized attacker to elevate privileges locally. |
|
CVE-2025-55688
HIGH 7.0
Use after free in Windows PrintWorkflowUserSvc allows an authorized attacker to elevate privileges locally. |
|
CVE-2025-55686
HIGH 7.0
Use after free in Windows PrintWorkflowUserSvc allows an authorized attacker to elevate privileges locally. |
|
CVE-2025-55684
HIGH 7.0
Use after free in Windows PrintWorkflowUserSvc allows an authorized attacker to elevate privileges locally. |
|
CVE-2025-55682
MEDIUM 6.1
Improper enforcement of behavioral workflow in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack. |
Manage your fleet with Appaloosa
Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.