Vulnerabilities
Tracked app vulnerabilities
18,849 CVEs affect a tracked app or OS (all severities, Windows). 305 of them are in the CISA KEV catalog, meaning exploitation is confirmed.
- Matching CVEs
- 18,849
- Actively exploited
- 305
- Publication window
- 2004-07-27 → 2026-11-11
Chronological sort: newest to oldest. Use the KEV / severity filters above to prioritize.
| CVE |
|---|
|
CVE-2023-21555
CRITICAL · vendor
Windows Layer 2 Tunneling Protocol (L2TP) Remote Code Execution Vulnerability |
|
CVE-2023-21552
HIGH · vendor
Windows GDI Elevation of Privilege Vulnerability |
|
CVE-2023-21551
CRITICAL · vendor
Microsoft Cryptographic Services Elevation of Privilege Vulnerability |
|
CVE-2023-21550
HIGH · vendor
Windows Cryptographic Information Disclosure Vulnerability |
|
CVE-2023-21549
HIGH · vendor
Windows SMB Witness Service Elevation of Privilege Vulnerability |
|
CVE-2023-21548
CRITICAL · vendor
Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability |
|
CVE-2023-21547
HIGH · vendor
Internet Key Exchange (IKE) Protocol Denial of Service Vulnerability |
|
CVE-2023-21546
CRITICAL · vendor
Windows Layer 2 Tunneling Protocol (L2TP) Remote Code Execution Vulnerability |
|
CVE-2023-21543
CRITICAL · vendor
Windows Layer 2 Tunneling Protocol (L2TP) Remote Code Execution Vulnerability |
|
CVE-2023-21542
HIGH · vendor
Windows Installer Elevation of Privilege Vulnerability |
|
CVE-2023-21541
HIGH · vendor
Windows Task Scheduler Elevation of Privilege Vulnerability |
|
CVE-2023-21540
HIGH · vendor
Windows Cryptographic Information Disclosure Vulnerability |
|
CVE-2023-21539
HIGH · vendor
Windows Authentication Remote Code Execution Vulnerability |
|
CVE-2023-21537
HIGH · vendor
Microsoft Message Queuing (MSMQ) Elevation of Privilege Vulnerability |
|
CVE-2023-21536
HIGH · vendor
Event Tracing for Windows Information Disclosure Vulnerability |
|
CVE-2023-21535
CRITICAL · vendor
Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability |
|
CVE-2023-21532
HIGH · vendor
Windows GDI Elevation of Privilege Vulnerability |
|
CVE-2023-21527
HIGH · vendor
Windows iSCSI Service Denial of Service Vulnerability |
|
CVE-2023-21525
HIGH · vendor
Remote Procedure Call Runtime Denial of Service Vulnerability |
|
CVE-2023-21524
HIGH · vendor
Windows Local Security Authority (LSA) Elevation of Privilege Vulnerability |
|
CVE-2022-4025
MEDIUM 4.3
Inappropriate implementation in Paint in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to leak cross-origin data outside an iframe via a crafte… |
|
CVE-2022-3863
MEDIUM 6.1
Use after free in Browser History in Google Chrome prior to 100.0.4896.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML p… |
|
CVE-2022-3842
HIGH 7.5
Use after free in Passwords in Google Chrome prior to 105.0.5195.125 allowed a remote attacker who had compromised the renderer process to potentially exploit … |
|
CVE-2022-2743
HIGH 8.8
Integer overflow in Window Manager in Google Chrome on Chrome OS and Lacros prior to 104.0.5112.79 allowed a remote attacker who convinced a user to engage in … |
|
CVE-2022-2742
HIGH 8.8
Use after free in Exosphere in Google Chrome on Chrome OS and Lacros prior to 104.0.5112.79 allowed a remote attacker who convinced a user to engage in specifi… |
|
CVE-2022-0801
MEDIUM 6.1
Inappropriate implementation in HTML parser in Google Chrome prior to 99.0.4844.51 allowed a remote attacker to bypass XSS preventions via a crafted HTML page.… |
|
CVE-2022-0337
MEDIUM 6.5
Inappropriate implementation in File System API in Google Chrome on Windows prior to 97.0.4692.71 allowed a remote attacker to obtain potentially sensitive inf… |
|
CVE-2021-30558
HIGH 8.8
Insufficient policy enforcement in content security policy in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass content security policy v… |
|
CVE-2021-21200
MEDIUM 5.4
Out of bounds read in WebUI Settings in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to perform an out of bounds memory read via a crafted HTM… |
|
CVE-2019-13768
HIGH 7.4
Use after free in FileAPI in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Ch… |
|
CVE-2022-46882
CRITICAL 9.8
A use-after-free in WebGL extensions could have led to a potentially exploitable crash. This vulnerability affects Firefox < 107, Firefox ESR < 102.6, and Thun… |
|
CVE-2022-46881
HIGH 8.8
An optimization in WebGL was incorrect in some cases, and could have led to memory corruption and a potentially exploitable crash. *Note*: This advisory was ad… |
|
CVE-2022-46880
MEDIUM 6.5
A missing check related to tex units could have led to a use-after-free and potentially exploitable crash.<br />*Note*: This advisory was added on December 13t… |
|
CVE-2022-46878
HIGH 8.8
Mozilla developers Randell Jesup, Valentin Gosu, Olli Pettay, and the Mozilla Fuzzing Team reported memory safety bugs present in Thunderbird 102.5. Some of th… |
|
CVE-2022-46875
MEDIUM 6.5
The executable file warning was not presented when downloading .atloc and .ftploc files, which can run commands on a user's computer. <br>*Note: This issue onl… |
|
CVE-2022-46874
HIGH 8.8
A file with a long filename could have had its filename truncated to remove the valid extension, leaving a malicious extension in its place. This could potenti… |
|
CVE-2022-46872
HIGH 8.6
An attacker who compromised a content process could have partially escaped the sandbox to read arbitrary files via clipboard-related IPC messages.<br>*This bug… |
|
CVE-2022-45421
HIGH 8.8
Mozilla developers Andrew McCreight and Gabriele Svelto reported memory safety bugs present in Thunderbird 102.4. Some of these bugs showed evidence of memory … |
|
CVE-2022-45420
MEDIUM 6.5
Use tables inside of an iframe, an attacker could have caused iframe contents to be rendered outside the boundaries of the iframe, resulting in potential user … |
|
CVE-2022-45418
MEDIUM 6.1
If a custom mouse cursor is specified in CSS, under certain circumstances the cursor could have been drawn over the browser UI, resulting in potential user con… |
|
CVE-2022-45416
MEDIUM 6.5
Keyboard events reference strings like "KeyA" that were at fixed, known, and widely-spread addresses. Cache-based timing attacks such as Prime+Probe could have… |
|
CVE-2022-45414
HIGH 8.1
If a Thunderbird user quoted from an HTML email, for example by replying to the email, and the email contained either a VIDEO tag with the POSTER attribute or … |
|
CVE-2022-45412
HIGH 8.8
When resolving a symlink such as <code>file:///proc/self/fd/1</code>, an error message may be produced where the symlink was resolved to a string containing un… |
|
CVE-2022-45411
MEDIUM 6.1
Cross-Site Tracing occurs when a server will echo a request back via the Trace method, allowing an XSS attack to access to authorization headers and cookies in… |
|
CVE-2022-45410
MEDIUM · vendor
When a ServiceWorker intercepted a request with <code>FetchEvent</code>, the origin of the request was lost after the ServiceWorker took ownership of it. This … |
|
CVE-2022-45409
HIGH 8.8
The garbage collector could have been aborted in several states and zones and <code>GCRuntime::finishCollection</code> may not have been called, leading to a u… |
|
CVE-2022-45408
MEDIUM 6.5
Through a series of popups that reuse windowName, an attacker can cause a window to go fullscreen without the user seeing the notification prompt, resulting in… |
|
CVE-2022-45406
CRITICAL 9.8
If an out-of-memory condition occurred when creating a JavaScript global, a JavaScript realm may be deleted while references to it lived on in a BaseShape. Thi… |
|
CVE-2022-45405
MEDIUM 6.5
Freeing arbitrary <code>nsIInputStream</code>'s on a different thread than creation could have led to a use-after-free and potentially exploitable crash. This … |
|
CVE-2022-45404
MEDIUM 6.5
Through a series of popup and <code>window.print()</code> calls, an attacker can cause a window to go fullscreen without the user seeing the notification promp… |
Manage your fleet with Appaloosa
Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.