Vulnerabilities
Tracked app vulnerabilities
27,643 CVEs affect a tracked app or OS (all severities, all platforms). 377 of them are in the CISA KEV catalog, meaning exploitation is confirmed.
- Matching CVEs
- 27,643
- Actively exploited
- 377
- Publication window
- 2004-07-27 → 2026-11-10
Chronological sort: newest to oldest. Use the KEV / severity filters above to prioritize.
| CVE |
|---|
|
CVE-2026-20526
HIGH · vendor
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2026-20525
HIGH · vendor
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2026-20524
HIGH · vendor
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2026-20522
HIGH · vendor
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2026-20521
HIGH · vendor
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2026-20520
CRITICAL · vendor
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2026-20519
CRITICAL · vendor
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2026-16280
HIGH · vendor
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2026-11891
HIGH · vendor
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2025-22442
HIGH · vendor
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2025-0647
HIGH · vendor
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2026-74912
CRITICAL 9.8
On GPU systems with the security vulnerability fix for CVE-2026-49746 applied, the mapping range of graphics buffers is limited which causes errors when the ma… |
|
CVE-2026-65587
MEDIUM 5.5
A web page that contains unusual WebGPU content loaded into the GPU GLES render process can trigger an OOB write in the GPU user-space driver, leading to memor… |
|
CVE-2026-65586
HIGH 7.1
Software installed and run as a non-privileged user may conduct improper GPU system calls to free memory in still in use, replace with another allocation and c… |
|
CVE-2026-19199
HIGH 7.1
Software installed and run as a non-privileged user may conduct improper system calls to allocate physical memory. A 32-bit integer overflow in the KM driver d… |
|
CVE-2026-18629
HIGH 7.5
A web page that contains unusual GPU shader code is loaded into the GPU compiler process and can lead memory allocation failure. If the allocation failure is n… |
|
CVE-2026-15466
HIGH 7.0
Software installed and run as a non-privileged user may conduct improper GPU system calls to cause race condition in hardware performance counters buffer’s des… |
|
CVE-2026-76031
HIGH 8.8
Incorrect authorization in Input in Google Chrome prior to 156.0.8078.79 allowed a remote attacker leveraging social engineering to bypass web origin policy vi… |
|
CVE-2026-76030
HIGH 8.8
Incorrect authorization in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker leveraging social engineering to potentially execute ar… |
|
CVE-2026-76029
HIGH 8.8
Improper input validation in Network in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via crafted… |
|
CVE-2026-76028
HIGH 8.8
Incorrect authorization in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker leveraging social engineering to execute arbitrary code… |
|
CVE-2026-76027
MEDIUM 4.3
Information loss in CacheStorage in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromi… |
|
CVE-2026-76026
HIGH 8.8
Origin validation error in Autofill in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chr… |
|
CVE-2026-76025
HIGH 8.8
Incorrect authorization in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker leveraging social engineering to execute arbitrary code… |
|
CVE-2026-76024
MEDIUM 6.5
Use after free in MediaStream in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML… |
|
CVE-2026-119272
MEDIUM 4.3
Incorrect authorization in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker leveraging social engineering to obtain sensitive infor… |
|
CVE-2026-119271
HIGH 8.8
Uninitialized resource in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker who had compromised the renderer process to read memory outsid… |
|
CVE-2026-119270
HIGH 8.8
Incorrect reference resolution in CacheStorage in Google Chrome prior to 156.0.8078.79 allowed a remote attacker who had compromised the renderer process to ob… |
|
CVE-2026-119269
HIGH 8.8
Incorrect authorization in Blink in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromi… |
|
CVE-2026-119268
HIGH 8.8
Use after free in Editing in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML pag… |
|
CVE-2026-119267
HIGH 8.8
Use after free in DOM in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (… |
|
CVE-2026-119266
HIGH 8.8
Incorrect reference resolution in Quota in Google Chrome prior to 156.0.8078.79 allowed a remote attacker who had compromised the renderer process to potential… |
|
CVE-2026-119265
HIGH 8.8
Incorrect reference resolution in Quota in Google Chrome prior to 156.0.8078.79 allowed a remote attacker who had compromised the renderer process to execute a… |
|
CVE-2026-119264
HIGH 8.8
Use after free in Dawn in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafte… |
|
CVE-2026-119263
CRITICAL 9.6
Use after free in GarbageCollection in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafte… |
|
CVE-2026-119262
HIGH 8.8
Out of bounds write in V8 in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML pag… |
|
CVE-2026-119261
CRITICAL 9.6
Buffer overflow in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker who had compromised the renderer process to potentially execute arbit… |
|
CVE-2026-119260
HIGH 8.8
Use after free in Frames in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page… |
|
CVE-2026-112605
LOW 3.3
This issue was addressed with improved handling of symlinks. This issue is fixed in Xcode 27.2. An app may be able to read arbitrary files. |
|
CVE-2026-112602
LOW 3.3
An authorization issue was addressed with improved state management. This issue is fixed in Xcode 27.2. An app may be able to access sensitive user data. |
|
CVE-2026-85330
MEDIUM 4.3
Incorrect authorization in Microsoft Edge for Android allows an unauthorized attacker to bypass a security feature over a network. |
|
CVE-2026-118359
HIGH 8.8
Use after free in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (C… |
|
CVE-2026-118358
HIGH 8.8
Use after free in WebAudio in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML pa… |
|
CVE-2026-118357
HIGH 8.8
Use after free in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML… |
|
CVE-2026-118356
HIGH 8.8
Use after free in WTF in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted … |
|
CVE-2026-118355
CRITICAL 9.6
Use after free in Command in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML pag… |
|
CVE-2026-118354
HIGH 8.8
Uninitialized resource in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium… |
|
CVE-2026-118353
HIGH 8.8
Missing authorization in Paint in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium… |
|
CVE-2026-118352
HIGH 8.8
Use after free in Cache in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page… |
|
CVE-2026-118351
HIGH 8.8
Use after free in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page.… |
Manage your fleet with Appaloosa
Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.