Vulnerabilities
Tracked app vulnerabilities
18,849 CVEs affect a tracked app or OS (all severities, Windows). 305 of them are in the CISA KEV catalog, meaning exploitation is confirmed.
- Matching CVEs
- 18,849
- Actively exploited
- 305
- Publication window
- 2004-07-27 → 2026-11-11
Chronological sort: newest to oldest. Use the KEV / severity filters above to prioritize.
| CVE |
|---|
|
CVE-2021-21113
HIGH 8.8
Heap buffer overflow in Skia in Google Chrome prior to 87.0.4280.141 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
|
CVE-2021-21112
HIGH 8.8
Use after free in Blink in Google Chrome prior to 87.0.4280.141 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
|
CVE-2021-21111
CRITICAL 9.6
Insufficient policy enforcement in WebUI in Google Chrome prior to 87.0.4280.141 allowed an attacker who convinced a user to install a malicious extension to p… |
|
CVE-2021-21110
CRITICAL 9.6
Use after free in safe browsing in Google Chrome prior to 87.0.4280.141 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML pa… |
|
CVE-2021-21109
CRITICAL 9.6
Use after free in payments in Google Chrome prior to 87.0.4280.141 allowed a remote attacker who had compromised the renderer process to potentially perform a … |
|
CVE-2021-21108
CRITICAL 9.6
Use after free in media in Google Chrome prior to 87.0.4280.141 allowed a remote attacker who had compromised the renderer process to potentially perform a san… |
|
CVE-2021-21107
CRITICAL 9.6
Use after free in drag and drop in Google Chrome on Linux prior to 87.0.4280.141 allowed a remote attacker who had compromised the renderer process to potentia… |
|
CVE-2021-21106
CRITICAL 9.6
Use after free in autofill in Google Chrome prior to 87.0.4280.141 allowed a remote attacker who had compromised the renderer process to potentially perform a … |
|
CVE-2020-16043
HIGH 8.8
Insufficient data validation in networking in Google Chrome prior to 87.0.4280.141 allowed a remote attacker to bypass discretionary access control via malicio… |
|
CVE-2020-16042
MEDIUM 6.5
Uninitialized Use in V8 in Google Chrome prior to 87.0.4280.88 allowed a remote attacker to obtain potentially sensitive information from process memory via a … |
|
CVE-2020-16041
HIGH 8.1
Out of bounds read in networking in Google Chrome prior to 87.0.4280.88 allowed a remote attacker who had compromised the renderer process to obtain potentiall… |
|
CVE-2020-16040
MEDIUM 6.5
Insufficient data validation in V8 in Google Chrome prior to 87.0.4280.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML p… |
|
CVE-2020-16039
HIGH 8.8
Use after free in extensions in Google Chrome prior to 87.0.4280.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
|
CVE-2020-16038
HIGH 8.8
Use after free in media in Google Chrome on OS X prior to 87.0.4280.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
|
CVE-2020-16037
HIGH 8.8
Use after free in clipboard in Google Chrome prior to 87.0.4280.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
|
CVE-2020-16036
MEDIUM 6.5
Inappropriate implementation in cookies in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to bypass cookie restrictions via a crafted HTML page. |
|
CVE-2020-16035
HIGH 8.8
Insufficient data validation in cros-disks in Google Chrome on ChromeOS prior to 87.0.4280.66 allowed a remote attacker who had compromised the browser process… |
|
CVE-2020-16034
MEDIUM 4.3
Inappropriate implementation in WebRTC in Google Chrome prior to 87.0.4280.66 allowed a local attacker to bypass policy restrictions via a crafted HTML page. |
|
CVE-2020-16033
MEDIUM 4.3
Inappropriate implementation in WebUSB in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to spoof security UI via a crafted HTML page. |
|
CVE-2020-16032
MEDIUM 4.3
Insufficient data validation in sharing in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a c… |
|
CVE-2020-16031
MEDIUM 4.3
Insufficient data validation in UI in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafte… |
|
CVE-2020-16030
MEDIUM 6.1
Insufficient data validation in Blink in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted… |
|
CVE-2020-16029
HIGH 8.8
Inappropriate implementation in PDFium in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to bypass navigation restrictions via a crafted PDF fil… |
|
CVE-2020-16028
HIGH 8.8
Heap buffer overflow in WebRTC in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
|
CVE-2020-16027
MEDIUM 6.5
Insufficient policy enforcement in developer tools in Google Chrome prior to 87.0.4280.66 allowed an attacker who convinced a user to install a malicious exten… |
|
CVE-2020-16026
HIGH 8.8
Use after free in WebRTC in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
|
CVE-2020-16025
CRITICAL 9.6
Heap buffer overflow in clipboard in Google Chrome prior to 87.0.4280.66 allowed a remote attacker who had compromised the renderer process to potentially perf… |
|
CVE-2020-16024
CRITICAL 9.6
Heap buffer overflow in UI in Google Chrome prior to 87.0.4280.66 allowed a remote attacker who had compromised the renderer process to potentially perform a s… |
|
CVE-2020-16023
HIGH 8.8
Use after free in WebCodecs in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
|
CVE-2020-16022
HIGH 8.8
Insufficient policy enforcement in networking in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to potentially bypass firewall controls via a cr… |
|
CVE-2020-16021
HIGH 7.5
Race in image burner in Google Chrome on ChromeOS prior to 87.0.4280.66 allowed a remote attacker who had compromised the browser process to perform OS-level p… |
|
CVE-2020-16020
HIGH 8.8
Inappropriate implementation in cryptohome in Google Chrome on ChromeOS prior to 87.0.4280.66 allowed a remote attacker who had compromised the browser process… |
|
CVE-2020-16019
HIGH 8.8
Inappropriate implementation in filesystem in Google Chrome on ChromeOS prior to 87.0.4280.66 allowed a remote attacker who had compromised the browser process… |
|
CVE-2020-16018
CRITICAL 9.6
Use after free in payments in Google Chrome prior to 87.0.4280.66 allowed a remote attacker who had compromised the renderer process to potentially perform a s… |
|
CVE-2020-16017
CRITICAL 9.6
Use after free in site isolation in Google Chrome prior to 86.0.4240.198 allowed a remote attacker who had compromised the renderer process to potentially perf… |
|
CVE-2020-16016
CRITICAL 9.6
Inappropriate implementation in base in Google Chrome prior to 86.0.4240.193 allowed a remote attacker who had compromised the renderer process to potentially … |
|
CVE-2020-16015
HIGH 8.8
Insufficient data validation in WASM in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML… |
|
CVE-2020-16014
CRITICAL 9.6
Use after free in PPAPI in Google Chrome prior to 87.0.4280.66 allowed a remote attacker who had compromised the renderer process to potentially perform a sand… |
|
CVE-2020-16013
HIGH 8.8
Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.198 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML … |
|
CVE-2020-16012
MEDIUM 4.3
Side-channel information leakage in graphics in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
|
CVE-2020-26664
HIGH 7.8
A vulnerability in EbmlTypeDispatcher::send in VideoLAN VLC media player 3.0.11 allows attackers to trigger a heap-based buffer overflow via a crafted .mkv fil… |
|
CVE-2020-35113
HIGH 8.8
Mozilla developers reported memory safety bugs present in Firefox 83 and Firefox ESR 78.5. Some of these bugs showed evidence of memory corruption and we presu… |
|
CVE-2020-35112
HIGH 8.8
If a user downloaded a file lacking an extension on Windows, and then "Open"-ed it from the downloads panel, if there was an executable file in the downloads d… |
|
CVE-2020-35111
MEDIUM 4.3
When an extension with the proxy permission registered to receive <all_urls>, the proxy.onRequest callback was not triggered for view-source URLs. While web co… |
|
CVE-2020-26978
MEDIUM 6.1
Using techniques that built on the slipstream research, a malicious webpage could have exposed both an internal network's hosts as well as services running on … |
|
CVE-2020-26974
HIGH 8.8
When flex-basis was used on a table wrapper, a StyleGenericFlexBasis object could have been incorrectly cast to the wrong type. This resulted in a heap user-af… |
|
CVE-2020-26973
HIGH 8.8
Certain input to the CSS Sanitizer confused it, resulting in incorrect components being removed. This could have been used as a sanitizer bypass. This vulnerab… |
|
CVE-2020-26971
HIGH 8.8
Certain blit values provided by the user were not properly constrained leading to a heap buffer overflow on some video drivers. This vulnerability affects Fire… |
|
CVE-2020-17131
MEDIUM 4.2
Chakra Scripting Engine Memory Corruption Vulnerability |
|
CVE-2020-17130
MEDIUM 6.5
Microsoft Excel Security Feature Bypass Vulnerability |
Manage your fleet with Appaloosa
Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.