Vulnerabilities
Tracked app vulnerabilities
2,721 CVEs affect a tracked app or OS (Critical, all platforms). 48 of them are in the CISA KEV catalog, meaning exploitation is confirmed.
- Matching CVEs
- 2,721
- Actively exploited
- 48
- Publication window
- 2007-08-28 → 2026-11-10
Chronological sort: newest to oldest. Use the KEV / severity filters above to prioritize.
| CVE |
|---|
|
CVE-2022-40514
CRITICAL · vendor
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2022-33280
CRITICAL · vendor
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2022-33243
CRITICAL · vendor
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2022-33232
CRITICAL · vendor
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2022-41903
CRITICAL · vendor
Git is distributed revision control system. `git log` can display commits in an arbitrary format using its `--format` specifiers. This functionality is also ex… |
|
CVE-2023-21730
CRITICAL · vendor
Microsoft Cryptographic Services Elevation of Privilege Vulnerability |
|
CVE-2023-21712
CRITICAL · vendor
Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability |
|
CVE-2023-21679
CRITICAL · vendor
Windows Layer 2 Tunneling Protocol (L2TP) Remote Code Execution Vulnerability |
|
CVE-2023-21561
CRITICAL · vendor
Microsoft Cryptographic Services Elevation of Privilege Vulnerability |
|
CVE-2023-21556
CRITICAL · vendor
Windows Layer 2 Tunneling Protocol (L2TP) Remote Code Execution Vulnerability |
|
CVE-2023-21555
CRITICAL · vendor
Windows Layer 2 Tunneling Protocol (L2TP) Remote Code Execution Vulnerability |
|
CVE-2023-21551
CRITICAL · vendor
Microsoft Cryptographic Services Elevation of Privilege Vulnerability |
|
CVE-2023-21548
CRITICAL · vendor
Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability |
|
CVE-2023-21546
CRITICAL · vendor
Windows Layer 2 Tunneling Protocol (L2TP) Remote Code Execution Vulnerability |
|
CVE-2023-21543
CRITICAL · vendor
Windows Layer 2 Tunneling Protocol (L2TP) Remote Code Execution Vulnerability |
|
CVE-2023-21535
CRITICAL · vendor
Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability |
|
CVE-2022-22088
CRITICAL · vendor
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2021-35134
CRITICAL · vendor
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2021-35113
CRITICAL · vendor
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2021-35097
CRITICAL · vendor
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2022-46882
CRITICAL 9.8
A use-after-free in WebGL extensions could have led to a potentially exploitable crash. This vulnerability affects Firefox < 107, Firefox ESR < 102.6, and Thun… |
|
CVE-2022-45406
CRITICAL 9.8
If an out-of-memory condition occurred when creating a JavaScript global, a JavaScript realm may be deleted while references to it lived on in a BaseShape. Thi… |
|
CVE-2022-34470
CRITICAL 9.8
Session history navigations may have led to a use-after-free and potentially exploitable crash. This vulnerability affects Firefox < 102, Firefox ESR < 91.11, … |
|
CVE-2022-31747
CRITICAL 9.8
Mozilla developers Andrew McCreight, Nicolas B. Pierron, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 100 and Firefox ESR 91.9. … |
|
CVE-2022-31737
CRITICAL 9.8
A malicious webpage could have caused an out-of-bounds write in WebGL, leading to memory corruption and a potentially exploitable crash. This vulnerability aff… |
|
CVE-2022-31736
CRITICAL 9.8
A malicious website could have learned the size of a cross-origin resource that supported Range requests. This vulnerability affects Thunderbird < 91.10, Firef… |
|
CVE-2022-29917
CRITICAL 9.8
Mozilla developers Andrew McCreight, Gabriele Svelto, Tom Ritter and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 99 and Firefox ESR… |
|
CVE-2022-26384
CRITICAL 9.6
If an attacker could control the contents of an iframe sandboxed with <code>allow-popups</code> but not <code>allow-scripts</code>, they were able to craft a l… |
|
CVE-2022-22759
CRITICAL 9.6
If a document created a sandboxed iframe without <code>allow-scripts</code>, and subsequently appended an element to the iframe's document that e.g. had a Java… |
|
CVE-2021-4140
CRITICAL 10.0
It was possible to construct specific XSLT markup that would be able to bypass an iframe sandbox. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, … |
|
CVE-2021-4129
CRITICAL 9.8
Mozilla developers and community members Julian Hector, Randell Jesup, Gabriele Svelto, Tyson Smith, Christian Holler, and Masayuki Nakano reported memory safe… |
|
CVE-2021-4127
CRITICAL 9.8
An out of date graphics library (Angle) likely contained vulnerabilities that could potentially be exploited. This vulnerability affects Thunderbird < 78.9 and… |
|
CVE-2022-44676
CRITICAL · vendor
Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability |
|
CVE-2022-44670
CRITICAL · vendor
Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability |
|
CVE-2022-41076
CRITICAL · vendor
PowerShell Remote Code Execution Vulnerability |
|
CVE-2022-20498
CRITICAL · vendor
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2022-20473
CRITICAL · vendor
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2022-20472
CRITICAL · vendor
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2022-20411
CRITICAL · vendor
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2022-4135
CRITICAL 9.6
KEV
Heap buffer overflow in GPU in Google Chrome prior to 107.0.5304.121 allowed a remote attacker who had compromised the renderer process to potentially perform … |
|
CVE-2022-3890
CRITICAL 9.6
Heap buffer overflow in Crashpad in Google Chrome on Android prior to 107.0.5304.106 allowed a remote attacker who had compromised the renderer process to pote… |
|
CVE-2021-35122
CRITICAL · vendor
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2022-37454
CRITICAL 9.8
The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary … |
|
CVE-2022-41081
CRITICAL · vendor
Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability |
|
CVE-2022-38047
CRITICAL · vendor
Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability |
|
CVE-2022-38000
CRITICAL · vendor
Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability |
|
CVE-2022-37979
CRITICAL · vendor
Windows Hyper-V Elevation of Privilege Vulnerability |
|
CVE-2022-37976
CRITICAL · vendor
Active Directory Certificate Services Elevation of Privilege Vulnerability |
|
CVE-2022-34689
CRITICAL · vendor
Windows CryptoAPI Spoofing Vulnerability |
|
CVE-2022-33634
CRITICAL · vendor
Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability |
Manage your fleet with Appaloosa
Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.