Vulnerabilities
Tracked app vulnerabilities
18,849 CVEs affect a tracked app or OS (all severities, Windows). 305 of them are in the CISA KEV catalog, meaning exploitation is confirmed.
- Matching CVEs
- 18,849
- Actively exploited
- 305
- Publication window
- 2004-07-27 → 2026-11-11
Chronological sort: newest to oldest. Use the KEV / severity filters above to prioritize.
| CVE |
|---|
|
CVE-2020-6478
MEDIUM 6.5
Inappropriate implementation in full screen in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to spoof security UI via a crafted HTML page. |
|
CVE-2020-6477
HIGH 7.8
Inappropriate implementation in installer in Google Chrome on OS X prior to 83.0.4103.61 allowed a local attacker to perform privilege escalation via a crafted… |
|
CVE-2020-6476
MEDIUM 6.5
Insufficient policy enforcement in tab strip in Google Chrome prior to 83.0.4103.61 allowed an attacker who convinced a user to install a malicious extension t… |
|
CVE-2020-6475
MEDIUM 6.5
Incorrect implementation in full screen in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to spoof security UI via a crafted HTML page. |
|
CVE-2020-6474
HIGH 8.8
Use after free in Blink in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
|
CVE-2020-6473
MEDIUM 6.5
Insufficient policy enforcement in Blink in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to obtain potentially sensitive information from proc… |
|
CVE-2020-6472
MEDIUM 6.5
Insufficient policy enforcement in developer tools in Google Chrome prior to 83.0.4103.61 allowed an attacker who convinced a user to install a malicious exten… |
|
CVE-2020-6471
CRITICAL 9.6
Insufficient policy enforcement in developer tools in Google Chrome prior to 83.0.4103.61 allowed an attacker who convinced a user to install a malicious exten… |
|
CVE-2020-6470
MEDIUM 6.1
Insufficient validation of untrusted input in clipboard in Google Chrome prior to 83.0.4103.61 allowed a local attacker to inject arbitrary scripts or HTML (UX… |
|
CVE-2020-6469
CRITICAL 9.6
Insufficient policy enforcement in developer tools in Google Chrome prior to 83.0.4103.61 allowed an attacker who convinced a user to install a malicious exten… |
|
CVE-2020-6468
HIGH 8.8
Type confusion in V8 in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
|
CVE-2020-6467
HIGH 8.8
Use after free in WebRTC in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
|
CVE-2020-6466
CRITICAL 9.6
Use after free in media in Google Chrome prior to 83.0.4103.61 allowed a remote attacker who had compromised the renderer process to potentially perform a sand… |
|
CVE-2020-6465
CRITICAL 9.6
Use after free in reader mode in Google Chrome on Android prior to 83.0.4103.61 allowed a remote attacker who had compromised the renderer process to potential… |
|
CVE-2020-6464
HIGH 8.8
Type confusion in Blink in Google Chrome prior to 81.0.4044.138 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
|
CVE-2020-6463
HIGH 8.8
Use after free in ANGLE in Google Chrome prior to 81.0.4044.122 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
|
CVE-2020-6462
CRITICAL 9.6
Use after free in task scheduling in Google Chrome prior to 81.0.4044.129 allowed a remote attacker who had compromised the renderer process to potentially per… |
|
CVE-2020-6461
CRITICAL 9.6
Use after free in storage in Google Chrome prior to 81.0.4044.129 allowed a remote attacker who had compromised the renderer process to potentially perform a s… |
|
CVE-2020-6460
MEDIUM 6.5
Insufficient data validation in URL formatting in Google Chrome prior to 81.0.4044.122 allowed a remote attacker to perform domain spoofing via a crafted domai… |
|
CVE-2020-6459
HIGH 8.8
Use after free in payments in Google Chrome prior to 81.0.4044.122 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
|
CVE-2020-6458
HIGH 8.8
Out of bounds read and write in PDFium in Google Chrome prior to 81.0.4044.122 allowed a remote attacker to potentially exploit heap corruption via a crafted P… |
|
CVE-2020-6457
CRITICAL 9.6
Use after free in speech recognizer in Google Chrome prior to 81.0.4044.113 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTM… |
|
CVE-2019-19721
HIGH 7.8
An off-by-one error in the DecodeBlock function in codec/sdl_image.c in VideoLAN VLC media player before 3.0.9 allows remote attackers to cause a denial of ser… |
|
CVE-2020-6825
CRITICAL 9.8
Mozilla developers and community members Tyson Smith and Christian Holler reported memory safety bugs present in Firefox 74 and Firefox ESR 68.6. Some of these… |
|
CVE-2020-6822
HIGH 8.8
On 32-bit builds, an out of bounds write could have occurred when processing an image larger than 4 GB in <code>GMPDecodeData</code>. It is possible that with … |
|
CVE-2020-6821
HIGH 7.5
When reading from areas partially or fully outside the source resource with WebGL's <code>copyTexSubImage</code> method, the specification requires the returne… |
|
CVE-2020-6820
HIGH 8.1
KEV
Under certain conditions, when handling a ReadableStream, a race condition can cause a use-after-free. We are aware of targeted attacks in the wild abusing thi… |
|
CVE-2020-6819
HIGH 8.1
KEV
Under certain conditions, when running the nsDocShell destructor, a race condition can cause a use-after-free. We are aware of targeted attacks in the wild abu… |
|
CVE-2020-0980
HIGH 7.8
A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory, aka 'Microsoft Word Remote Code Exe… |
|
CVE-2020-0970
HIGH 7.5
A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka 'Scripting Engine Memory Corruption… |
|
CVE-2020-0969
HIGH 7.5
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge (HTML-based), aka 'Chakra … |
|
CVE-2020-0935
MEDIUM 5.5
An elevation of privilege vulnerability exists when the OneDrive for Windows Desktop application improperly handles symbolic links, aka 'OneDrive for Windows E… |
|
CVE-2020-0906
HIGH 8.8
A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Excel Rem… |
|
CVE-2020-0760
HIGH 8.8
+2
A remote code execution vulnerability exists when Microsoft Office improperly loads arbitrary type libraries, aka 'Microsoft Office Remote Code Execution Vulne… |
|
CVE-2020-11765
MEDIUM 5.5
An issue was discovered in OpenEXR before 2.4.1. There is an off-by-one error in use of the ImfXdr.h read function by DwaCompressor::Classifier::Classifier, le… |
|
CVE-2020-11764
MEDIUM 5.5
An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds write in copyIntoFrameBuffer in ImfMisc.cpp. |
|
CVE-2020-11763
MEDIUM 5.5
An issue was discovered in OpenEXR before 2.4.1. There is an std::vector out-of-bounds read and write, as demonstrated by ImfTileOffsets.cpp. |
|
CVE-2020-11762
MEDIUM 5.5
An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds read and write in DwaCompressor::uncompress in ImfDwaCompressor.cpp when handling th… |
|
CVE-2020-11761
MEDIUM 5.5
An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds read during Huffman uncompression, as demonstrated by FastHufDecoder::refill in ImfF… |
|
CVE-2020-11760
MEDIUM 5.5
An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds read during RLE uncompression in rleUncompress in ImfRle.cpp. |
|
CVE-2020-11759
MEDIUM 5.5
An issue was discovered in OpenEXR before 2.4.1. Because of integer overflows in CompositeDeepScanLine::Data::handleDeepFrameBuffer and readSampleCountForLineB… |
|
CVE-2020-11758
MEDIUM 5.5
An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds read in ImfOptimizedPixelReading.h. |
|
CVE-2020-1094
HIGH · vendor
Windows Work Folder Service Elevation of Privilege Vulnerability |
|
CVE-2020-1029
HIGH · vendor
Connected User Experiences and Telemetry Service Elevation of Privilege Vulnerability |
|
CVE-2020-1027
Windows Kernel Elevation of Privilege Vulnerability |
|
CVE-2020-1020
Adobe Font Manager Library Remote Code Execution Vulnerability |
|
CVE-2020-1017
HIGH · vendor
Windows Push Notification Service Elevation of Privilege Vulnerability |
|
CVE-2020-1016
HIGH · vendor
Windows Push Notification Service Information Disclosure Vulnerability |
|
CVE-2020-1015
HIGH · vendor
Windows Elevation of Privilege Vulnerability |
|
CVE-2020-1014
HIGH · vendor
Microsoft Windows Update Client Elevation of Privilege Vulnerability |
Manage your fleet with Appaloosa
Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.