Vulnerabilities
Tracked app vulnerabilities
27,728 CVEs affect a tracked app or OS (all severities, all platforms). 377 of them are in the CISA KEV catalog, meaning exploitation is confirmed.
- Matching CVEs
- 27,728
- Actively exploited
- 377
- Publication window
- 2004-07-27 → 2026-11-11
Chronological sort: newest to oldest. Use the KEV / severity filters above to prioritize.
| CVE |
|---|
|
CVE-2023-32009
HIGH · vendor
Windows Collaborative Translation Framework Elevation of Privilege Vulnerability |
|
CVE-2023-32008
HIGH · vendor
Windows Resilient File System (ReFS) Remote Code Execution Vulnerability |
|
CVE-2023-29373
HIGH · vendor
Microsoft ODBC Driver Remote Code Execution Vulnerability |
|
CVE-2023-29372
HIGH · vendor
Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability |
|
CVE-2023-29371
HIGH · vendor
Windows GDI Elevation of Privilege Vulnerability |
|
CVE-2023-29370
HIGH · vendor
Windows Media Remote Code Execution Vulnerability |
|
CVE-2023-29369
HIGH · vendor
Remote Procedure Call Runtime Denial of Service Vulnerability |
|
CVE-2023-29368
HIGH · vendor
Windows Filtering Platform Elevation of Privilege Vulnerability |
|
CVE-2023-29367
HIGH · vendor
iSCSI Target WMI Provider Remote Code Execution Vulnerability |
|
CVE-2023-29366
HIGH · vendor
Windows Geolocation Service Remote Code Execution Vulnerability |
|
CVE-2023-29365
HIGH · vendor
Windows Media Remote Code Execution Vulnerability |
|
CVE-2023-29364
HIGH · vendor
Windows Authentication Elevation of Privilege Vulnerability |
|
CVE-2023-29363
CRITICAL · vendor
Windows Pragmatic General Multicast (PGM) Remote Code Execution Vulnerability |
|
CVE-2023-29362
HIGH · vendor
Remote Desktop Client Remote Code Execution Vulnerability |
|
CVE-2023-29361
HIGH · vendor
Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability |
|
CVE-2023-29360
Microsoft Streaming Service Elevation of Privilege Vulnerability |
|
CVE-2023-29359
HIGH · vendor
GDI Elevation of Privilege Vulnerability |
|
CVE-2023-29358
HIGH · vendor
Windows GDI Elevation of Privilege Vulnerability |
|
CVE-2023-29355
HIGH · vendor
DHCP Server Service Information Disclosure Vulnerability |
|
CVE-2023-29352
HIGH · vendor
Windows Remote Desktop Security Feature Bypass Vulnerability |
|
CVE-2023-29351
HIGH · vendor
Windows Group Policy Elevation of Privilege Vulnerability |
|
CVE-2023-29346
HIGH · vendor
NTFS Elevation of Privilege Vulnerability |
|
CVE-2023-24938
HIGH · vendor
Windows CryptoAPI Denial of Service Vulnerability |
|
CVE-2023-24937
HIGH · vendor
Windows CryptoAPI Denial of Service Vulnerability |
|
CVE-2023-33595
MEDIUM 5.5
CPython v3.12.0 alpha 7 was discovered to contain a heap use-after-free via the function ascii_decode at /Objects/unicodeobject.c. |
|
CVE-2023-3079
HIGH 8.8
KEV
Type confusion in V8 in Google Chrome prior to 114.0.5735.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromi… |
|
CVE-2023-32215
HIGH 8.8
Mozilla developers and community members Gabriele Svelto, Andrew Osmond, Emily McDonough, Sebastian Hengst, Andrew McCreight and the Mozilla Fuzzing Team repor… |
|
CVE-2023-32213
HIGH 8.8
When reading a file, an uninitialized value could have been used as read limit. This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird… |
|
CVE-2023-32212
MEDIUM 4.3
An attacker could have positioned a `datalist` element to obscure the address bar. This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderb… |
|
CVE-2023-32211
MEDIUM 6.5
A type checking bug would have led to invalid code being compiled. This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102.11. |
|
CVE-2023-32207
HIGH 8.8
A missing delay in popup notifications could have made it possible for an attacker to trick a user into granting permissions. This vulnerability affects Firefo… |
|
CVE-2023-32206
MEDIUM 6.5
An out-of-bound read could have led to a crash in the RLBox Expat driver. This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102… |
|
CVE-2023-32205
MEDIUM 4.3
In multiple cases browser prompts could have been obscured by popups controlled by content. These could have led to potential user confusion and spoofing attac… |
|
CVE-2023-28176
HIGH 8.8
Memory safety bugs present in Firefox 110 and Firefox ESR 102.8. Some of these bugs showed evidence of memory corruption and we presume that with enough effort… |
|
CVE-2023-28164
MEDIUM 6.5
Dragging a URL from a cross-origin iframe that was removed during the drag could have led to user confusion and website spoofing attacks. This vulnerability af… |
|
CVE-2023-28163
MEDIUM 6.5
When downloading files through the Save As dialog on Windows with suggested filenames containing environment variable names, Windows would have resolved those … |
|
CVE-2023-28162
HIGH 8.8
While implementing AudioWorklets, some code may have casted one type to another, invalid, dynamic type. This could have led to a potentially exploitable crash.… |
|
CVE-2023-25752
MEDIUM 6.5
When accessing throttled streams, the count of available bytes needed to be checked in the calling function to be within bounds. This may have lead future code… |
|
CVE-2023-25751
MEDIUM 6.5
Sometimes, when invalidating JIT code while following an iterator, the newly generated code could be overwritten incorrectly. This could lead to a potentially … |
|
CVE-2023-25746
HIGH 8.8
Memory safety bugs present in Firefox ESR 102.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these c… |
|
CVE-2023-25744
HIGH 8.8
Mmemory safety bugs present in Firefox 109 and Firefox ESR 102.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effor… |
|
CVE-2023-25742
MEDIUM 6.5
When importing a SPKI RSA public key as ECDSA P-256, the key would be handled incorrectly causing the tab to crash. This vulnerability affects Firefox < 110, T… |
|
CVE-2023-25739
HIGH 8.8
Module load requests that failed were not being checked as to whether or not they were cancelled causing a use-after-free in <code>ScriptLoadContext</code>. Th… |
|
CVE-2023-25738
MEDIUM 6.5
Members of the <code>DEVMODEW</code> struct set by the printer device driver weren't being validated and could have resulted in invalid values which in turn wo… |
|
CVE-2023-25737
HIGH 8.8
An invalid downcast from <code>nsTextNode</code> to <code>SVGElement</code> could have lead to undefined behavior. This vulnerability affects Firefox < 110, Th… |
|
CVE-2023-25735
HIGH 8.8
Cross-compartment wrappers wrapping a scripted proxy could have caused objects from other compartments to be stored in the main compartment resulting in a use-… |
|
CVE-2023-25734
HIGH 8.1
After downloading a Windows <code>.url</code> shortcut from the local filesystem, an attacker could supply a remote path that would lead to unexpected network … |
|
CVE-2023-25732
HIGH 8.8
When encoding data from an <code>inputStream</code> in <code>xpcom</code> the size of the input being encoded was not correctly calculated potentially leading … |
|
CVE-2023-25731
HIGH 8.8
Due to URL previews in the network panel of developer tools improperly storing URLs, query parameters could potentially be used to overwrite global objects in … |
|
CVE-2023-25730
MEDIUM 5.4
A background script invoking <code>requestFullscreen</code> and then blocking the main thread could force the browser into fullscreen mode indefinitely, result… |
Manage your fleet with Appaloosa
Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.