Vulnerabilities
Tracked app vulnerabilities
6,362 CVEs affect a tracked app or OS (Medium, all platforms). 33 of them are in the CISA KEV catalog, meaning exploitation is confirmed.
- Matching CVEs
- 6,362
- Actively exploited
- 33
- Publication window
- 2009-07-30 → 2026-11-10
Chronological sort: newest to oldest. Use the KEV / severity filters above to prioritize.
| CVE |
|---|
|
CVE-2026-0069
MEDIUM 5.5
In verifySignature of ApkChecksums.java, there is a possible way to cause a crash due to resource exhaustion. This could lead to local denial of service with n… |
|
CVE-2026-0067
MEDIUM 5.5
In multiple functions of ubsan_throwing_runtime.cpp, there is a possible way to cause a permanent denial of service due to a logic error in the code. This coul… |
|
CVE-2026-0061
MEDIUM 5.9
In multiple functions of WindowState.java, there is a possible way to trick a user into accepting a permission due to a tapjacking/overlay attack. This could l… |
|
CVE-2026-0060
MEDIUM 5.5
In updateState of GraphicsDriverEnableAngleAsSystemDriverController.java, there is a possible persistent dos issue due to an unusual root cause. This could lea… |
|
CVE-2026-0055
MEDIUM 6.2
In createSessionInternal of PackageInstallerService.java, there is a possible to update a Device Policy Controller (DPC) into an invalid directory due to a pat… |
|
CVE-2026-0052
MEDIUM 6.5
In multiple functions of ubsan_throwing_runtime.cpp, there is a possible way to cause a crash due to an integer overflow. This could lead to remote denial of s… |
|
CVE-2026-0051
MEDIUM 6.5
In multiple functions of ubsan_throwing_runtime.cpp, there is a possible way to cause a system crash due to improper input validation. This could lead to remot… |
|
CVE-2026-0048
MEDIUM 6.8
In hide of WindowState.java, there is a possible way to trick the user into approving permissions due to a tapjacking/overlay attack. This could lead to local … |
|
CVE-2026-0046
MEDIUM 6.2
In InputInterceptor of Letterbox.java, there is a possible way to trick a user into accepting a permission due to a tapjacking/overlay attack. This could lead … |
|
CVE-2026-0044
MEDIUM 6.5
In multiple functions of ubsan_throwing_runtime.cpp, there is a possible way to cause the system to crash due to an integer overflow. This could lead to remote… |
|
CVE-2026-0043
MEDIUM 5.5
In multiple functions of ubsan_throwing_runtime.cpp, there is a possible persistent denial of service due to an integer overflow. This could lead to local esca… |
|
CVE-2026-0042
MEDIUM 5.5
In multiple functions of ubsan_throwing_runtime.cpp, there is a possible persistent denial of service due to resource exhaustion. This could lead to local deni… |
|
CVE-2026-0041
MEDIUM 6.5
In multiple functions of ubsan_throwing_runtime.cpp, there is a possible UBSan failure due to an integer overflow. This could lead to remote denial of service … |
|
CVE-2026-0040
MEDIUM 6.5
In multiple functions of ubsan_throwing_runtime.cpp, there is a possible way to cause a crash due to an integer overflow. This could lead to remote denial of s… |
|
CVE-2026-0039
MEDIUM 6.5
In multiple functions of ubsan_throwing_runtime.cpp, there is a possible persistent denial of service due to an integer overflow. This could lead to remote den… |
|
CVE-2026-0018
MEDIUM 5.5
In multiple functions of AccessibilityManagerService.java, there is a possible persistent denial of service due to improper input validation. This could lead t… |
|
CVE-2025-48648
MEDIUM 5.5
In isSameApp of NotificationManagerService.java, there is a possible persistent dos due to resource exhaustion. This could lead to local denial of service with… |
|
CVE-2026-9309
MEDIUM 5.4
Firefox for iOS Reader View did not properly escape HTML tags in JSON-LD metadata. A malicious page could inject markup that changed Reader View behavior and l… |
|
CVE-2026-9308
MEDIUM 5.4
Firefox for iOS Reader View replaced page content in its HTML template before replacing other internal placeholders. A malicious page could include a placehold… |
|
CVE-2026-34193
MEDIUM 4.3
Kernel software installed and running inside a Guest/Host VM may post improper commands to the GPU Firmware to trigger a write of data outside the intended GPU… |
|
CVE-2026-20454
MEDIUM 6.4
In geniezone, there is a possible out of bounds write due to a race condition. This could lead to local escalation of privilege if a malicious actor has alread… |
|
CVE-2026-20453
MEDIUM 6.7
In geniezone, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has … |
|
CVE-2026-9996
MEDIUM 6.5
Out of bounds read in WebRTC in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker to obtain potentially sensitive information from process… |
|
CVE-2026-9989
MEDIUM 6.3
Inappropriate implementation in Media in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to bypass same origin policy via a crafted video file.… |
|
CVE-2026-9986
MEDIUM 4.2
Insufficient validation of untrusted input in OptimizationGuide in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the rend… |
|
CVE-2026-9985
MEDIUM 5.3
Insufficient validation of untrusted input in Media in Google Chrome on ChromeOS prior to 148.0.7778.216 allowed a remote attacker who had compromised the rend… |
|
CVE-2026-9981
MEDIUM 6.5
Inappropriate implementation in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to obtain potentially sensitive information from proces… |
|
CVE-2026-9980
MEDIUM 5.0
Insufficient validation of untrusted input in Printing in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer proc… |
|
CVE-2026-9979
MEDIUM 5.0
Insufficient validation of untrusted input in Input in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process… |
|
CVE-2026-9971
MEDIUM 5.4
Inappropriate implementation in iOS in Google Chrome on iOS prior to 148.0.7778.216 allowed a remote attacker who convinced a user to engage in specific UI ges… |
|
CVE-2026-9955
MEDIUM 4.3
Inappropriate implementation in iOS in Google Chrome on iOS prior to 148.0.7778.216 allowed a remote attacker to leak cross-origin data via a crafted HTML page… |
|
CVE-2026-9953
MEDIUM 6.5
Out of bounds read in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to obtain potentially sensitive information from process memory … |
|
CVE-2026-9943
MEDIUM 4.3
Out of bounds read in WebGL in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (C… |
|
CVE-2026-9942
MEDIUM 5.0
Uninitialized Use in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to bypass site isolation… |
|
CVE-2026-9935
MEDIUM 4.3
Uninitialized Use in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium secu… |
|
CVE-2026-9930
MEDIUM 4.3
Out of bounds write in Dawn in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker to perform an out of bounds memory write via a crafted HT… |
|
CVE-2026-9929
MEDIUM 4.3
Inappropriate implementation in WebGL in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker to leak cross-origin data via a crafted HTM… |
|
CVE-2026-9921
MEDIUM 4.3
Uninitialized Use in WebGL in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker to leak cross-origin information via a crafted HTML pa… |
|
CVE-2026-9919
MEDIUM 4.3
Out of bounds read in WebGL in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (C… |
|
CVE-2026-9917
MEDIUM 6.5
Uninitialized Use in WebGL in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker to obtain potentially sensitive information from proce… |
|
CVE-2026-9913
MEDIUM 4.3
Inappropriate implementation in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to potentially perform out of bounds memory access via… |
|
CVE-2026-9912
MEDIUM 6.5
Inappropriate implementation in GPU in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker to obtain potentially sensitive information f… |
|
CVE-2026-9911
MEDIUM 4.3
Integer overflow in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (… |
|
CVE-2026-9908
MEDIUM 6.5
Out of bounds read in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to obtain potentially sensitive information from process memory … |
|
CVE-2026-9907
MEDIUM 4.3
Out of bounds read in Dawn in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Ch… |
|
CVE-2026-9903
MEDIUM 5.0
Insufficient validation of untrusted input in Site Isolation in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the rendere… |
|
CVE-2026-9882
MEDIUM 6.5
Integer overflow in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium secur… |
|
CVE-2026-10018
MEDIUM 6.5
Integer overflow in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to obtain potentially sensitive information from process memory vi… |
|
CVE-2026-10010
MEDIUM 5.0
Inappropriate implementation in Input in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to… |
|
CVE-2026-10008
MEDIUM 6.5
Uninitialized Use in GPU in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker to obtain potentially sensitive information from process… |
Manage your fleet with Appaloosa
Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.