Vulnerabilities
Tracked app vulnerabilities
2,721 CVEs affect a tracked app or OS (Critical, all platforms). 48 of them are in the CISA KEV catalog, meaning exploitation is confirmed.
- Matching CVEs
- 2,721
- Actively exploited
- 48
- Publication window
- 2007-08-28 → 2026-11-10
Chronological sort: newest to oldest. Use the KEV / severity filters above to prioritize.
| CVE |
|---|
|
CVE-2026-43790
CRITICAL 9.1
The issue was addressed with improved memory handling. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. A remote attacker may… |
|
CVE-2026-87654
CRITICAL 9.6
Buffer overflow in ANGLE in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox via a cr… |
|
CVE-2026-87650
CRITICAL 9.6
Out of bounds read in WebGL in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a c… |
|
CVE-2026-87646
CRITICAL 9.6
Use after free in Web Authentication in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox via a craf… |
|
CVE-2026-87643
CRITICAL 9.6
Integer overflow in GPU in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandb… |
|
CVE-2026-87638
CRITICAL 9.6
Out of bounds write in Media in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a … |
|
CVE-2026-87637
CRITICAL 9.6
Use after free in Extensions in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox via a cr… |
|
CVE-2026-87634
CRITICAL 9.6
Use after free in WebPackaging in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via … |
|
CVE-2026-87621
CRITICAL 9.6
Out of bounds write in ANGLE in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the … |
|
CVE-2026-87613
CRITICAL 9.0
Incorrect reference resolution in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside th… |
|
CVE-2026-87609
CRITICAL 9.6
Use after free in Sharing in Google Chrome on on iOS prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox via crafted… |
|
CVE-2026-87607
CRITICAL 9.6
Use after free in Device in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox … |
|
CVE-2026-87595
CRITICAL 9.8
Server-side request forgery in Mobile in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access r… |
|
CVE-2026-87581
CRITICAL 9.6
Use after free in Payments in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to potentially execute arbitrary cod… |
|
CVE-2026-87558
CRITICAL 9.6
Use after free in Payments in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox via a craf… |
|
CVE-2026-87547
CRITICAL 9.6
Incorrect reference resolution in FileSystem in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to potentially exe… |
|
CVE-2026-87544
CRITICAL 9.8
Incorrect authorization in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions into a privileged … |
|
CVE-2026-87534
CRITICAL 9.8
Missing authorization in WebView in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system… |
|
CVE-2026-87529
CRITICAL 9.6
Numeric truncation error in Media in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox v… |
|
CVE-2026-87528
CRITICAL 9.6
Type confusion in Rust in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbo… |
|
CVE-2026-87527
CRITICAL 9.6
Buffer overflow in WebGL in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML pag… |
|
CVE-2026-87526
CRITICAL 9.6
Use after free in Passwords in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to potentially execute arbitrary co… |
|
CVE-2026-87520
CRITICAL 9.6
Use after free in Dawn in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox via a craf… |
|
CVE-2026-87512
CRITICAL 9.6
Use after free in ANGLE in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox via a cra… |
|
CVE-2026-87504
CRITICAL 9.6
Use after free in Core in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sa… |
|
CVE-2026-87500
CRITICAL 9.6
Improper validation of array index in ANGLE in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the… |
|
CVE-2026-87494
CRITICAL 9.6
Use after free in Browser in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to execute arbitrary co… |
|
CVE-2026-87492
CRITICAL 9.6
Incorrect authorization in DevTools in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox… |
|
CVE-2026-87488
CRITICAL 9.6
Use after free in WebGL in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox via a cra… |
|
CVE-2026-87474
CRITICAL 9.6
Use after free in Payments in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a cr… |
|
CVE-2026-87470
CRITICAL 9.6
Improper quantity validation in Tint in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside … |
|
CVE-2026-87464
CRITICAL 9.6
Use after free in WebGL in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page… |
|
CVE-2026-87455
CRITICAL 9.6
Use after free in Aura in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafte… |
|
CVE-2026-87448
CRITICAL 9.6
Use after free in DevTools in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML p… |
|
CVE-2026-87438
CRITICAL 9.6
Out of bounds write in WebGL in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox via … |
|
CVE-2026-58822
CRITICAL 9.8
In multiple functions of ftsmooth.c, there is a possible memory safety issue due to improper casting. This could lead to remote code execution with no addition… |
|
CVE-2026-49921
CRITICAL 9.8
In multiple locations, there is a possible memory safety issue due to a heap buffer overflow. This could lead to remote code execution with no additional execu… |
|
CVE-2026-28606
CRITICAL 9.8
In handleBondStateChanged of AdapterService.java, there is a possible way to skip pairing due to a logic error in the code. This could lead to remote escalatio… |
|
CVE-2026-78509
CRITICAL 9.8
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. |
|
CVE-2026-78445
CRITICAL 9.8
Use after free in Windows Services for NFS ONCRPC XDR Driver allows an unauthorized attacker to execute code over a network. |
|
CVE-2026-77493
CRITICAL 9.8
Double free in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network. |
|
CVE-2026-73025
CRITICAL 9.8
Weak authentication in Windows iSCSI allows an unauthorized attacker to bypass a security feature over a network. |
|
CVE-2026-73010
CRITICAL 9.8
Use after free in Windows Failover Cluster allows an unauthorized attacker to execute code over a network. |
|
CVE-2026-73009
CRITICAL 9.8
Use after free in Windows Secure Socket Tunneling Protocol (SSTP) allows an unauthorized attacker to execute code over a network. |
|
CVE-2026-72983
CRITICAL 9.8
Use after free in Windows Internet Connection Sharing (ICS) allows an unauthorized attacker to execute code over a network. |
|
CVE-2026-72982
CRITICAL 9.8
Stack-based buffer overflow in Windows Netlogon allows an unauthorized attacker to execute code over a network. |
|
CVE-2026-72979
CRITICAL 9.8
Use after free in Windows DHCP Server allows an unauthorized attacker to execute code over a network. |
|
CVE-2026-70296
CRITICAL 9.8
Out-of-bounds write in Windows Imaging Component allows an unauthorized attacker to execute code over a network. |
|
CVE-2026-69910
CRITICAL 9.8
Stack-based buffer overflow in Windows Hyper-V allows an unauthorized attacker to execute code over a network. |
|
CVE-2026-69845
CRITICAL 9.8
Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code over a network. |
Manage your fleet with Appaloosa
Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.