Vulnerabilities
Tracked app vulnerabilities
8,012 CVEs affect a tracked app or OS (all severities, macOS). 103 of them are in the CISA KEV catalog, meaning exploitation is confirmed.
- Matching CVEs
- 8,012
- Actively exploited
- 103
- Publication window
- 2004-07-27 → 2026-09-29
Chronological sort: newest to oldest. Use the KEV / severity filters above to prioritize.
| CVE |
|---|
|
CVE-2024-54568
MEDIUM 4.3
The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.2. Parsing a maliciously crafted file may lead to an unexpected … |
|
CVE-2024-54554
MEDIUM 5.5
This issue was addressed with improved handling of symlinks. This issue is fixed in macOS Sequoia 15.1. An app may be able to access sensitive user data. |
|
CVE-2024-44271
LOW 3.3
The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.2. An app may be able to record the screen without an indicator. |
|
CVE-2025-9478
HIGH 8.8
Use after free in ANGLE in Google Chrome prior to 139.0.7258.154 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chr… |
|
CVE-2025-4609
CRITICAL 9.6
Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 136.0.7103.113 allowed a remote attacker to potentially per… |
|
CVE-2025-43300
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.8.5 and iPadOS 15.8.5, iOS 16.7.12 and iPadOS 16.7.12, … |
|
CVE-2025-9132
HIGH 8.8
Out of bounds write in V8 in Google Chrome prior to 139.0.7258.138 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (C… |
|
CVE-2025-8901
HIGH 8.8
Out of bounds write in ANGLE in Google Chrome prior to 139.0.7258.127 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page.… |
|
CVE-2025-8882
HIGH 8.8
Use after free in Aura in Google Chrome prior to 139.0.7258.127 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially… |
|
CVE-2025-8881
MEDIUM 6.5
Inappropriate implementation in File Picker in Google Chrome prior to 139.0.7258.127 allowed a remote attacker who convinced a user to engage in specific UI ge… |
|
CVE-2025-8880
HIGH 8.8
Race in V8 in Google Chrome prior to 139.0.7258.127 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium sec… |
|
CVE-2025-8879
HIGH 8.8
Heap buffer overflow in libaom in Google Chrome prior to 139.0.7258.127 allowed a remote attacker to potentially exploit heap corruption via a curated set of g… |
|
CVE-2025-53761
HIGH 7.8
Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally. |
|
CVE-2025-53741
HIGH 7.8
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
|
CVE-2025-53739
HIGH 7.8
Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
|
CVE-2025-53738
HIGH 7.8
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally. |
|
CVE-2025-53737
HIGH 7.8
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
|
CVE-2025-53736
MEDIUM 6.8
Buffer over-read in Microsoft Office Word allows an unauthorized attacker to disclose information locally. |
|
CVE-2025-53735
HIGH 7.8
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
|
CVE-2025-53733
HIGH 8.4
Incorrect conversion between numeric types in Microsoft Office Word allows an unauthorized attacker to execute code locally. |
|
CVE-2025-8583
MEDIUM 4.3
Inappropriate implementation in Permissions in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (… |
|
CVE-2025-8582
MEDIUM 4.3
Insufficient validation of untrusted input in Core in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to spoof the contents of the Omnibox (URL … |
|
CVE-2025-8581
MEDIUM 4.3
Inappropriate implementation in Extensions in Google Chrome prior to 139.0.7258.66 allowed a remote attacker who convinced a user to engage in specific UI gest… |
|
CVE-2025-8580
MEDIUM 4.3
Inappropriate implementation in Filesystems in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (… |
|
CVE-2025-8579
MEDIUM 4.3
Inappropriate implementation in Picture In Picture in Google Chrome prior to 139.0.7258.66 allowed a remote attacker who convinced a user to engage in specific… |
|
CVE-2025-8578
HIGH 8.8
Use after free in Cast in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chrom… |
|
CVE-2025-8577
MEDIUM 4.3
Inappropriate implementation in Picture In Picture in Google Chrome prior to 139.0.7258.66 allowed a remote attacker who convinced a user to engage in specific… |
|
CVE-2025-8576
HIGH 8.8
Use after free in Extensions in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to potentially exploit heap corruption via a crafted Chrome Exte… |
|
CVE-2025-8292
HIGH 8.8
Use after free in Media Stream in Google Chrome prior to 138.0.7204.183 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML pag… |
|
CVE-2025-43277
The issue was addressed with improved memory handling. This issue is fixed in iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, macOS Sonoma 14.8, tvOS 18.6, visio… |
|
CVE-2025-43276
MEDIUM 5.3
A logic error was addressed with improved error handling. This issue is fixed in macOS Sequoia 15.6. iCloud Private Relay may not activate when more than one u… |
|
CVE-2025-43275
CRITICAL 9.8
A race condition was addressed with additional validation. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app may be … |
|
CVE-2025-43274
MEDIUM 4.4
A privacy issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.6. A sandboxed process may be able to circumvent sandbox… |
|
CVE-2025-43273
CRITICAL 9.1
A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.8. A sandboxed process may b… |
|
CVE-2025-43270
HIGH 8.8
An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An ap… |
|
CVE-2025-43267
MEDIUM 5.5
An injection issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.6. An app may be able to access sensitive user data. |
|
CVE-2025-43266
MEDIUM 5.1
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app ma… |
|
CVE-2025-43265
An out-of-bounds read was addressed with improved input validation. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6… |
|
CVE-2025-43261
CRITICAL 9.8
A logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app may be able to b… |
|
CVE-2025-43260
MEDIUM 5.1
This issue was addressed with improved data protection. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7. An app may be able to hijack entitlemen… |
|
CVE-2025-43259
MEDIUM 4.6
This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7… |
|
CVE-2025-43256
HIGH 7.8
This issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7. An app may be able to gain root pri… |
|
CVE-2025-43254
HIGH 7.1
An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. Proce… |
|
CVE-2025-43253
CRITICAL 9.8
This issue was addressed with improved input validation. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7. A malicious app may be able to launch … |
|
CVE-2025-43252
MEDIUM 6.5
This issue was addressed by adding an additional prompt for user consent. This issue is fixed in macOS Sequoia 15.6. A website may be able to access sensitive … |
|
CVE-2025-43251
MEDIUM 5.5
An authorization issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.6. A local attacker may gain access to Keychain it… |
|
CVE-2025-43250
MEDIUM 4.0
A path handling issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app may … |
|
CVE-2025-43249
HIGH 7.8
A logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app may be able to g… |
|
CVE-2025-43248
HIGH 7.8
A logic issue was addressed with improved restrictions. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7. A malicious app may be able to gain roo… |
|
CVE-2025-43247
MEDIUM 5.5
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. A malicio… |
Manage your fleet with Appaloosa
Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.