Vulnerabilities
Tracked app vulnerabilities
6,380 CVEs affect a tracked app or OS (Medium, all platforms). 33 of them are in the CISA KEV catalog, meaning exploitation is confirmed.
- Matching CVEs
- 6,380
- Actively exploited
- 33
- Publication window
- 2009-07-30 → 2026-11-11
Chronological sort: newest to oldest. Use the KEV / severity filters above to prioritize.
| CVE |
|---|
|
CVE-2022-0117
MEDIUM 6.5
Policy bypass in Blink in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
|
CVE-2022-0116
MEDIUM 4.3
Inappropriate implementation in Compositing in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via… |
|
CVE-2022-0113
MEDIUM 6.5
Inappropriate implementation in Blink in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
|
CVE-2022-0112
MEDIUM 4.3
Incorrect security UI in Browser UI in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to display missing URL or incorrect URL via a crafted URL. |
|
CVE-2022-0111
MEDIUM 6.5
Inappropriate implementation in Navigation in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to incorrectly set origin via a crafted HTML page. |
|
CVE-2022-0110
MEDIUM 4.3
Incorrect security UI in Autofill in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted… |
|
CVE-2022-0109
MEDIUM 6.5
Inappropriate implementation in Autofill in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to obtain potentially sensitive information via a cra… |
|
CVE-2022-0108
MEDIUM 6.5
Inappropriate implementation in Navigation in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
|
CVE-2022-23255
MEDIUM 5.9
Microsoft OneDrive for Android Security Feature Bypass Vulnerability |
|
CVE-2022-22716
MEDIUM 5.5
Microsoft Excel Information Disclosure Vulnerability |
|
CVE-2021-4068
MEDIUM 6.5
Insufficient data validation in new tab page in Google Chrome prior to 96.0.4664.93 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
|
CVE-2021-4059
MEDIUM 6.5
Insufficient data validation in loader in Google Chrome prior to 96.0.4664.93 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
|
CVE-2021-4054
MEDIUM 6.5
Incorrect security UI in autofill in Google Chrome prior to 96.0.4664.93 allowed a remote attacker to perform domain spoofing via a crafted HTML page. |
|
CVE-2021-38022
MEDIUM 6.5
Inappropriate implementation in WebAuthentication in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to leak cross-origin data via a crafted HTML… |
|
CVE-2021-38021
MEDIUM 6.5
Inappropriate implementation in referrer in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to bypass navigation restrictions via a crafted HTML … |
|
CVE-2021-38020
MEDIUM 4.3
Insufficient policy enforcement in contacts picker in Google Chrome on Android prior to 96.0.4664.45 allowed a remote attacker to spoof the contents of the Omn… |
|
CVE-2021-38019
MEDIUM 6.5
Insufficient policy enforcement in CORS in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
|
CVE-2021-38018
MEDIUM 6.5
Inappropriate implementation in navigation in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to perform domain spoofing via a crafted HTML page. |
|
CVE-2021-38010
MEDIUM 6.5
Inappropriate implementation in service workers in Google Chrome prior to 96.0.4664.45 allowed a remote attacker who had compromised the renderer process to by… |
|
CVE-2021-38009
MEDIUM 6.5
Inappropriate implementation in cache in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
|
CVE-2021-43546
MEDIUM 4.3
It was possible to recreate previous cursor spoofing attacks against users with a zoomed native cursor. This vulnerability affects Thunderbird < 91.4.0, Firefo… |
|
CVE-2021-43545
MEDIUM 6.5
Using the Location API in a loop could have caused severe application hangs and crashes. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0,… |
|
CVE-2021-43543
MEDIUM 6.1
Documents loaded with the CSP sandbox directive could have escaped the sandbox's script restriction by embedding additional content. This vulnerability affects… |
|
CVE-2021-43542
MEDIUM 6.5
Using XMLHttpRequest, an attacker could have identified installed applications by probing error messages for loading external protocols. This vulnerability aff… |
|
CVE-2021-43541
MEDIUM 6.5
When invoking protocol handlers for external protocols, a supplied parameter URL containing spaces was not properly escaped. This vulnerability affects Thunder… |
|
CVE-2021-43538
MEDIUM 4.3
By misusing a race in our notification code, an attacker could have forcefully hidden the notification for pages that had received full screen and pointer lock… |
|
CVE-2021-43536
MEDIUM 6.5
Under certain circumstances, asynchronous functions could have caused a navigation to fail but expose the target URL. This vulnerability affects Thunderbird < … |
|
CVE-2021-43528
MEDIUM 6.5
Thunderbird unexpectedly enabled JavaScript in the composition area. The JavaScript execution context was limited to this area and did not receive chrome-level… |
|
CVE-2021-38509
MEDIUM 4.3
Due to an unusual sequence of attacker-controlled events, a Javascript alert() dialog with arbitrary (although unstyled) contents could be displayed over top a… |
|
CVE-2021-38508
MEDIUM 4.3
By displaying a form validity message in the correct location at the same time as a permission prompt (such as for geolocation), the validity message could hav… |
|
CVE-2021-38507
MEDIUM 6.5
The Opportunistic Encryption feature of HTTP2 (RFC 8164) allows a connection to be transparently upgraded to TLS while retaining the visual properties of an HT… |
|
CVE-2021-38506
MEDIUM 4.3
Through a series of navigations, Firefox could have entered fullscreen mode without notification or warning to the user. This could lead to spoofing attacks on… |
|
CVE-2021-38505
MEDIUM 6.5
Microsoft introduced a new feature in Windows 10 known as Cloud Clipboard which, if enabled, will record data copied to the clipboard to the cloud, and make it… |
|
CVE-2021-0969
MEDIUM · vendor
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2021-0961
MEDIUM · vendor
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2021-0958
MEDIUM · vendor
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2021-38004
MEDIUM 4.3
Insufficient policy enforcement in Autofill in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
|
CVE-2021-38000
MEDIUM 6.1
KEV
Insufficient validation of untrusted input in Intents in Google Chrome on Android prior to 95.0.4638.69 allowed a remote attacker to arbitrarily browser to a m… |
|
CVE-2021-37999
MEDIUM 6.1
Insufficient data validation in New Tab Page in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to inject arbitrary scripts or HTML in a new brow… |
|
CVE-2021-42288
MEDIUM 5.7
Windows Hello Security Feature Bypass Vulnerability |
|
CVE-2021-42284
MEDIUM 6.8
Windows Hyper-V Denial of Service Vulnerability |
|
CVE-2021-42280
MEDIUM 5.5
Windows Feedback Hub Elevation of Privilege Vulnerability |
|
CVE-2021-42279
MEDIUM 4.2
Chakra Scripting Engine Memory Corruption Vulnerability |
|
CVE-2021-42277
MEDIUM 5.5
Diagnostics Hub Standard Collector Elevation of Privilege Vulnerability |
|
CVE-2021-42274
MEDIUM 6.8
Windows Hyper-V Discrete Device Assignment (DDA) Denial of Service Vulnerability |
|
CVE-2021-41379
Windows Installer Elevation of Privilege Vulnerability |
|
CVE-2021-41371
MEDIUM 4.4
Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability |
|
CVE-2021-41368
MEDIUM 6.1
Microsoft Access Remote Code Execution Vulnerability |
|
CVE-2021-41351
MEDIUM 4.3
Microsoft Edge (Chrome based) Spoofing on IE Mode |
|
CVE-2021-38631
MEDIUM 4.4
Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability |
Manage your fleet with Appaloosa
Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.