Vulnerabilities
Tracked app vulnerabilities
6,380 CVEs affect a tracked app or OS (Medium, all platforms). 33 of them are in the CISA KEV catalog, meaning exploitation is confirmed.
- Matching CVEs
- 6,380
- Actively exploited
- 33
- Publication window
- 2009-07-30 → 2026-11-11
Chronological sort: newest to oldest. Use the KEV / severity filters above to prioritize.
| CVE |
|---|
|
CVE-2021-38502
MEDIUM 5.9
Thunderbird ignored the configuration to require STARTTLS security for an SMTP connection. A MITM could perform a downgrade attack to intercept transmitted mes… |
|
CVE-2021-38497
MEDIUM 6.5
Through use of reportValidity() and window.open(), a plain-text validation message could have been overlaid on another origin, leading to possible user confusi… |
|
CVE-2021-38492
MEDIUM 6.5
When delegating navigations to the operating system, Firefox would accept the `mk` scheme which might allow attackers to launch pages and execute scripts in In… |
|
CVE-2018-6125
MEDIUM 6.5
Insufficient policy enforcement in USB in Google Chrome on Windows prior to 67.0.3396.62 allowed a remote attacker to obtain potentially sensitive information … |
|
CVE-2021-37996
MEDIUM 5.5
Insufficient validation of untrusted input Downloads in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to bypass navigation restrictions via a m… |
|
CVE-2021-37995
MEDIUM 6.5
Inappropriate implementation in WebApp Installer in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to potentially overlay and spoof the contents… |
|
CVE-2021-37994
MEDIUM 6.5
Inappropriate implementation in iFrame Sandbox in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to bypass navigation restrictions via a crafted… |
|
CVE-2021-37990
MEDIUM 5.5
Inappropriate implementation in WebView in Google Chrome on Android prior to 95.0.4638.54 allowed a remote attacker to leak cross-origin data via a crafted app. |
|
CVE-2021-37989
MEDIUM 6.5
Inappropriate implementation in Blink in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to abuse content security policy via a crafted HTML page. |
|
CVE-2021-0922
MEDIUM · vendor
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2021-0919
MEDIUM · vendor
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2021-40472
MEDIUM 5.5
Microsoft Excel Information Disclosure Vulnerability |
|
CVE-2021-37976
MEDIUM 6.5
KEV
Inappropriate implementation in Memory in Google Chrome prior to 94.0.4606.71 allowed a remote attacker to obtain potentially sensitive information from proces… |
|
CVE-2021-37971
MEDIUM 4.3
Incorrect security UI in Web Browser UI in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a c… |
|
CVE-2021-37968
MEDIUM 4.3
Inappropriate implementation in Background Fetch API in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to leak cross-origin data via a crafted H… |
|
CVE-2021-37967
MEDIUM 4.3
Inappropriate implementation in Background Fetch API in Google Chrome prior to 94.0.4606.54 allowed a remote attacker who had compromised the renderer process … |
|
CVE-2021-37966
MEDIUM 4.3
Inappropriate implementation in Compositing in Google Chrome on Android prior to 94.0.4606.54 allowed a remote attacker to spoof the contents of the Omnibox (U… |
|
CVE-2021-37965
MEDIUM 4.3
Inappropriate implementation in Background Fetch API in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to leak cross-origin data via a crafted H… |
|
CVE-2021-37963
MEDIUM 4.3
Side-channel information leakage in DevTools in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to bypass site isolation via a crafted HTML page. |
|
CVE-2021-37958
MEDIUM 5.4
Inappropriate implementation in Navigation in Google Chrome on Windows prior to 94.0.4606.54 allowed a remote attacker to inject scripts or HTML into a privile… |
|
CVE-2021-30630
MEDIUM 4.3
Inappropriate implementation in Blink in Google Chrome prior to 93.0.4577.82 allowed a remote attacker who had compromised the renderer process to leak cross-o… |
|
CVE-2021-41795
MEDIUM 6.5
The Safari app extension bundled with 1Password for Mac 7.7.0 through 7.8.x before 7.8.7 is vulnerable to authorization bypass. By targeting a vulnerable compo… |
|
CVE-2021-22947
MEDIUM 5.9
When curl >= 7.20.0 and <= 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrade to TLS security, the server can respond and sen… |
|
CVE-2021-38669
MEDIUM 6.4
Microsoft Edge (Chromium-based) Tampering Vulnerability |
|
CVE-2021-38637
MEDIUM 5.5
Windows Storage Information Disclosure Vulnerability |
|
CVE-2021-38636
MEDIUM 5.5
Windows Redirected Drive Buffering SubSystem Driver Information Disclosure Vulnerability |
|
CVE-2021-38635
MEDIUM 5.5
Windows Redirected Drive Buffering SubSystem Driver Information Disclosure Vulnerability |
|
CVE-2021-38632
MEDIUM 5.7
Windows BitLocker Security Feature Bypass Vulnerability |
|
CVE-2021-38629
MEDIUM 6.5
Windows Ancillary Function Driver for WinSock Information Disclosure Vulnerability |
|
CVE-2021-38624
MEDIUM 6.5
Windows Key Storage Provider Security Feature Bypass Vulnerability |
|
CVE-2021-36972
MEDIUM 5.5
Windows SMB Information Disclosure Vulnerability |
|
CVE-2021-36969
MEDIUM 5.5
Windows Redirected Drive Buffering SubSystem Driver Information Disclosure Vulnerability |
|
CVE-2021-36962
MEDIUM 5.5
Windows Installer Information Disclosure Vulnerability |
|
CVE-2021-36961
MEDIUM 5.5
Windows Installer Denial of Service Vulnerability |
|
CVE-2021-36959
MEDIUM 5.5
Windows Authenticode Spoofing Vulnerability |
|
CVE-2021-40529
MEDIUM 5.9
The ElGamal implementation in Botan through 2.18.1, as used in Thunderbird and other products, allows plaintext recovery because, during interaction between tw… |
|
CVE-2021-30621
MEDIUM 6.5
Chromium: CVE-2021-30621 UI Spoofing in Autofill |
|
CVE-2021-30619
MEDIUM 6.5
Chromium: CVE-2021-30619 UI Spoofing in Autofill |
|
CVE-2021-30617
MEDIUM 6.5
Chromium: CVE-2021-30617 Policy bypass in Blink |
|
CVE-2021-30615
MEDIUM 6.5
Chromium: CVE-2021-30615 Cross-origin data leak in Navigation |
|
CVE-2021-36930
MEDIUM 5.3
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability |
|
CVE-2021-26436
MEDIUM 6.1
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability |
|
CVE-2021-0691
MEDIUM · vendor
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2021-30597
MEDIUM 6.8
Use after free in Browser UI in Google Chrome on Chrome prior to 92.0.4515.131 allowed a remote attacker to potentially exploit heap corruption via physical ac… |
|
CVE-2021-30596
MEDIUM 4.3
Incorrect security UI in Navigation in Google Chrome on Android prior to 92.0.4515.131 allowed a remote attacker to spoof the contents of the Omnibox (URL bar)… |
|
CVE-2021-30594
MEDIUM 6.8
Use after free in Page Info UI in Google Chrome prior to 92.0.4515.131 allowed a remote attacker to potentially exploit heap corruption via physical access to … |
|
CVE-2021-29987
MEDIUM 6.5
After requesting multiple permissions, and closing the first permission panel, subsequent permission panels will be displayed in a different position but still… |
|
CVE-2021-29982
MEDIUM 6.5
Due to incorrect JIT optimization, we incorrectly interpreted data from the wrong type of object, resulting in the potential leak of a single bit of memory. Th… |
|
CVE-2021-36938
MEDIUM 5.5
Windows Cryptographic Primitives Library Information Disclosure Vulnerability |
|
CVE-2021-34534
MEDIUM 6.8
Windows MSHTML Platform Remote Code Execution Vulnerability |
Manage your fleet with Appaloosa
Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.