Vulnerabilities
Tracked app vulnerabilities
6,377 CVEs affect a tracked app or OS (Medium, all platforms). 33 of them are in the CISA KEV catalog, meaning exploitation is confirmed.
- Matching CVEs
- 6,377
- Actively exploited
- 33
- Publication window
- 2009-07-30 → 2026-11-11
Chronological sort: newest to oldest. Use the KEV / severity filters above to prioritize.
| CVE |
|---|
|
CVE-2020-17153
MEDIUM 4.3
Microsoft Edge for Android Spoofing Vulnerability |
|
CVE-2020-17131
MEDIUM 4.2
Chakra Scripting Engine Memory Corruption Vulnerability |
|
CVE-2020-17130
MEDIUM 6.5
Microsoft Excel Security Feature Bypass Vulnerability |
|
CVE-2020-17126
MEDIUM 5.5
Microsoft Excel Information Disclosure Vulnerability |
|
CVE-2020-17119
MEDIUM 6.5
Microsoft Outlook Information Disclosure Vulnerability |
|
CVE-2020-26966
MEDIUM 6.5
Searching for a single word from the address bar caused an mDNS request to be sent on the local network searching for a hostname consisting of that string; res… |
|
CVE-2020-26965
MEDIUM 6.5
Some websites have a feature "Show Password" where clicking a button will change a password field into a textbook field, revealing the typed password. If, when… |
|
CVE-2020-26961
MEDIUM 6.5
When DNS over HTTPS is in use, it intentionally filters RFC1918 and related IP ranges from the responses as these do not make sense coming from a DoH resolver.… |
|
CVE-2020-26958
MEDIUM 6.1
Firefox did not block execution of scripts with incorrect MIME types when the response was intercepted and cached through a ServiceWorker. This could lead to a… |
|
CVE-2020-26956
MEDIUM 6.1
In some cases, removing HTML elements during sanitization would keep existing SVG event handlers and therefore lead to XSS. This vulnerability affects Firefox … |
|
CVE-2020-26953
MEDIUM 4.3
It was possible to cause the browser to enter fullscreen mode without displaying the security UI; thus making it possible to attempt a phishing attack or other… |
|
CVE-2020-26951
MEDIUM 6.1
A parsing and event loading mismatch in Firefox's SVG code could have allowed load events to fire, even after sanitization. An attacker already capable of expl… |
|
CVE-2020-29660
MEDIUM · vendor
A locking inconsistency issue was discovered in the tty subsystem of the Linux kernel through 5.9.13. drivers/tty/tty_io.c and drivers/tty/tty_jobctrl.c may al… |
|
CVE-2020-24441
MEDIUM 5.5
Adobe Acrobat Reader for Android version 20.6.2 (and earlier) does not properly restrict access to directories created by the application. This could result in… |
|
CVE-2020-17054
MEDIUM 4.2
Chakra Scripting Engine Memory Corruption Vulnerability |
|
CVE-2020-17048
MEDIUM 4.2
Chakra Scripting Engine Memory Corruption Vulnerability |
|
CVE-2020-15436
MEDIUM · vendor
Use-after-free vulnerability in fs/block_dev.c in the Linux kernel before 5.8 allows local users to gain privileges or cause a denial of service by leveraging … |
|
CVE-2020-1908
MEDIUM 4.6
Improper authorization of the Screen Lock feature in WhatsApp and WhatsApp Business for iOS prior to v2.20.100 could have permitted use of Siri to interact wit… |
|
CVE-2020-6557
MEDIUM 6.5
Inappropriate implementation in networking in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to perform domain spoofing via a crafted HTML page. |
|
CVE-2020-15989
MEDIUM 5.5
Uninitialized data in PDFium in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to obtain potentially sensitive information from process memory v… |
|
CVE-2020-15988
MEDIUM 6.3
Insufficient policy enforcement in downloads in Google Chrome on Windows prior to 86.0.4240.75 allowed a remote attacker who convinced the user to open files t… |
|
CVE-2020-15986
MEDIUM 6.5
Integer overflow in media in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
|
CVE-2020-15985
MEDIUM 6.5
Inappropriate implementation in Blink in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to spoof security UI via a crafted HTML page. |
|
CVE-2020-15984
MEDIUM 6.5
Insufficient policy enforcement in Omnibox in Google Chrome on iOS prior to 86.0.4240.75 allowed a remote attacker to spoof the contents of the Omnibox (URL ba… |
|
CVE-2020-15982
MEDIUM 6.5
Inappropriate implementation in cache in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to obtain potentially sensitive information from process… |
|
CVE-2020-15981
MEDIUM 6.5
Out of bounds read in audio in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to obtain potentially sensitive information from process memory vi… |
|
CVE-2020-15977
MEDIUM 6.5
Insufficient data validation in dialogs in Google Chrome on OS X prior to 86.0.4240.75 allowed a remote attacker to obtain potentially sensitive information fr… |
|
CVE-2020-15973
MEDIUM 6.5
Insufficient policy enforcement in extensions in Google Chrome prior to 86.0.4240.75 allowed an attacker who convinced a user to install a malicious extension … |
|
CVE-2020-16949
MEDIUM 4.7
<p>A denial of service vulnerability exists in Microsoft Outlook software when the software fails to properly handle objects in memory. An attacker who success… |
|
CVE-2020-0415
MEDIUM 5.5
In various locations in SystemUI, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure of cont… |
|
CVE-2020-15646
MEDIUM 5.9
If an attacker intercepts Thunderbird's initial attempt to perform automatic account setup using the Microsoft Exchange autodiscovery mechanism, and the attack… |
|
CVE-2020-1904
MEDIUM 5.5
A path validation issue in WhatsApp for iOS prior to v2.20.61 and WhatsApp Business for iOS prior to v2.20.61 could have allowed for directory traversal overwr… |
|
CVE-2020-1903
MEDIUM 5.5
An issue when unzipping docx, pptx, and xlsx documents in WhatsApp for iOS prior to v2.20.61 and WhatsApp Business for iOS prior to v2.20.61 could have resulte… |
|
CVE-2020-1901
MEDIUM 5.3
Receiving a large text message containing URLs in WhatsApp for iOS prior to v2.20.91.4 could have caused the application to freeze while processing the message. |
|
CVE-2020-15677
MEDIUM 6.1
By exploiting an Open Redirect vulnerability on a website, an attacker could have spoofed the site displayed in the download file dialog to show the original s… |
|
CVE-2020-15676
MEDIUM 6.1
Firefox sometimes ran the onload handler for SVG elements that the DOM sanitizer decided to remove, resulting in JavaScript being executed after pasting attack… |
|
CVE-2019-2194
MEDIUM · vendor
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2020-6571
MEDIUM 4.3
Insufficient data validation in Omnibox in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to perform domain spoofing via IDN homographs via a cr… |
|
CVE-2020-6570
MEDIUM 4.3
Information leakage in WebRTC in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to obtain potentially sensitive information via a crafted WebRTC… |
|
CVE-2020-6569
MEDIUM 6.3
Integer overflow in WebUSB in Google Chrome prior to 85.0.4183.83 allowed a remote attacker who had compromised the renderer process to potentially exploit hea… |
|
CVE-2020-6568
MEDIUM 6.5
Insufficient policy enforcement in intent handling in Google Chrome on Android prior to 85.0.4183.83 allowed a remote attacker to bypass navigation restriction… |
|
CVE-2020-6567
MEDIUM 6.5
Insufficient validation of untrusted input in command line handling in Google Chrome on Windows prior to 85.0.4183.83 allowed a remote attacker to bypass navig… |
|
CVE-2020-6566
MEDIUM 6.5
Insufficient policy enforcement in media in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
|
CVE-2020-6565
MEDIUM 6.5
Inappropriate implementation in Omnibox in Google Chrome on iOS prior to 85.0.4183.83 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) … |
|
CVE-2020-6564
MEDIUM 6.5
Inappropriate implementation in permissions in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to spoof the contents of a permission dialog via a… |
|
CVE-2020-6563
MEDIUM 6.5
Insufficient policy enforcement in intent handling in Google Chrome on Android prior to 85.0.4183.83 allowed a remote attacker to obtain potentially sensitive … |
|
CVE-2020-6562
MEDIUM 6.5
Insufficient policy enforcement in Blink in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
|
CVE-2020-6561
MEDIUM 6.5
Inappropriate implementation in Content Security Policy in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to leak cross-origin data via a crafte… |
|
CVE-2020-6560
MEDIUM 6.5
Insufficient policy enforcement in autofill in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
|
CVE-2020-6558
MEDIUM 6.5
Insufficient policy enforcement in iOSWeb in Google Chrome on iOS prior to 85.0.4183.83 allowed a remote attacker to bypass navigation restrictions via a craft… |
Manage your fleet with Appaloosa
Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.