Vulnerabilities

Tracked app vulnerabilities

6,377 CVEs affect a tracked app or OS (Medium, all platforms). 33 of them are in the CISA KEV catalog, meaning exploitation is confirmed.

Matching CVEs: 6,377
Actively exploited: 33
Publication window: 2009-07-30 → 2026-11-11

All CVEs 6,377 CISA KEV 33 Public exploit 39 All severities Critical High Medium Low Hide N/A

All platforms iOS Android macOS Windows

Chronological sort: newest to oldest. Use the KEV / severity filters above to prioritize.

6,377 entries Medium Clear all

CVE	Severity	KEV	Apps	Published
CVE-2020-6547 MEDIUM 6.5 2020-09-21 Incorrect security UI in media in Google Chrome prior to 84.0.4147.125 allowed a remote attacker to potentially obtain sensitive information via a crafted HTML…	MEDIUM 6.5	—		2020-09-21
CVE-2020-6538 MEDIUM 6.5 2020-09-21 Inappropriate implementation in WebView in Google Chrome on Android prior to 84.0.4147.105 allowed a remote attacker to leak cross-origin data via a crafted HT…	MEDIUM 6.5	—		2020-09-21
CVE-2020-15966 MEDIUM 4.3 2020-09-21 Insufficient policy enforcement in extensions in Google Chrome prior to 85.0.4183.121 allowed an attacker who convinced a user to install a malicious extension…	MEDIUM 4.3	—		2020-09-21
CVE-2020-15959 MEDIUM 4.3 2020-09-21 Insufficient policy enforcement in networking in Google Chrome prior to 85.0.4183.102 allowed an attacker who convinced the user to enable logging to obtain po…	MEDIUM 4.3	—		2020-09-21
CVE-2020-1224 MEDIUM 5.5 2020-09-11 <p>An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory. An attacker who exploited the vulnerabi…	MEDIUM 5.5	—		2020-09-11
CVE-2020-1180 MEDIUM 4.2 Microsoft Edge 2020-09-11 <p>A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory. The vulnerability could corrupt memo…	MEDIUM 4.2	—	Microsoft Edge	2020-09-11
CVE-2020-1172 MEDIUM 4.2 Microsoft Edge 2020-09-11 <p>A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory. The vulnerability could corrupt memo…	MEDIUM 4.2	—	Microsoft Edge	2020-09-11
CVE-2020-1057 MEDIUM 4.2 Microsoft Edge 2020-09-11 <p>A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory. The vulnerability could corrupt memo…	MEDIUM 4.2	—	Microsoft Edge	2020-09-11
CVE-2020-16884 MEDIUM 4.2 Microsoft Edge 2020-09-11 <p>A remote code execution vulnerability exists in the way that the IEToEdge Browser Helper Object (BHO) plugin on Internet Explorer handles objects in memory.…	MEDIUM 4.2	—	Microsoft Edge	2020-09-11
CVE-2020-0878 MEDIUM 4.2 KEV Microsoft Edge 2020-09-11 <p>A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory. The vulnerability could corrupt memory in a way th…	MEDIUM 4.2	KEV	Microsoft Edge	2020-09-11
CVE-2020-12464 MEDIUM · vendor Android 2020-09-08 Microsoft Security Update Guide entry — NVD enrichira.	MEDIUM · vendor	—	Android	2020-09-08
CVE-2020-10768 MEDIUM · vendor Android 2020-09-08 A flaw was found in the Linux Kernel before 5.8-rc1 in the prctl() function where it can be used to enable indirect branch speculation after it has been disabl…	MEDIUM · vendor	—	Android	2020-09-08
CVE-2020-10767 MEDIUM · vendor Android 2020-09-08 A flaw was found in the Linux kernel before 5.8-rc1 in the implementation of the Enhanced IBPB (Indirect Branch Prediction Barrier). The IBPB mitigation will b…	MEDIUM · vendor	—	Android	2020-09-08
CVE-2020-10766 MEDIUM · vendor Android 2020-09-08 A logic bug flaw was found in Linux kernel before 5.8-rc1 in the implementation of SSBD. A bug in the logic handling allows an attacker with a local account to…	MEDIUM · vendor	—	Android	2020-09-08
CVE-2017-8246 MEDIUM · vendor Android 2020-09-08 Microsoft Security Update Guide entry — NVD enrichira.	MEDIUM · vendor	—	Android	2020-09-08
CVE-2020-1574 MEDIUM 5.5 Windows 2020-08-17 A remote code execution vulnerability exists in the way that Microsoft Windows Codecs Library handles objects in memory. An attacker who successfully exploited…	MEDIUM 5.5	—	Windows	2020-08-17
CVE-2020-1503 MEDIUM 5.5 2020-08-17 An information disclosure vulnerability exists when Microsoft Word improperly discloses the contents of its memory. An attacker who exploited the vulnerability…	MEDIUM 5.5	—		2020-08-17
CVE-2020-1497 MEDIUM 5.5 2020-08-17 An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory. An attacker who exploited the vulnerabilit…	MEDIUM 5.5	—		2020-08-17
CVE-2020-1493 MEDIUM 5.5 2020-08-17 An information disclosure vulnerability exists when attaching files to Outlook messages. This vulnerability could potentially allow users to share attached fil…	MEDIUM 5.5	—		2020-08-17
CVE-2020-1483 MEDIUM 5.0 2020-08-17 A remote code execution vulnerability exists in Microsoft Outlook when the software fails to properly handle objects in memory. An attacker who successfully ex…	MEDIUM 5.0	—		2020-08-17
CVE-2020-8647 MEDIUM · vendor Android 2020-08-11 Microsoft Security Update Guide entry — NVD enrichira.	MEDIUM · vendor	—	Android	2020-08-11
CVE-2020-15658 MEDIUM 6.5 2020-08-10 The code for downloading files did not properly take care of special characters, which led to an attacker being able to cut off the file ending at an earlier p…	MEDIUM 6.5	—		2020-08-10
CVE-2020-15655 MEDIUM 6.5 2020-08-10 A redirected HTTP request which is observed or modified through a web extension could bypass existing CORS checks, leading to potential disclosure of cross-ori…	MEDIUM 6.5	—		2020-08-10
CVE-2020-15654 MEDIUM 6.5 2020-08-10 When in an endless loop, a website specifying a custom cursor using CSS could make it look like the user is interacting with the user interface, when they are …	MEDIUM 6.5	—		2020-08-10
CVE-2020-15653 MEDIUM 6.5 2020-08-10 An iframe sandbox element with the allow-popups flag could be bypassed when using noopener links. This could have led to security issues for websites relying o…	MEDIUM 6.5	—		2020-08-10
CVE-2020-15652 MEDIUM 6.5 2020-08-10 By observing the stack trace for JavaScript errors in web workers, it was possible to leak the result of a cross-origin redirect. This applied only to content …	MEDIUM 6.5	—		2020-08-10
CVE-2020-15648 MEDIUM 6.5 2020-08-10 Using object or embed tags, it was possible to frame other websites, even if they disallowed framing using the X-Frame-Options header. This vulnerability affec…	MEDIUM 6.5	—		2020-08-10
CVE-2020-6536 MEDIUM 4.3 2020-07-22 Incorrect security UI in PWAs in Google Chrome prior to 84.0.4147.89 allowed a remote attacker who had persuaded the user to install a PWA to spoof the content…	MEDIUM 4.3	—		2020-07-22
CVE-2020-6535 MEDIUM 6.1 2020-07-22 Insufficient data validation in WebUI in Google Chrome prior to 84.0.4147.89 allowed a remote attacker who had compromised the renderer process to inject scrip…	MEDIUM 6.1	—		2020-07-22
CVE-2020-6531 MEDIUM 4.3 2020-07-22 Side-channel information leakage in scroll to text in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to leak cross-origin data via a crafted HTM…	MEDIUM 4.3	—		2020-07-22
CVE-2020-6529 MEDIUM 4.3 2020-07-22 Inappropriate implementation in WebRTC in Google Chrome prior to 84.0.4147.89 allowed an attacker in a privileged network position to leak cross-origin data vi…	MEDIUM 4.3	—		2020-07-22
CVE-2020-6528 MEDIUM 4.3 2020-07-22 Incorrect security UI in basic auth in Google Chrome on iOS prior to 84.0.4147.89 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via …	MEDIUM 4.3	—		2020-07-22
CVE-2020-6527 MEDIUM 4.3 2020-07-22 Insufficient policy enforcement in CSP in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to bypass content security policy via a crafted HTML pa…	MEDIUM 4.3	—		2020-07-22
CVE-2020-6526 MEDIUM 6.5 2020-07-22 Inappropriate implementation in iframe sandbox in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to bypass navigation restrictions via a crafted…	MEDIUM 6.5	—		2020-07-22
CVE-2020-6521 MEDIUM 6.5 2020-07-22 Side-channel information leakage in autofill in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to obtain potentially sensitive information from …	MEDIUM 6.5	—		2020-07-22
CVE-2020-6519 MEDIUM 6.5 2020-07-22 Policy bypass in CSP in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to bypass content security policy via a crafted HTML page.	MEDIUM 6.5	—		2020-07-22
CVE-2020-6516 MEDIUM 4.3 2020-07-22 Policy bypass in CORS in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to leak cross-origin data via a crafted HTML page.	MEDIUM 4.3	—		2020-07-22
CVE-2020-6514 MEDIUM 6.5 2020-07-22 Inappropriate implementation in WebRTC in Google Chrome prior to 84.0.4147.89 allowed an attacker in a privileged network position to potentially exploit heap …	MEDIUM 6.5	—		2020-07-22
CVE-2020-6511 MEDIUM 6.5 2020-07-22 Information leak in content security policy in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to leak cross-origin data via a crafted HTML page.	MEDIUM 6.5	—		2020-07-22
CVE-2020-6506 MEDIUM 6.5 2020-07-22 Insufficient policy enforcement in WebView in Google Chrome on Android prior to 83.0.4103.106 allowed a remote attacker to bypass site isolation via a crafted …	MEDIUM 6.5	—		2020-07-22
CVE-2020-1462 MEDIUM 4.3 Microsoft Edge 2020-07-14 An information disclosure vulnerability exists when Skype for Business is accessed via Microsoft Edge (EdgeHTML-based), aka 'Skype for Business via Microsoft E…	MEDIUM 4.3	—	Microsoft Edge	2020-07-14
CVE-2020-1445 MEDIUM 5.5 2020-07-14 An information disclosure vulnerability exists when Microsoft Office improperly discloses the contents of its memory, aka 'Microsoft Office Information Disclos…	MEDIUM 5.5	—		2020-07-14
CVE-2020-1433 MEDIUM 6.5 Microsoft Edge 2020-07-14 An information disclosure vulnerability exists when Microsoft Edge PDF Reader improperly handles objects in memory, aka 'Microsoft Edge PDF Information Disclos…	MEDIUM 6.5	—	Microsoft Edge	2020-07-14
CVE-2020-1342 MEDIUM 5.5 2020-07-14 An information disclosure vulnerability exists when Microsoft Office software reads out of bound memory due to an uninitialized variable, which could disclose …	MEDIUM 5.5	—		2020-07-14
CVE-2020-12421 MEDIUM 6.5 2020-07-09 When performing add-on updates, certificate chains terminating in non-built-in-roots were rejected (even if they were legitimately added by an administrator.) …	MEDIUM 6.5	—		2020-07-09
CVE-2020-12418 MEDIUM 6.5 2020-07-09 Manipulating individual parts of a URL object could have caused an out-of-bounds read, leaking process memory to malicious JavaScript. This vulnerability affec…	MEDIUM 6.5	—		2020-07-09
CVE-2020-12405 MEDIUM 5.3 2020-07-09 When browsing a malicious page, a race condition in our SharedWorkerService could occur and lead to a potentially exploitable crash. This vulnerability affects…	MEDIUM 5.3	—		2020-07-09
CVE-2020-12399 MEDIUM 4.4 2020-07-09 NSS has shown timing differences when performing DSA signatures, which was exploitable and could eventually leak private keys. This vulnerability affects Thund…	MEDIUM 4.4	—		2020-07-09
CVE-2020-15358 MEDIUM 5.5 Android 2020-06-27 In SQLite before 3.32.3, select.c mishandles query-flattener optimization, leading to a multiSelectOrderBy heap overflow because of misuse of transitive proper…	MEDIUM 5.5	—	Android	2020-06-27
CVE-2020-14422 MEDIUM 5.9 2020-06-18 Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes, which might allow a remote attacker to…	MEDIUM 5.9	—		2020-06-18

Manage your fleet with Appaloosa

Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.

Discover Appaloosa MDM