Vulnerabilities
Tracked app vulnerabilities
10,960 CVEs affect a tracked app or OS (all severities, macOS). 106 of them are in the CISA KEV catalog, meaning exploitation is confirmed.
- Matching CVEs
- 10,960
- Actively exploited
- 106
- Publication window
- 1997-01-01 → 2026-11-11
Chronological sort: newest to oldest. Use the KEV / severity filters above to prioritize.
| CVE |
|---|
|
CVE-2025-24088
HIGH 7.5
The issue was addressed by adding additional logic. This issue is fixed in macOS Tahoe 26. An app may be able to override MDM-enforced settings from profiles. |
|
CVE-2025-59375
libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing. |
|
CVE-2025-40909
MEDIUM · vendor
[Apple Perl] Multiple issues in Perl |
|
CVE-2025-9086
1. A cookie is set using the `secure` keyword for `https://target` 2. curl is redirected to or otherwise made to speak with `http://target` (same hostname, … |
|
CVE-2025-10201
HIGH 8.8
Inappropriate implementation in Mojo in Google Chrome on Android, Linux, ChromeOS prior to 140.0.7339.127 allowed a remote attacker to bypass site isolation vi… |
|
CVE-2025-10200
HIGH 8.8
Use after free in Serviceworker in Google Chrome on Desktop prior to 140.0.7339.127 allowed a remote attacker to potentially exploit heap corruption via a craf… |
|
CVE-2025-54910
HIGH 8.4
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally. |
|
CVE-2025-54908
HIGH 7.8
Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally. |
|
CVE-2025-54907
HIGH 7.8
Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code locally. |
|
CVE-2025-54905
HIGH 7.1
Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to disclose information locally. |
|
CVE-2025-54904
HIGH 7.8
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
|
CVE-2025-54903
HIGH 7.8
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
|
CVE-2025-54902
HIGH 7.8
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
|
CVE-2025-54901
MEDIUM 5.5
Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. |
|
CVE-2025-54900
HIGH 7.8
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
|
CVE-2025-54899
HIGH 7.8
Free of memory not on the heap in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
|
CVE-2025-54898
HIGH 7.8
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
|
CVE-2025-54896
HIGH 7.8
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
|
CVE-2025-9867
MEDIUM 5.4
Inappropriate implementation in Downloads in Google Chrome on Android prior to 140.0.7339.80 allowed a remote attacker to perform UI spoofing via a crafted HTM… |
|
CVE-2025-9866
HIGH 8.8
Inappropriate implementation in Extensions in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to bypass content security policy via a crafted HT… |
|
CVE-2025-9865
MEDIUM 5.4
Inappropriate implementation in Toolbar in Google Chrome on Android prior to 140.0.7339.80 allowed a remote attacker who convinced a user to engage in specific… |
|
CVE-2025-43284
MEDIUM 5.5
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app… |
|
CVE-2025-43268
HIGH 7.8
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.6. A malicious app may be able to gain root privileges. |
|
CVE-2025-43255
LOW 3.3
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app… |
|
CVE-2025-43187
HIGH 7.8
This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. Running an hdiu… |
|
CVE-2024-54568
MEDIUM 4.3
The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.2. Parsing a maliciously crafted file may lead to an unexpected … |
|
CVE-2024-54554
MEDIUM 5.5
This issue was addressed with improved handling of symlinks. This issue is fixed in macOS Sequoia 15.1. An app may be able to access sensitive user data. |
|
CVE-2024-44271
LOW 3.3
The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.2. An app may be able to record the screen without an indicator. |
|
CVE-2025-9478
HIGH 8.8
Use after free in ANGLE in Google Chrome prior to 139.0.7258.154 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chr… |
|
CVE-2025-4609
CRITICAL 9.6
Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 136.0.7103.113 allowed a remote attacker to potentially per… |
|
CVE-2025-43300
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.8.5 and iPadOS 15.8.5, iOS 16.7.12 and iPadOS 16.7.12, … |
|
CVE-2025-9132
HIGH 8.8
Out of bounds write in V8 in Google Chrome prior to 139.0.7258.138 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (C… |
|
CVE-2025-8901
HIGH 8.8
Out of bounds write in ANGLE in Google Chrome prior to 139.0.7258.127 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page.… |
|
CVE-2025-8882
HIGH 8.8
Use after free in Aura in Google Chrome prior to 139.0.7258.127 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially… |
|
CVE-2025-8881
MEDIUM 6.5
Inappropriate implementation in File Picker in Google Chrome prior to 139.0.7258.127 allowed a remote attacker who convinced a user to engage in specific UI ge… |
|
CVE-2025-8880
HIGH 8.8
Race in V8 in Google Chrome prior to 139.0.7258.127 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium sec… |
|
CVE-2025-8879
HIGH 8.8
Heap buffer overflow in libaom in Google Chrome prior to 139.0.7258.127 allowed a remote attacker to potentially exploit heap corruption via a curated set of g… |
|
CVE-2025-53761
HIGH 7.8
Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally. |
|
CVE-2025-53741
HIGH 7.8
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
|
CVE-2025-53739
HIGH 7.8
Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
|
CVE-2025-53738
HIGH 7.8
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally. |
|
CVE-2025-53737
HIGH 7.8
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
|
CVE-2025-53736
MEDIUM 6.8
Buffer over-read in Microsoft Office Word allows an unauthorized attacker to disclose information locally. |
|
CVE-2025-53735
HIGH 7.8
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
|
CVE-2025-53733
HIGH 8.4
Incorrect conversion between numeric types in Microsoft Office Word allows an unauthorized attacker to execute code locally. |
|
CVE-2025-8583
MEDIUM 4.3
Inappropriate implementation in Permissions in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (… |
|
CVE-2025-8582
MEDIUM 4.3
Insufficient validation of untrusted input in Core in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to spoof the contents of the Omnibox (URL … |
|
CVE-2025-8581
MEDIUM 4.3
Inappropriate implementation in Extensions in Google Chrome prior to 139.0.7258.66 allowed a remote attacker who convinced a user to engage in specific UI gest… |
|
CVE-2025-8580
MEDIUM 4.3
Inappropriate implementation in Filesystems in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (… |
|
CVE-2025-8579
MEDIUM 4.3
Inappropriate implementation in Picture In Picture in Google Chrome prior to 139.0.7258.66 allowed a remote attacker who convinced a user to engage in specific… |
Manage your fleet with Appaloosa
Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.