Vulnerabilities
Tracked app vulnerabilities
12,531 CVEs affect a tracked app or OS (High, Windows). 246 of them are in the CISA KEV catalog, meaning exploitation is confirmed.
- Matching CVEs
- 12,531
- Actively exploited
- 246
- Publication window
- 2004-07-27 → 2026-11-11
Chronological sort: newest to oldest. Use the KEV / severity filters above to prioritize.
| CVE |
|---|
|
CVE-2025-8292
HIGH 8.8
Use after free in Media Stream in Google Chrome prior to 138.0.7204.183 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML pag… |
|
CVE-2025-8011
HIGH 8.8
Type Confusion in V8 in Google Chrome prior to 138.0.7204.168 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromi… |
|
CVE-2025-8010
HIGH 8.8
Type Confusion in V8 in Google Chrome prior to 138.0.7204.168 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromi… |
|
CVE-2025-8040
HIGH 8.8
Memory safety bugs present in Firefox ESR 140.0, Thunderbird ESR 140.0, Firefox 140 and Thunderbird 140. Some of these bugs showed evidence of memory corruptio… |
|
CVE-2025-8039
HIGH 8.1
In some cases search terms persisted in the URL bar even after navigating away from the search page. This vulnerability was fixed in Firefox 141, Firefox ESR 1… |
|
CVE-2025-8036
HIGH 8.1
Thunderbird cached CORS preflight responses across IP address changes. This allowed circumventing CORS with DNS rebinding. This vulnerability was fixed in Fire… |
|
CVE-2025-8035
HIGH 8.8
Memory safety bugs present in Firefox ESR 128.12, Thunderbird ESR 128.12, Firefox ESR 140.0, Thunderbird ESR 140.0, Firefox 140 and Thunderbird 140. Some of th… |
|
CVE-2025-8034
HIGH 8.8
Memory safety bugs present in Firefox ESR 115.25, Firefox ESR 128.12, Thunderbird ESR 128.12, Firefox ESR 140.0, Thunderbird ESR 140.0, Firefox 140 and Thunder… |
|
CVE-2025-8032
HIGH 8.1
XSLT document loading did not correctly propagate the source document which bypassed its CSP. This vulnerability was fixed in Firefox 141, Firefox ESR 128.13, … |
|
CVE-2025-8030
HIGH 8.1
Insufficient escaping in the “Copy as cURL” feature could potentially be used to trick a user into executing unexpected code. This vulnerability was fixed in F… |
|
CVE-2025-8029
HIGH 8.1
Thunderbird executed `javascript:` URLs when used in `object` and `embed` tags. This vulnerability was fixed in Firefox 141, Firefox ESR 128.13, Firefox ESR 14… |
|
CVE-2025-53817
HIGH 7.5
7-Zip is a file archiver with a high compression ratio. 7-Zip supports extracting from Compound Documents. Prior to version 25.0.0, a null pointer dereference … |
|
CVE-2025-53816
HIGH 7.5
7-Zip is a file archiver with a high compression ratio. Zeroes written outside heap buffer in RAR5 handler may lead to memory corruption and denial of service … |
|
CVE-2025-7657
HIGH 8.8
Use after free in WebRTC in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Ch… |
|
CVE-2025-7656
HIGH 8.8
Integer overflow in V8 in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chro… |
|
CVE-2025-6558
Insufficient validation of untrusted input in ANGLE and GPU in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to potentially perform a sandbox… |
|
CVE-2025-6965
There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns available. This could lead… |
|
CVE-2025-49711
HIGH 7.8
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
|
CVE-2025-49705
HIGH 7.8
Heap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally. |
|
CVE-2025-49703
HIGH 7.8
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally. |
|
CVE-2025-49700
HIGH 7.8
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally. |
|
CVE-2025-49699
HIGH 7.0
+1
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. |
|
CVE-2025-49698
HIGH 7.8
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally. |
|
CVE-2025-49753
HIGH · vendor
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability |
|
CVE-2025-49744
HIGH · vendor
Windows Graphics Component Elevation of Privilege Vulnerability |
|
CVE-2025-49742
HIGH · vendor
Windows Graphics Component Remote Code Execution Vulnerability |
|
CVE-2025-49740
HIGH · vendor
Windows SmartScreen Security Feature Bypass Vulnerability |
|
CVE-2025-49733
HIGH · vendor
Win32k Elevation of Privilege Vulnerability |
|
CVE-2025-49732
HIGH · vendor
Windows Graphics Component Elevation of Privilege Vulnerability |
|
CVE-2025-49730
HIGH · vendor
Microsoft Windows QoS Scheduler Driver Elevation of Privilege Vulnerability |
|
CVE-2025-49729
HIGH · vendor
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability |
|
CVE-2025-49727
HIGH · vendor
Win32k Elevation of Privilege Vulnerability |
|
CVE-2025-49726
HIGH · vendor
Windows Notification Elevation of Privilege Vulnerability |
|
CVE-2025-49725
HIGH · vendor
Windows Notification Elevation of Privilege Vulnerability |
|
CVE-2025-49724
HIGH · vendor
Windows Connected Devices Platform Service Remote Code Execution Vulnerability |
|
CVE-2025-49723
HIGH · vendor
Windows StateRepository API Server file Tampering Vulnerability |
|
CVE-2025-49722
HIGH · vendor
Windows Print Spooler Denial of Service Vulnerability |
|
CVE-2025-49721
HIGH · vendor
Windows Fast FAT File System Driver Elevation of Privilege Vulnerability |
|
CVE-2025-49716
HIGH · vendor
Windows Netlogon Denial of Service Vulnerability |
|
CVE-2025-49694
HIGH · vendor
Microsoft Brokering File System Elevation of Privilege Vulnerability |
|
CVE-2025-49693
HIGH · vendor
Microsoft Brokering File System Elevation of Privilege Vulnerability |
|
CVE-2025-49691
HIGH · vendor
Windows Miracast Wireless Display Remote Code Execution Vulnerability |
|
CVE-2025-49690
HIGH · vendor
Capability Access Management Service (camsvc) Elevation of Privilege Vulnerability |
|
CVE-2025-49689
HIGH · vendor
Microsoft Virtual Hard Disk Elevation of Privilege Vulnerability |
|
CVE-2025-49688
HIGH · vendor
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability |
|
CVE-2025-49687
HIGH · vendor
Windows Input Method Editor (IME) Elevation of Privilege Vulnerability |
|
CVE-2025-49686
HIGH · vendor
Windows TCP/IP Driver Elevation of Privilege Vulnerability |
|
CVE-2025-49685
HIGH · vendor
Windows Search Service Elevation of Privilege Vulnerability |
|
CVE-2025-49684
HIGH · vendor
Windows Storage Port Driver Information Disclosure Vulnerability |
|
CVE-2025-49683
HIGH · vendor
Microsoft Virtual Hard Disk Remote Code Execution Vulnerability |
Manage your fleet with Appaloosa
Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.