Vulnerabilities
Tracked app vulnerabilities
6,380 CVEs affect a tracked app or OS (Medium, all platforms). 33 of them are in the CISA KEV catalog, meaning exploitation is confirmed.
- Matching CVEs
- 6,380
- Actively exploited
- 33
- Publication window
- 2009-07-30 → 2026-11-11
Chronological sort: newest to oldest. Use the KEV / severity filters above to prioritize.
| CVE |
|---|
|
CVE-2018-8297
MEDIUM 4.3
An information disclosure vulnerability exists when Microsoft Edge improperly handles objects in memory, aka "Microsoft Edge Information Disclosure Vulnerabili… |
|
CVE-2018-8289
MEDIUM 4.3
An information disclosure vulnerability exists when Microsoft Edge improperly handles objects in memory, aka "Microsoft Edge Information Disclosure Vulnerabili… |
|
CVE-2018-8278
MEDIUM 6.1
A spoofing vulnerability exists when Microsoft Edge improperly handles specific HTML content, aka "Microsoft Edge Spoofing Vulnerability." This affects Microso… |
|
CVE-2018-8276
MEDIUM 6.5
A security feature bypass vulnerability exists in the Microsoft Chakra scripting engine that allows Control Flow Guard (CFG) to be bypassed, aka "Scripting Eng… |
|
CVE-2018-1061
MEDIUM 6.5
python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in the difflib.IS_LINE_JUNK method. An attacker … |
|
CVE-2018-8246
MEDIUM 5.5
An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory, aka "Microsoft Excel Information Disclosur… |
|
CVE-2018-8244
MEDIUM 6.5
An elevation of privilege vulnerability exists when Microsoft Outlook does not validate attachment headers properly, aka "Microsoft Outlook Elevation of Privil… |
|
CVE-2018-8235
MEDIUM 4.3
A security feature bypass vulnerability exists when Microsoft Edge improperly handles requests of different origins, aka "Microsoft Edge Security Feature Bypas… |
|
CVE-2018-8234
MEDIUM 4.3
An information disclosure vulnerability exists when Microsoft Edge improperly handles objects in memory, aka "Microsoft Edge Information Disclosure Vulnerabili… |
|
CVE-2018-0871
MEDIUM 4.3
An information disclosure vulnerability exists when Edge improperly marks files, aka "Microsoft Edge Information Disclosure Vulnerability." This affects Micros… |
|
CVE-2018-12271
MEDIUM 6.4
An issue was discovered in the com.getdropbox.Dropbox app 100.2 for iOS. The LAContext class for Biometric (TouchID) validation allows authentication bypass by… |
|
CVE-2018-5185
MEDIUM 6.5
Plaintext of decrypted emails can leak through by user submitting an embedded form. This vulnerability affects Thunderbird ESR < 52.8 and Thunderbird < 52.8. |
|
CVE-2018-5170
MEDIUM 4.3
It is possible to spoof the filename of an attachment and display an arbitrary attachment name. This could lead to a user opening a remote attachment which is … |
|
CVE-2018-5168
MEDIUM 5.3
Sites can bypass security checks on permissions to install lightweight themes by manipulating the "baseURI" property of the theme element. This could allow a m… |
|
CVE-2018-5161
MEDIUM 4.3
Crafted message headers can cause a Thunderbird process to hang on receiving the message. This vulnerability affects Thunderbird ESR < 52.8 and Thunderbird < 5… |
|
CVE-2018-5117
MEDIUM 5.3
If right-to-left text is used in the addressbar with left-to-right alignment, it is possible in some circumstances to scroll this text to spoof the displayed U… |
|
CVE-2017-7848
MEDIUM 5.3
RSS fields can inject new lines into the created email structure, modifying the message body. This vulnerability affects Thunderbird < 52.5.2. |
|
CVE-2017-7847
MEDIUM 4.3
Crafted CSS in an RSS feed can leak and reveal local path strings, which may contain user name. This vulnerability affects Thunderbird < 52.5.2. |
|
CVE-2017-7830
MEDIUM 6.5
The Resource Timing API incorrectly revealed navigations in cross-origin iframes. This is a same-origin policy violation and could allow for data theft of URLs… |
|
CVE-2017-7829
MEDIUM 5.3
It is possible to spoof the sender's email address and display an arbitrary sender address to the email recipient. The real sender's address is not displayed i… |
|
CVE-2017-7825
MEDIUM 5.3
Several fonts on OS X display some Tibetan and Arabic characters as whitespace. When used in the addressbar as part of an IDN this can be used for domain name … |
|
CVE-2017-7823
MEDIUM 5.4
The content security policy (CSP) "sandbox" directive did not create a unique origin for the document, causing it to behave as if the "allow-same-origin" keywo… |
|
CVE-2017-7791
MEDIUM 5.3
On pages containing an iframe, the "data:" protocol can be used to create a modal alert that will render over arbitrary domains following page navigation, spoo… |
|
CVE-2017-7782
MEDIUM 5.3
An error in the "WindowsDllDetourPatcher" where a RWX ("Read/Write/Execute") 4k block is allocated but never protected, violating DEP protections. Note: This a… |
|
CVE-2017-7764
MEDIUM 5.3
Characters from the "Canadian Syllabics" unicode block can be mixed with characters from other unicode blocks in the addressbar instead of being rendered as th… |
|
CVE-2017-7763
MEDIUM 5.3
Default fonts on OS X display some Tibetan characters as whitespace. When used in the addressbar as part of an IDN this can be used for domain name spoofing at… |
|
CVE-2017-5466
MEDIUM 6.1
If a page is loaded from an original site through a hyperlink and contains a redirect to a "data:text/html" URL, triggering a reload will run the reloaded "dat… |
|
CVE-2017-5462
MEDIUM 5.3
A flaw in DRBG number generation within the Network Security Services (NSS) library where the internal state V does not correctly carry bits over. The NSS libr… |
|
CVE-2017-5451
MEDIUM 4.3
A mechanism to spoof the addressbar through the user interaction on the addressbar and the "onblur" event. The event could be used by script to affect text dis… |
|
CVE-2017-5426
MEDIUM 5.3
On Linux, if the secure computing mode BPF (seccomp-bpf) filter is running when the Gecko Media Plugin sandbox is started, the sandbox fails to be applied and … |
|
CVE-2017-5418
MEDIUM 5.3
An out of bounds read error occurs when parsing some HTTP digest authorization responses, resulting in information leakage through the reading of random memory… |
|
CVE-2017-5414
MEDIUM 5.5
The file picker dialog can choose and display the wrong local default directory when instantiated. On some operating systems, this can lead to information disc… |
|
CVE-2017-5408
MEDIUM 5.3
Video files loaded video captions cross-origin without checking for the presence of CORS headers permitting such cross-origin use, leading to potential informa… |
|
CVE-2017-5407
MEDIUM 6.5
Using SVG filters that don't use the fixed point math implementation on a target iframe, a malicious page can extract pixel values from a targeted user. This c… |
|
CVE-2017-5405
MEDIUM 5.3
Certain response codes in FTP connections can result in the use of uninitialized values for ports in FTP operations. This vulnerability affects Firefox < 52, F… |
|
CVE-2017-5383
MEDIUM 5.3
URLs containing certain unicode glyphs for alternative hyphens and quotes do not properly trigger punycode display, allowing for domain name spoofing attacks i… |
|
CVE-2016-9895
MEDIUM 6.1
Event handlers on "marquee" elements were executed despite a strict Content Security Policy (CSP) that disallowed inline JavaScript. This vulnerability affects… |
|
CVE-2016-9074
MEDIUM 5.9
An existing mitigation of timing side-channel attacks is insufficient in some circumstances. This issue is addressed in Network Security Services (NSS) 3.26.1.… |
|
CVE-2016-5294
MEDIUM 5.5
The Mozilla Updater can be made to choose an arbitrary target working directory for output files resulting from the update process. This vulnerability requires… |
|
CVE-2016-5291
MEDIUM 5.5
A same-origin policy bypass with local shortcut files to load arbitrary local content from disk. This vulnerability affects Thunderbird < 45.5, Firefox ESR < 4… |
|
CVE-2017-17689
MEDIUM 5.9
+1
The S/MIME specification allows a Cipher Block Chaining (CBC) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL. |
|
CVE-2017-17688
MEDIUM 5.9
The OpenPGP specification allows a Cipher Feedback Mode (CFB) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL. NOTE: t… |
|
CVE-2018-8163
MEDIUM 5.5
An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory, aka "Microsoft Excel Information Disclosur… |
|
CVE-2018-8123
MEDIUM 4.3
An information disclosure vulnerability exists when Microsoft Edge improperly handles objects in memory, aka "Microsoft Edge Information Disclosure Vulnerabili… |
|
CVE-2018-8112
MEDIUM 4.3
A security feature bypass vulnerability exists when Microsoft Edge improperly handles requests of different origins, aka "Microsoft Edge Security Feature Bypas… |
|
CVE-2018-1025
MEDIUM 4.3
An information disclosure vulnerability exists when affected Microsoft browsers improperly handle objects in memory, aka "Microsoft Browser Information Disclos… |
|
CVE-2018-1021
MEDIUM 4.3
An information disclosure vulnerability exists when Microsoft Edge improperly handles objects in memory, aka "Microsoft Edge Information Disclosure Vulnerabili… |
|
CVE-2018-10229
MEDIUM 4.8
A hardware vulnerability in GPU memory modules allows attackers to accelerate micro-architectural attacks through the use of the JavaScript WebGL API. |
|
CVE-2018-0998
MEDIUM 4.3
An information disclosure vulnerability exists when Microsoft Edge PDF Reader improperly handles objects in memory, aka "Microsoft Edge Information Disclosure … |
|
CVE-2018-0950
MEDIUM 6.5
An information disclosure vulnerability exists when Office renders Rich Text Format (RTF) email messages containing OLE objects when a message is opened or pre… |
Manage your fleet with Appaloosa
Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.