Vulnerabilities
Tracked app vulnerabilities
12,531 CVEs affect a tracked app or OS (High, Windows). 246 of them are in the CISA KEV catalog, meaning exploitation is confirmed.
- Matching CVEs
- 12,531
- Actively exploited
- 246
- Publication window
- 2004-07-27 → 2026-11-11
Chronological sort: newest to oldest. Use the KEV / severity filters above to prioritize.
| CVE |
|---|
|
CVE-2025-33057
HIGH · vendor
Windows Local Security Authority (LSA) Denial of Service Vulnerability |
|
CVE-2025-33056
HIGH · vendor
Windows Local Security Authority (LSA) Denial of Service Vulnerability |
|
CVE-2025-33055
HIGH · vendor
Windows Storage Management Provider Information Disclosure Vulnerability |
|
CVE-2025-33053
Internet Shortcut Files Remote Code Execution Vulnerability |
|
CVE-2025-33052
HIGH · vendor
Windows DWM Core Library Information Disclosure Vulnerability |
|
CVE-2025-33050
HIGH · vendor
DHCP Server Service Denial of Service Vulnerability |
|
CVE-2025-32725
HIGH · vendor
DHCP Server Service Denial of Service Vulnerability |
|
CVE-2025-32724
HIGH · vendor
Windows Local Security Authority Subsystem Service (LSASS) Denial of Service Vulnerability |
|
CVE-2025-32722
HIGH · vendor
Windows Storage Port Driver Information Disclosure Vulnerability |
|
CVE-2025-32721
HIGH · vendor
Windows Recovery Driver Elevation of Privilege Vulnerability |
|
CVE-2025-32720
HIGH · vendor
Windows Storage Management Provider Information Disclosure Vulnerability |
|
CVE-2025-32719
HIGH · vendor
Windows Storage Management Provider Information Disclosure Vulnerability |
|
CVE-2025-32718
HIGH · vendor
Windows SMB Client Elevation of Privilege Vulnerability |
|
CVE-2025-32716
HIGH · vendor
Windows Media Elevation of Privilege Vulnerability |
|
CVE-2025-32715
HIGH · vendor
Remote Desktop Protocol Client Information Disclosure Vulnerability |
|
CVE-2025-32714
HIGH · vendor
Windows Installer Elevation of Privilege Vulnerability |
|
CVE-2025-32713
HIGH · vendor
Windows Common Log File System Driver Elevation of Privilege Vulnerability |
|
CVE-2025-32712
HIGH · vendor
Win32k Elevation of Privilege Vulnerability |
|
CVE-2025-3052
HIGH · vendor
Cert CC: CVE-2025-3052 InsydeH2O Secure Boot Bypass |
|
CVE-2025-24069
HIGH · vendor
Windows Storage Management Provider Information Disclosure Vulnerability |
|
CVE-2025-24068
HIGH · vendor
Windows Storage Management Provider Information Disclosure Vulnerability |
|
CVE-2025-24065
HIGH · vendor
Windows Storage Management Provider Information Disclosure Vulnerability |
|
CVE-2025-5419
HIGH 8.8
KEV
Out of bounds read and write in V8 in Google Chrome prior to 137.0.7151.68 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML … |
|
CVE-2025-5068
HIGH 8.8
Use after free in Blink in Google Chrome prior to 137.0.7151.68 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chro… |
|
CVE-2025-5280
HIGH 8.8
Out of bounds write in V8 in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Ch… |
|
CVE-2025-5063
HIGH 8.8
Use after free in Compositing in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.… |
|
CVE-2025-5272
HIGH 7.3
Memory safety bugs present in Firefox 138 and Thunderbird 138. Some of these bugs showed evidence of memory corruption and we presume that with enough effort s… |
|
CVE-2025-5270
HIGH 7.5
In certain cases, SNI could have been sent unencrypted even when encrypted DNS was enabled. This vulnerability was fixed in Firefox 139 and Thunderbird 139. |
|
CVE-2025-5269
HIGH 8.1
Memory safety bug present in Firefox ESR 128.10, and Thunderbird 128.10. This bug showed evidence of memory corruption and we presume that with enough effort t… |
|
CVE-2025-5268
HIGH 8.1
Memory safety bugs present in Firefox 138, Thunderbird 138, Firefox ESR 128.10, and Thunderbird 128.10. Some of these bugs showed evidence of memory corruption… |
|
CVE-2025-5262
HIGH 7.5
A double-free could have occurred in `vpx_codec_enc_init_multi` after a failed allocation when initializing the encoder for WebRTC. This could have caused memo… |
|
CVE-2025-4919
HIGH 8.8
An attacker was able to perform an out-of-bounds read or write on a JavaScript object by confusing array index sizes. This vulnerability was fixed in Firefox 1… |
|
CVE-2025-3909
HIGH 8.1
Thunderbird's handling of the X-Mozilla-External-Attachment-URL header can be exploited to execute JavaScript in the file:/// context. By crafting a nested ema… |
|
CVE-2025-3875
HIGH 7.5
Thunderbird parses addresses in a way that can allow sender spoofing in case the server allows an invalid From address to be used. For example, if the From hea… |
|
CVE-2025-32704
HIGH 8.4
Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
|
CVE-2025-30388
HIGH · vendor
Heap-based buffer overflow in Windows Win32K - GRFX allows an unauthorized attacker to execute code locally. |
|
CVE-2025-30383
HIGH 7.8
Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
|
CVE-2025-30381
HIGH 7.8
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
|
CVE-2025-30379
HIGH 7.8
Release of invalid pointer or reference in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
|
CVE-2025-30377
HIGH 8.4
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. |
|
CVE-2025-30376
HIGH 7.8
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
|
CVE-2025-30375
HIGH 7.8
Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
|
CVE-2025-29979
HIGH 7.8
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
|
CVE-2025-29977
HIGH 7.8
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
|
CVE-2025-32709
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability |
|
CVE-2025-32707
HIGH · vendor
NTFS Elevation of Privilege Vulnerability |
|
CVE-2025-32706
Windows Common Log File System Driver Elevation of Privilege Vulnerability |
|
CVE-2025-32701
Windows Common Log File System Driver Elevation of Privilege Vulnerability |
|
CVE-2025-30400
Microsoft DWM Core Library Elevation of Privilege Vulnerability |
|
CVE-2025-30397
Scripting Engine Memory Corruption Vulnerability |
Manage your fleet with Appaloosa
Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.