Vulnerabilities
Tracked app vulnerabilities
12,531 CVEs affect a tracked app or OS (High, Windows). 246 of them are in the CISA KEV catalog, meaning exploitation is confirmed.
- Matching CVEs
- 12,531
- Actively exploited
- 246
- Publication window
- 2004-07-27 → 2026-11-11
Chronological sort: newest to oldest. Use the KEV / severity filters above to prioritize.
| CVE |
|---|
|
CVE-2025-26668
HIGH · vendor
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability |
|
CVE-2025-26667
HIGH · vendor
Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability |
|
CVE-2025-26666
HIGH · vendor
Windows Media Remote Code Execution Vulnerability |
|
CVE-2025-26665
HIGH · vendor
Windows upnphost.dll Elevation of Privilege Vulnerability |
|
CVE-2025-26664
HIGH · vendor
Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability |
|
CVE-2025-26652
HIGH · vendor
Windows Standards-Based Storage Management Service Denial of Service Vulnerability |
|
CVE-2025-26651
HIGH · vendor
Windows Local Session Manager (LSM) Denial of Service Vulnerability |
|
CVE-2025-26649
HIGH · vendor
Windows Secure Channel Elevation of Privilege Vulnerability |
|
CVE-2025-26648
HIGH · vendor
Windows Kernel Elevation of Privilege Vulnerability |
|
CVE-2025-26647
HIGH · vendor
Windows Kerberos Elevation of Privilege Vulnerability |
|
CVE-2025-26644
HIGH · vendor
Windows Hello Spoofing Vulnerability |
|
CVE-2025-26641
HIGH · vendor
Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability |
|
CVE-2025-26640
HIGH · vendor
Windows Digital Media Elevation of Privilege Vulnerability |
|
CVE-2025-26639
HIGH · vendor
Windows USB Print Driver Elevation of Privilege Vulnerability |
|
CVE-2025-26637
HIGH · vendor
Windows BitLocker Security Feature Bypass Vulnerability |
|
CVE-2025-26635
HIGH · vendor
Windows Hello Security Feature Bypass Vulnerability |
|
CVE-2025-24074
HIGH · vendor
Microsoft DWM Core Library Elevation of Privilege Vulnerability |
|
CVE-2025-24073
HIGH · vendor
Microsoft DWM Core Library Elevation of Privilege Vulnerability |
|
CVE-2025-24062
HIGH · vendor
Microsoft DWM Core Library Elevation of Privilege Vulnerability |
|
CVE-2025-24060
HIGH · vendor
Microsoft DWM Core Library Elevation of Privilege Vulnerability |
|
CVE-2025-24058
HIGH · vendor
Windows DWM Core Library Elevation of Privilege Vulnerability |
|
CVE-2025-21222
HIGH · vendor
Windows Telephony Service Remote Code Execution Vulnerability |
|
CVE-2025-21221
HIGH · vendor
Windows Telephony Service Remote Code Execution Vulnerability |
|
CVE-2025-21205
HIGH · vendor
Windows Telephony Service Remote Code Execution Vulnerability |
|
CVE-2025-21204
HIGH · vendor
Windows Process Activation Elevation of Privilege Vulnerability |
|
CVE-2025-21203
HIGH · vendor
Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability |
|
CVE-2025-21197
HIGH · vendor
Windows NTFS Information Disclosure Vulnerability |
|
CVE-2025-21191
HIGH · vendor
Windows Local Security Authority (LSA) Elevation of Privilege Vulnerability |
|
CVE-2025-21174
HIGH · vendor
Windows Standards-Based Storage Management Service Denial of Service Vulnerability |
|
CVE-2025-3069
HIGH 8.8
Inappropriate implementation in Extensions in Google Chrome prior to 135.0.7049.52 allowed a remote attacker to perform privilege escalation via a crafted HTML… |
|
CVE-2025-3068
HIGH 8.8
Inappropriate implementation in Intents in Google Chrome on Android prior to 135.0.7049.52 allowed a remote attacker to perform privilege escalation via a craf… |
|
CVE-2025-3067
HIGH 8.8
Inappropriate implementation in Custom Tabs in Google Chrome on Android prior to 135.0.7049.52 allowed a remote attacker who convinced a user to engage in spec… |
|
CVE-2025-3066
HIGH 8.8
Use after free in Site Isolation in Google Chrome prior to 135.0.7049.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML pa… |
|
CVE-2025-3034
HIGH 8.1
Memory safety bugs present in Firefox 136 and Thunderbird 136. Some of these bugs showed evidence of memory corruption and we presume that with enough effort s… |
|
CVE-2025-3033
HIGH 7.7
After selecting a malicious Windows `.url` shortcut from the local filesystem, an unexpected file could be uploaded. *This bug only affects Firefox on Window… |
|
CVE-2025-3032
HIGH 7.4
Leaking of file descriptors from the fork server to web content processes could allow for privilege escalation attacks. This vulnerability was fixed in Firefox… |
|
CVE-2025-3030
HIGH 8.1
Memory safety bugs present in Firefox 136, Thunderbird 136, Firefox ESR 128.8, and Thunderbird 128.8. Some of these bugs showed evidence of memory corruption a… |
|
CVE-2025-3029
HIGH 7.3
A crafted URL containing specific Unicode characters could have hidden the true origin of the page, resulting in a potential spoofing attack. This vulnerabilit… |
|
CVE-2025-2783
HIGH 8.3
KEV
Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 134.0.6998.177 allowed a remote attacker to perform a sandb… |
|
CVE-2025-2476
HIGH 8.8
Use after free in Lens in Google Chrome prior to 134.0.6998.117 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chro… |
|
CVE-2025-26633
Improper neutralization in Microsoft Management Console allows an unauthorized attacker to bypass a security feature locally. |
|
CVE-2025-24993
Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally. |
|
CVE-2025-24082
HIGH 7.8
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
|
CVE-2025-24081
HIGH 7.8
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
|
CVE-2025-24079
HIGH 7.8
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally. |
|
CVE-2025-24078
HIGH 7.0
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally. |
|
CVE-2025-24075
HIGH 7.8
Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
|
CVE-2025-26634
HIGH · vendor
Windows Core Messaging Elevation of Privileges Vulnerability |
|
CVE-2025-25008
HIGH · vendor
Windows Server Elevation of Privilege Vulnerability |
|
CVE-2025-24997
HIGH · vendor
DirectX Graphics Kernel File Denial of Service Vulnerability |
Manage your fleet with Appaloosa
Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.