Vulnerabilities
Tracked app vulnerabilities
12,531 CVEs affect a tracked app or OS (High, Windows). 246 of them are in the CISA KEV catalog, meaning exploitation is confirmed.
- Matching CVEs
- 12,531
- Actively exploited
- 246
- Publication window
- 2004-07-27 → 2026-11-11
Chronological sort: newest to oldest. Use the KEV / severity filters above to prioritize.
| CVE |
|---|
|
CVE-2025-24996
HIGH · vendor
NTLM Hash Disclosure Spoofing Vulnerability |
|
CVE-2025-24995
HIGH · vendor
Kernel Streaming WOW Thunk Service Driver Elevation of Privilege Vulnerability |
|
CVE-2025-24994
HIGH · vendor
Microsoft Windows Cross Device Service Elevation of Privilege Vulnerability |
|
CVE-2025-24992
HIGH · vendor
Windows NTFS Information Disclosure Vulnerability |
|
CVE-2025-24991
Windows NTFS Information Disclosure Vulnerability |
|
CVE-2025-24988
HIGH · vendor
Windows USB Video Class System Driver Elevation of Privilege Vulnerability |
|
CVE-2025-24987
HIGH · vendor
Windows USB Video Class System Driver Elevation of Privilege Vulnerability |
|
CVE-2025-24985
Windows Fast FAT File System Driver Remote Code Execution Vulnerability |
|
CVE-2025-24984
Windows NTFS Information Disclosure Vulnerability |
|
CVE-2025-24983
Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability |
|
CVE-2025-24076
HIGH · vendor
Microsoft Windows Cross Device Service Elevation of Privilege Vulnerability |
|
CVE-2025-24072
HIGH · vendor
Microsoft Local Security Authority (LSA) Server Elevation of Privilege Vulnerability |
|
CVE-2025-24071
HIGH · vendor
Microsoft Windows File Explorer Spoofing Vulnerability |
|
CVE-2025-24067
HIGH · vendor
Kernel Streaming Service Driver Elevation of Privilege Vulnerability |
|
CVE-2025-24066
HIGH · vendor
Kernel Streaming Service Driver Elevation of Privilege Vulnerability |
|
CVE-2025-24061
HIGH · vendor
Windows Mark of the Web Security Feature Bypass Vulnerability |
|
CVE-2025-24059
HIGH · vendor
Windows Common Log File System Driver Elevation of Privilege Vulnerability |
|
CVE-2025-24056
HIGH · vendor
Windows Telephony Service Remote Code Execution Vulnerability |
|
CVE-2025-24055
HIGH · vendor
Windows USB Video Class System Driver Information Disclosure Vulnerability |
|
CVE-2025-24054
NTLM Hash Disclosure Spoofing Vulnerability |
|
CVE-2025-24051
HIGH · vendor
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability |
|
CVE-2025-24050
HIGH · vendor
Windows Hyper-V Elevation of Privilege Vulnerability |
|
CVE-2025-24048
HIGH · vendor
Windows Hyper-V Elevation of Privilege Vulnerability |
|
CVE-2025-24046
HIGH · vendor
Kernel Streaming Service Driver Elevation of Privilege Vulnerability |
|
CVE-2025-24044
HIGH · vendor
Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability |
|
CVE-2025-21247
HIGH · vendor
MapUrlToZone Security Feature Bypass Vulnerability |
|
CVE-2025-21180
HIGH · vendor
Windows exFAT File System Remote Code Execution Vulnerability |
|
CVE-2024-9157
HIGH · vendor
Synaptics: CVE-2024-9157 Synaptics Service Binaries DLL Loading Vulnerability |
|
CVE-2025-2137
HIGH 8.8
Out of bounds read in V8 in Google Chrome prior to 134.0.6998.88 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chr… |
|
CVE-2025-2136
HIGH 8.8
Use after free in Inspector in Google Chrome prior to 134.0.6998.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (… |
|
CVE-2025-2135
HIGH 8.8
Type Confusion in V8 in Google Chrome prior to 134.0.6998.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromiu… |
|
CVE-2025-1920
HIGH 8.8
Type Confusion in V8 in Google Chrome prior to 134.0.6998.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromiu… |
|
CVE-2025-26696
HIGH 7.0
Certain crafted MIME email messages that claimed to contain an encrypted OpenPGP message, which instead contained an OpenPGP signed message, were wrongly shown… |
|
CVE-2025-1919
HIGH 8.8
Out of bounds read in Media in Google Chrome prior to 134.0.6998.35 allowed a remote attacker to potentially perform out of bounds memory access via a crafted … |
|
CVE-2025-1918
HIGH 8.8
Out of bounds read in PDFium in Google Chrome prior to 134.0.6998.35 allowed a remote attacker to potentially perform out of bounds memory access via a crafted… |
|
CVE-2025-1916
HIGH 8.8
Use after free in Profiles in Google Chrome prior to 134.0.6998.35 allowed an attacker who convinced a user to install a malicious extension to potentially exp… |
|
CVE-2025-1915
HIGH 8.1
Improper Limitation of a Pathname to a Restricted Directory in DevTools in Google Chrome on Windows prior to 134.0.6998.35 allowed an attacker who convinced a … |
|
CVE-2025-1914
HIGH 8.8
Out of bounds read in V8 in Google Chrome prior to 134.0.6998.35 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chr… |
|
CVE-2025-1943
HIGH 8.2
Memory safety bugs present in Firefox 135 and Thunderbird 135. Some of these bugs showed evidence of memory corruption and we presume that with enough effort s… |
|
CVE-2025-1940
HIGH 7.1
A select option could partially obscure the confirmation prompt shown before launching external apps. This could be used to trick a user in to launching an ext… |
|
CVE-2025-1937
HIGH 7.5
Memory safety bugs present in Firefox 135, Thunderbird 135, Firefox ESR 115.20, Firefox ESR 128.7, and Thunderbird 128.7. Some of these bugs showed evidence of… |
|
CVE-2025-1936
HIGH 7.3
jar: URLs retrieve local file content packaged in a ZIP archive. The null and everything after it was ignored when retrieving the content from the archive, but… |
|
CVE-2025-1933
HIGH 7.6
On 64-bit CPUs, when the JIT compiles WASM i32 return values they can pick up bits from left over memory. This can potentially cause them to be treated as a di… |
|
CVE-2025-1932
HIGH 8.1
An inconsistent comparator in xslt/txNodeSorter could have resulted in potentially exploitable out-of-bounds access. Only affected version 122 and later. This … |
|
CVE-2025-1931
HIGH 7.5
It was possible to cause a use-after-free in the content process side of a WebTransport connection, leading to a potentially exploitable crash. This vulnerabil… |
|
CVE-2025-1930
HIGH 8.8
On Windows, a compromised content process could use bad StreamData sent over AudioIPC to trigger a use-after-free in the Browser process. This could have led t… |
|
CVE-2025-1426
HIGH 8.8
Heap buffer overflow in GPU in Google Chrome on Android prior to 133.0.6943.126 allowed a remote attacker to potentially exploit heap corruption via a crafted … |
|
CVE-2025-1006
HIGH 8.8
Use after free in Network in Google Chrome prior to 133.0.6943.126 allowed a remote attacker to potentially exploit heap corruption via a crafted web app. (Chr… |
|
CVE-2025-0999
HIGH 8.8
Heap buffer overflow in V8 in Google Chrome prior to 133.0.6943.126 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (… |
|
CVE-2025-0997
HIGH 8.1
Use after free in Navigation in Google Chrome prior to 133.0.6943.98 allowed a remote attacker to potentially exploit heap corruption via a crafted Chrome Exte… |
Manage your fleet with Appaloosa
Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.