Vulnerabilities
Tracked app vulnerabilities
663 CVEs affect a tracked app or OS (Critical, macOS). 22 of them are in the CISA KEV catalog, meaning exploitation is confirmed.
- Matching CVEs
- 663
- Actively exploited
- 22
- Publication window
- 2008-01-16 → 2026-09-17
Chronological sort: newest to oldest. Use the KEV / severity filters above to prioritize.
| CVE |
|---|
|
CVE-2020-6469
CRITICAL 9.6
Insufficient policy enforcement in developer tools in Google Chrome prior to 83.0.4103.61 allowed an attacker who convinced a user to install a malicious exten… |
|
CVE-2020-6466
CRITICAL 9.6
Use after free in media in Google Chrome prior to 83.0.4103.61 allowed a remote attacker who had compromised the renderer process to potentially perform a sand… |
|
CVE-2020-6465
CRITICAL 9.6
Use after free in reader mode in Google Chrome on Android prior to 83.0.4103.61 allowed a remote attacker who had compromised the renderer process to potential… |
|
CVE-2020-6462
CRITICAL 9.6
Use after free in task scheduling in Google Chrome prior to 81.0.4044.129 allowed a remote attacker who had compromised the renderer process to potentially per… |
|
CVE-2020-6461
CRITICAL 9.6
Use after free in storage in Google Chrome prior to 81.0.4044.129 allowed a remote attacker who had compromised the renderer process to potentially perform a s… |
|
CVE-2020-6457
CRITICAL 9.6
Use after free in speech recognizer in Google Chrome prior to 81.0.4044.113 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTM… |
|
CVE-2014-9390
CRITICAL 9.8
Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows a… |
|
CVE-2019-5870
CRITICAL 9.6
Use after free in media in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. |
|
CVE-2019-5866
CRITICAL 9.8
Out of bounds memory access in JavaScript in Google Chrome prior to 75.0.3770.142 allowed a remote attacker to potentially exploit heap corruption via a crafte… |
|
CVE-2019-5850
CRITICAL 9.6
Use after free in offline mode in Google Chrome prior to 76.0.3809.87 allowed a remote attacker who had compromised the renderer process to potentially perform… |
|
CVE-2016-9652
CRITICAL 9.8
Multiple unspecified vulnerabilities in Google Chrome before 55.0.2883.75. |
|
CVE-2016-5194
CRITICAL 9.8
Unspecified vulnerabilities in Google Chrome before 54.0.2840.59. |
|
CVE-2016-5202
CRITICAL 9.1
browser/extensions/api/dial/dial_registry.cc in Google Chrome before 54.0.2840.98 on macOS, before 54.0.2840.99 on Windows, and before 54.0.2840.100 on Linux n… |
|
CVE-2019-14379
CRITICAL 9.8
SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manage… |
|
CVE-2019-5759
CRITICAL 9.6
Incorrect lifetime handling in HTML select elements in Google Chrome on Android and Mac prior to 72.0.3626.81 allowed a remote attacker to potentially perform … |
|
CVE-2018-6127
CRITICAL 9.6
Early free of object in use in IndexDB in Google Chrome prior to 67.0.3396.62 allowed a remote attacker who had compromised the renderer process to potentially… |
|
CVE-2018-16068
CRITICAL 9.6
Missing validation in Mojo in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. |
|
CVE-2017-15402
CRITICAL 9.6
Using an ID that can be controlled by a compromised renderer which allows any frame to overwrite the page_state of any other frame in the same process in Navig… |
|
CVE-2018-6152
CRITICAL 9.6
The implementation of the Page.downloadBehavior backend unconditionally marked downloaded files as safe, regardless of file type in Google Chrome prior to 66.0… |
|
CVE-2018-15715
CRITICAL 9.8
Zoom clients on Windows (before version 4.1.34814.1119), Mac OS (before version 4.1.34801.1116), and Linux (2.4.129780.0915 and below) are vulnerable to unauth… |
|
CVE-2018-17472
CRITICAL 9.6
Incorrect handling of googlechrome:// URL scheme on iOS in Intents in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to escape the <iframe> sand… |
|
CVE-2018-17462
CRITICAL 9.6
Incorrect refcounting in AppCache in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to perform a sandbox escape via a crafted HTML page. |
|
CVE-2017-15398
CRITICAL 9.8
A stack buffer overflow in the QUIC networking stack in Google Chrome prior to 62.0.3202.89 allowed a remote attacker to gain code execution via a malicious se… |
|
CVE-2018-4164
CRITICAL 9.8
An issue was discovered in certain Apple products. Xcode before 9.3 is affected. The issue, which is unspecified, involves the "LLVM" component. |
|
CVE-2016-5178
CRITICAL 9.8
Multiple unspecified vulnerabilities in Google Chrome before 53.0.2785.143 allow remote attackers to cause a denial of service or possibly have other impact vi… |
|
CVE-2014-9654
CRITICAL 9.8
The Regular Expressions package in International Components for Unicode (ICU) for C/C++ before 2014-12-03, as used in Google Chrome before 40.0.2214.91, calcul… |
|
CVE-2013-6647
CRITICAL 9.8
A use-after-free in AnimationController::endAnimationUpdate in Google Chrome. |
|
CVE-2016-5146
CRITICAL 9.8
Multiple unspecified vulnerabilities in Google Chrome before 52.0.2743.116 allow attackers to cause a denial of service or possibly have other impact via unkno… |
|
CVE-2016-5144
CRITICAL 9.8
The Developer Tools (aka DevTools) subsystem in Blink, as used in Google Chrome before 52.0.2743.116, mishandles the script-path hostname, remoteBase parameter… |
|
CVE-2016-5143
CRITICAL 9.8
The Developer Tools (aka DevTools) subsystem in Blink, as used in Google Chrome before 52.0.2743.116, mishandles the script-path hostname, remoteBase parameter… |
|
CVE-2016-5142
CRITICAL 9.8
The Web Cryptography API (aka WebCrypto) implementation in Blink, as used in Google Chrome before 52.0.2743.116, does not properly copy data buffers, which all… |
|
CVE-2016-5140
CRITICAL 9.8
Heap-based buffer overflow in the opj_j2k_read_SQcd_SQcc function in j2k.c in OpenJPEG, as used in PDFium in Google Chrome before 52.0.2743.116, allows remote … |
|
CVE-2016-1706
CRITICAL 9.6
The PPAPI implementation in Google Chrome before 52.0.2743.82 does not validate the origin of IPC messages to the plugin broker process that should have come f… |
|
CVE-2016-1666
CRITICAL 9.8
Multiple unspecified vulnerabilities in Google Chrome before 50.0.2661.94 allow attackers to cause a denial of service or possibly have other impact via unknow… |
|
CVE-2016-1662
CRITICAL 9.8
extensions/renderer/gc_callback.cc in Google Chrome before 50.0.2661.94 does not prevent fallback execution once the Garbage Collection callback has started, w… |
|
CVE-2016-1659
CRITICAL 9.8
Multiple unspecified vulnerabilities in Google Chrome before 50.0.2661.75 allow attackers to cause a denial of service or possibly have other impact via unknow… |
|
CVE-2016-2843
CRITICAL 9.8
Multiple unspecified vulnerabilities in Google V8 before 4.9.385.26, as used in Google Chrome before 49.0.2623.75, allow attackers to cause a denial of service… |
|
CVE-2016-1642
CRITICAL 9.8
Multiple unspecified vulnerabilities in Google Chrome before 49.0.2623.75 allow attackers to cause a denial of service or possibly have other impact via unknow… |
|
CVE-2016-1639
CRITICAL 9.8
Use-after-free vulnerability in browser/extensions/api/webrtc_audio_private/webrtc_audio_private_api.cc in the WebRTC Audio Private API implementation in Googl… |
|
CVE-2016-1636
CRITICAL 9.8
The PendingScript::notifyFinished function in WebKit/Source/core/dom/PendingScript.cpp in Google Chrome before 49.0.2623.75 relies on memory-cache information … |
|
CVE-2016-1635
CRITICAL 9.8
extensions/renderer/render_frame_observer_natives.cc in Google Chrome before 49.0.2623.75 does not properly consider object lifetimes and re-entrancy issues du… |
|
CVE-2016-1633
CRITICAL 9.8
Use-after-free vulnerability in Blink, as used in Google Chrome before 49.0.2623.75, allows remote attackers to cause a denial of service or possibly have unsp… |
|
CVE-2016-1629
CRITICAL 9.8
Google Chrome before 48.0.2564.116 allows remote attackers to bypass the Blink Same Origin Policy and a sandbox protection mechanism via unspecified vectors. |
|
CVE-2016-0746
CRITICAL 9.8
Use-after-free vulnerability in the resolver in nginx 0.6.18 through 1.8.0 and 1.9.x before 1.9.10 allows remote attackers to cause a denial of service (worker… |
|
CVE-2016-2051
CRITICAL 9.8
Multiple unspecified vulnerabilities in Google V8 before 4.8.271.17, as used in Google Chrome before 48.0.2564.82, allow attackers to cause a denial of service… |
|
CVE-2015-6792
CRITICAL 9.8
The MIDI subsystem in Google Chrome before 47.0.2526.106 does not properly handle the sending of data, which allows remote attackers to execute arbitrary code … |
|
CVE-2015-6764
CRITICAL 9.8
The BasicJsonStringifier::SerializeJSArray function in json-stringifier.h in the JSON stringifier in Google V8, as used in Google Chrome before 47.0.2526.73, i… |
|
CVE-2015-1276
CRITICAL 9.8
Use-after-free vulnerability in content/browser/indexed_db/indexed_db_backing_store.cc in the IndexedDB implementation in Google Chrome before 44.0.2403.89 all… |
|
CVE-2014-0497
CRITICAL 9.8
KEV
Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Mac OS X, and before 11.2.202.336 on Linu… |
|
CVE-2012-5376
CRITICAL 9.6
The Inter-process Communication (IPC) implementation in Google Chrome before 22.0.1229.94 allows remote attackers to bypass intended sandbox restrictions and w… |
Manage your fleet with Appaloosa
Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.