Vulnerabilities
Tracked app vulnerabilities
10,959 CVEs affect a tracked app or OS (all severities, macOS). 106 of them are in the CISA KEV catalog, meaning exploitation is confirmed.
- Matching CVEs
- 10,959
- Actively exploited
- 106
- Publication window
- 1997-01-01 → 2026-11-11
Chronological sort: newest to oldest. Use the KEV / severity filters above to prioritize.
| CVE |
|---|
|
CVE-2021-42296
HIGH 7.8
Microsoft Word Remote Code Execution Vulnerability |
|
CVE-2021-42292
HIGH 7.8
KEV
Microsoft Excel Security Feature Bypass Vulnerability |
|
CVE-2021-41368
MEDIUM 6.1
Microsoft Access Remote Code Execution Vulnerability |
|
CVE-2021-40442
HIGH 7.8
Microsoft Excel Remote Code Execution Vulnerability |
|
CVE-2020-6492
CRITICAL 9.6
Use after free in ANGLE in Google Chrome prior to 83.0.4103.97 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. |
|
CVE-2018-6125
MEDIUM 6.5
Insufficient policy enforcement in USB in Google Chrome on Windows prior to 67.0.3396.62 allowed a remote attacker to obtain potentially sensitive information … |
|
CVE-2018-6122
HIGH 8.8
Type confusion in WebAssembly in Google Chrome prior to 66.0.3359.139 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
|
CVE-2021-37996
MEDIUM 5.5
Insufficient validation of untrusted input Downloads in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to bypass navigation restrictions via a m… |
|
CVE-2021-37995
MEDIUM 6.5
Inappropriate implementation in WebApp Installer in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to potentially overlay and spoof the contents… |
|
CVE-2021-37994
MEDIUM 6.5
Inappropriate implementation in iFrame Sandbox in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to bypass navigation restrictions via a crafted… |
|
CVE-2021-37993
HIGH 8.8
Use after free in PDF Accessibility in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML … |
|
CVE-2021-37992
HIGH 8.8
Out of bounds read in WebAudio in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
|
CVE-2021-37991
HIGH 7.5
Race in V8 in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
|
CVE-2021-37990
MEDIUM 5.5
Inappropriate implementation in WebView in Google Chrome on Android prior to 95.0.4638.54 allowed a remote attacker to leak cross-origin data via a crafted app. |
|
CVE-2021-37989
MEDIUM 6.5
Inappropriate implementation in Blink in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to abuse content security policy via a crafted HTML page. |
|
CVE-2021-37988
HIGH 8.8
Use after free in Profiles in Google Chrome prior to 95.0.4638.54 allowed a remote attacker who convinced a user to engage in specific gestures to potentially … |
|
CVE-2021-37987
HIGH 8.8
Use after free in Network APIs in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
|
CVE-2021-37986
HIGH 8.8
Heap buffer overflow in Settings in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to engage with Dev Tools to potentially exploit heap corrupti… |
|
CVE-2021-37985
HIGH 8.8
Use after free in V8 in Google Chrome prior to 95.0.4638.54 allowed a remote attacker who had convinced a user to allow for connection to debugger to potential… |
|
CVE-2021-37984
HIGH 8.8
Heap buffer overflow in PDFium in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
|
CVE-2021-37983
HIGH 8.8
Use after free in Dev Tools in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
|
CVE-2021-37982
HIGH 8.8
Use after free in Incognito in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
|
CVE-2021-37981
CRITICAL 9.6
Heap buffer overflow in Skia in Google Chrome prior to 95.0.4638.54 allowed a remote attacker who had compromised the renderer process to potentially perform a… |
|
CVE-2021-37980
HIGH 7.4
Inappropriate implementation in Sandbox in Google Chrome prior to 94.0.4606.81 allowed a remote attacker to potentially bypass site isolation via Windows. |
|
CVE-2021-37979
HIGH 8.8
heap buffer overflow in WebRTC in Google Chrome prior to 94.0.4606.81 allowed a remote attacker who convinced a user to browse to a malicious website to potent… |
|
CVE-2021-37978
HIGH 8.8
Heap buffer overflow in Blink in Google Chrome prior to 94.0.4606.81 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
|
CVE-2021-37977
HIGH 8.8
Use after free in Garbage Collection in Google Chrome prior to 94.0.4606.81 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML… |
|
CVE-2021-40486
HIGH 7.8
Microsoft Word Remote Code Execution Vulnerability |
|
CVE-2021-40485
HIGH 7.8
Microsoft Excel Remote Code Execution Vulnerability |
|
CVE-2021-40474
HIGH 7.8
Microsoft Excel Remote Code Execution Vulnerability |
|
CVE-2021-40472
MEDIUM 5.5
Microsoft Excel Information Disclosure Vulnerability |
|
CVE-2021-37976
MEDIUM 6.5
KEV
Inappropriate implementation in Memory in Google Chrome prior to 94.0.4606.71 allowed a remote attacker to obtain potentially sensitive information from proces… |
|
CVE-2021-37975
HIGH 8.8
KEV
Use after free in V8 in Google Chrome prior to 94.0.4606.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
|
CVE-2021-37974
HIGH 8.8
Use after free in Safebrowsing in Google Chrome prior to 94.0.4606.71 allowed a remote attacker who had compromised the renderer process to potentially exploit… |
|
CVE-2021-37973
CRITICAL 9.6
KEV
Use after free in Portals in Google Chrome prior to 94.0.4606.61 allowed a remote attacker who had compromised the renderer process to potentially perform a sa… |
|
CVE-2021-37972
HIGH 8.8
Out of bounds read in libjpeg-turbo in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML … |
|
CVE-2021-37971
MEDIUM 4.3
Incorrect security UI in Web Browser UI in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a c… |
|
CVE-2021-37970
HIGH 8.8
Use after free in File System API in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML pa… |
|
CVE-2021-37969
HIGH 7.8
Inappropriate implementation in Google Updater in Google Chrome on Windows prior to 94.0.4606.54 allowed a remote attacker to perform local privilege escalatio… |
|
CVE-2021-37968
MEDIUM 4.3
Inappropriate implementation in Background Fetch API in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to leak cross-origin data via a crafted H… |
|
CVE-2021-37967
MEDIUM 4.3
Inappropriate implementation in Background Fetch API in Google Chrome prior to 94.0.4606.54 allowed a remote attacker who had compromised the renderer process … |
|
CVE-2021-37966
MEDIUM 4.3
Inappropriate implementation in Compositing in Google Chrome on Android prior to 94.0.4606.54 allowed a remote attacker to spoof the contents of the Omnibox (U… |
|
CVE-2021-37965
MEDIUM 4.3
Inappropriate implementation in Background Fetch API in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to leak cross-origin data via a crafted H… |
|
CVE-2021-37964
LOW 3.3
Inappropriate implementation in ChromeOS Networking in Google Chrome on ChromeOS prior to 94.0.4606.54 allowed an attacker with a rogue wireless access point t… |
|
CVE-2021-37963
MEDIUM 4.3
Side-channel information leakage in DevTools in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to bypass site isolation via a crafted HTML page. |
|
CVE-2021-37962
HIGH 8.8
Use after free in Performance Manager in Google Chrome prior to 94.0.4606.54 allowed a remote attacker who had compromised the renderer process to potentially … |
|
CVE-2021-37961
HIGH 8.8
Use after free in Tab Strip in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
|
CVE-2021-37959
HIGH 8.8
Use after free in Task Manager in Google Chrome prior to 94.0.4606.54 allowed an attacker who convinced a user to enage in a series of user gestures to potenti… |
|
CVE-2021-37958
MEDIUM 5.4
Inappropriate implementation in Navigation in Google Chrome on Windows prior to 94.0.4606.54 allowed a remote attacker to inject scripts or HTML into a privile… |
|
CVE-2021-37957
HIGH 8.8
Use after free in WebGPU in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
Manage your fleet with Appaloosa
Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.