Vulnerabilities
Tracked app vulnerabilities
28,053 CVEs affect a tracked app or OS (all severities, all platforms). 374 of them are in the CISA KEV catalog, meaning exploitation is confirmed.
- Matching CVEs
- 28,053
- Actively exploited
- 374
- Publication window
- 1997-01-01 → 2026-10-20
Chronological sort: newest to oldest. Use the KEV / severity filters above to prioritize.
| CVE |
|---|
|
CVE-2026-5860
HIGH 8.8
Use after free in WebRTC in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. … |
|
CVE-2026-5859
HIGH 8.8
Integer overflow in WebML in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Ch… |
|
CVE-2026-5858
HIGH 8.8
Heap buffer overflow in WebML in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium se… |
|
CVE-2026-5735
CRITICAL 9.8
Memory safety bugs present in Firefox 149.0.1 and Thunderbird 149.0.1. Some of these bugs showed evidence of memory corruption and we presume that with enough … |
|
CVE-2026-5734
CRITICAL 9.8
Memory safety bugs present in Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Firefox 149.0.1 and Thunderbird 149.0.1. Some of these bugs showed evidence of memo… |
|
CVE-2026-5733
HIGH 8.8
Incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 149.0.2 and Thunderbird 149.0.2. |
|
CVE-2026-5732
HIGH 8.8
Incorrect boundary conditions, integer overflow in the Graphics: Text component. This vulnerability was fixed in Firefox 149.0.2, Firefox ESR 140.9.1, Thunderb… |
|
CVE-2026-5731
CRITICAL 9.8
Memory safety bugs present in Firefox ESR 115.34.0, Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Firefox 149.0.1 and Thunderbird 149.0.1. Some of these bugs s… |
|
CVE-2026-20432
HIGH 8.0
In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a … |
|
CVE-2026-20431
MEDIUM 6.5
In Modem, there is a possible system crash due to a logic error. This could lead to remote denial of service, if a UE has connected to a rogue base station con… |
|
CVE-2026-0049
MEDIUM 6.2
In onHeaderDecoded of LocalImageResolver.java, there is a possible persistent denial of service due to resource exhaustion. This could lead to local denial of … |
|
CVE-2025-48651
MEDIUM 5.5
In importWrappedKey of KMKeymasterApplet.java, there is a possible way access keys that should be restricted due to improper input validation. This could lead … |
|
CVE-2026-21380
HIGH 7.8
Memory Corruption when using deprecated DMABUF IOCTL calls to manage video memory. |
|
CVE-2026-21372
HIGH 7.8
Memory Corruption when sending IOCTL requests with invalid buffer sizes during memcpy operations. |
|
CVE-2025-47400
HIGH 7.1
Cryptographic issue while copying data to a destination buffer without validating its size. |
|
CVE-2025-47392
HIGH 8.8
Memory corruption when decoding corrupted satellite data files with invalid signature offsets. |
|
CVE-2019-25677
MEDIUM 6.2
WinRAR 5.61 contains a denial of service vulnerability that allows local attackers to crash the application by placing a malformed winrar.lng language file in … |
|
CVE-2026-34979
MEDIUM 5.3
OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, there is a heap-based buffer… |
|
CVE-2025-43264
HIGH 8.8
The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.6. Processing a maliciously crafted image may corrupt process me… |
|
CVE-2025-43257
HIGH 8.7
This issue was addressed with improved handling of symlinks. This issue is fixed in macOS Sequoia 15.6. An app may be able to break out of its sandbox. |
|
CVE-2025-43238
MEDIUM 6.2
An integer overflow was addressed with improved input validation. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app … |
|
CVE-2025-43236
LOW 3.3
A type confusion issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An at… |
|
CVE-2025-43219
HIGH 8.8
The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.6. Processing a maliciously crafted image may corrupt process me… |
|
CVE-2025-43210
An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 18.6 and iPadOS 18.6, iPadOS 17.7.9, macOS Sequoia 15.6, … |
|
CVE-2025-43202
This issue was addressed with improved memory handling. This issue is fixed in iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6. Processing a file may lead to memo… |
|
CVE-2024-44303
HIGH 7.5
The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.1. A malicious application may be able to modify protected parts of the f… |
|
CVE-2024-44286
HIGH 7.5
This issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15.1. An attacker with physical access can input keyboard even… |
|
CVE-2024-44250
HIGH 8.2
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.1. An app may be able to execute arbitrary code out of … |
|
CVE-2024-44219
HIGH 7.5
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.1. A malicious application with root privileges may be … |
|
CVE-2024-40858
HIGH 7.1
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.1. An app may be able to access Contacts without user c… |
|
CVE-2024-40849
HIGH 7.5
A race condition was addressed with additional validation. This issue is fixed in macOS Sequoia 15.1. An app may be able to break out of its sandbox. |
|
CVE-2026-5292
HIGH 8.8
Out of bounds read in WebCodecs in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML p… |
|
CVE-2026-5291
MEDIUM 6.5
Inappropriate implementation in WebGL in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to obtain potentially sensitive information from proce… |
|
CVE-2026-5290
CRITICAL 9.6
Use after free in Compositing in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to potentially perfor… |
|
CVE-2026-5289
CRITICAL 9.6
Use after free in Navigation in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to potentially perform… |
|
CVE-2026-5288
CRITICAL 9.6
Use after free in WebView in Google Chrome on Android prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to potentially… |
|
CVE-2026-5287
HIGH 8.8
Use after free in PDF in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file. (Ch… |
|
CVE-2026-5286
HIGH 8.8
Use after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security… |
|
CVE-2026-5285
HIGH 8.8
Use after free in WebGL in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. … |
|
CVE-2026-5284
HIGH 7.5
Use after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to execute arbitrary code vi… |
|
CVE-2026-5283
MEDIUM 6.5
Inappropriate implementation in ANGLE in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Ch… |
|
CVE-2026-5282
HIGH 8.1
Out of bounds read in WebCodecs in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML p… |
|
CVE-2026-5281
HIGH 8.8
KEV
Use after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to execute arbitrary code vi… |
|
CVE-2026-5280
HIGH 8.8
Use after free in WebCodecs in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML pa… |
|
CVE-2026-5279
HIGH 8.8
Object corruption in V8 in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. … |
|
CVE-2026-5278
HIGH 8.8
Use after free in Web MIDI in Google Chrome on Android prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Ch… |
|
CVE-2026-5277
HIGH 7.5
Integer overflow in ANGLE in Google Chrome on Windows prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to perform an … |
|
CVE-2026-5276
MEDIUM 6.5
Insufficient policy enforcement in WebUSB in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to obtain potentially sensitive information from p… |
|
CVE-2026-5275
HIGH 8.8
Heap buffer overflow in ANGLE in Google Chrome on Mac prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chr… |
|
CVE-2026-5274
HIGH 8.8
Integer overflow in Codecs in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromiu… |
Manage your fleet with Appaloosa
Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.