Vulnerabilities
Tracked app vulnerabilities
19,673 CVEs affect a tracked app or OS (all severities, Windows). 303 of them are in the CISA KEV catalog, meaning exploitation is confirmed.
- Matching CVEs
- 19,673
- Actively exploited
- 303
- Publication window
- 1997-01-01 → 2026-10-20
Chronological sort: newest to oldest. Use the KEV / severity filters above to prioritize.
| CVE |
|---|
|
CVE-2025-54110
HIGH · vendor
Windows Kernel Elevation of Privilege Vulnerability |
|
CVE-2025-54109
HIGH · vendor
Windows Defender Firewall Service Elevation of Privilege Vulnerability |
|
CVE-2025-54107
HIGH · vendor
MapUrlToZone Security Feature Bypass Vulnerability |
|
CVE-2025-54106
HIGH · vendor
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability |
|
CVE-2025-54104
HIGH · vendor
Windows Defender Firewall Service Elevation of Privilege Vulnerability |
|
CVE-2025-54103
HIGH · vendor
Windows Management Service Elevation of Privilege Vulnerability |
|
CVE-2025-54102
HIGH · vendor
Windows Connected Devices Platform Service Elevation of Privilege Vulnerability |
|
CVE-2025-54101
HIGH · vendor
Windows SMB Client Remote Code Execution Vulnerability |
|
CVE-2025-54099
HIGH · vendor
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability |
|
CVE-2025-54098
HIGH · vendor
Windows Hyper-V Elevation of Privilege Vulnerability |
|
CVE-2025-54097
HIGH · vendor
Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability |
|
CVE-2025-54096
HIGH · vendor
Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability |
|
CVE-2025-54095
HIGH · vendor
Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability |
|
CVE-2025-54094
HIGH · vendor
Windows Defender Firewall Service Elevation of Privilege Vulnerability |
|
CVE-2025-54093
HIGH · vendor
Windows TCP/IP Driver Elevation of Privilege Vulnerability |
|
CVE-2025-54092
HIGH · vendor
Windows Hyper-V Elevation of Privilege Vulnerability |
|
CVE-2025-54091
HIGH · vendor
Windows Hyper-V Elevation of Privilege Vulnerability |
|
CVE-2025-53810
HIGH · vendor
Windows Defender Firewall Service Elevation of Privilege Vulnerability |
|
CVE-2025-53808
HIGH · vendor
Windows Defender Firewall Service Elevation of Privilege Vulnerability |
|
CVE-2025-53807
HIGH · vendor
Windows Graphics Component Elevation of Privilege Vulnerability |
|
CVE-2025-53806
HIGH · vendor
Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability |
|
CVE-2025-53805
HIGH · vendor
HTTP.sys Denial of Service Vulnerability |
|
CVE-2025-53804
HIGH · vendor
Windows Kernel-Mode Driver Information Disclosure Vulnerability |
|
CVE-2025-53803
HIGH · vendor
Windows Kernel Memory Information Disclosure Vulnerability |
|
CVE-2025-53802
HIGH · vendor
Windows Bluetooth Service Elevation of Privilege Vulnerability |
|
CVE-2025-53801
HIGH · vendor
Microsoft DWM Core Library Elevation of Privilege Vulnerability |
|
CVE-2025-53800
CRITICAL · vendor
Windows Graphics Component Elevation of Privilege Vulnerability |
|
CVE-2025-53798
HIGH · vendor
Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability |
|
CVE-2025-53797
HIGH · vendor
Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability |
|
CVE-2025-53796
HIGH · vendor
Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability |
|
CVE-2025-49734
HIGH · vendor
PowerShell Direct Elevation of Privilege Vulnerability |
|
CVE-2025-9867
MEDIUM 5.4
Inappropriate implementation in Downloads in Google Chrome on Android prior to 140.0.7339.80 allowed a remote attacker to perform UI spoofing via a crafted HTM… |
|
CVE-2025-9866
HIGH 8.8
Inappropriate implementation in Extensions in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to bypass content security policy via a crafted HT… |
|
CVE-2025-9865
MEDIUM 5.4
Inappropriate implementation in Toolbar in Google Chrome on Android prior to 140.0.7339.80 allowed a remote attacker who convinced a user to engage in specific… |
|
CVE-2023-24023
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2025-9478
HIGH 8.8
Use after free in ANGLE in Google Chrome prior to 139.0.7258.154 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chr… |
|
CVE-2025-4609
CRITICAL 9.6
Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 136.0.7103.113 allowed a remote attacker to potentially per… |
|
CVE-2025-9132
HIGH 8.8
Out of bounds write in V8 in Google Chrome prior to 139.0.7258.138 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (C… |
|
CVE-2025-9187
CRITICAL 9.8
Memory safety bugs present in Firefox 141 and Thunderbird 141. Some of these bugs showed evidence of memory corruption and we presume that with enough effort s… |
|
CVE-2025-9185
HIGH 8.1
Memory safety bugs present in Firefox ESR 115.26, Firefox ESR 128.13, Thunderbird ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunder… |
|
CVE-2025-9184
HIGH 8.1
Memory safety bugs present in Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141. Some of these bugs showed evidence of memory corruptio… |
|
CVE-2025-9183
MEDIUM 6.5
Spoofing issue in the Address Bar component. This vulnerability was fixed in Firefox 142 and Firefox ESR 140.2. |
|
CVE-2025-9182
HIGH 7.5
Denial-of-service due to out-of-memory in the Graphics: WebRender component. This vulnerability was fixed in Firefox 142, Firefox ESR 140.2, Thunderbird 142, a… |
|
CVE-2025-9181
MEDIUM 6.5
Uninitialized memory in the JavaScript Engine component. This vulnerability was fixed in Firefox 142, Firefox ESR 128.14, Firefox ESR 140.2, Thunderbird 142, T… |
|
CVE-2025-9180
HIGH 8.1
Same-origin policy bypass in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 142, Firefox ESR 115.27, Firefox ESR 128.14, Firefox ESR… |
|
CVE-2025-9179
CRITICAL 9.8
An attacker was able to perform memory corruption in the GMP process which processes encrypted media. This process is also heavily sandboxed, but represents sl… |
|
CVE-2025-8364
MEDIUM 4.3
A crafted URL using a blob: URI could have hidden the true origin of the page, resulting in a potential spoofing attack. *Note: This issue only affected Androi… |
|
CVE-2025-8901
HIGH 8.8
Out of bounds write in ANGLE in Google Chrome prior to 139.0.7258.127 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page.… |
|
CVE-2025-8882
HIGH 8.8
Use after free in Aura in Google Chrome prior to 139.0.7258.127 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially… |
|
CVE-2025-8881
MEDIUM 6.5
Inappropriate implementation in File Picker in Google Chrome prior to 139.0.7258.127 allowed a remote attacker who convinced a user to engage in specific UI ge… |
Manage your fleet with Appaloosa
Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.