Vulnerabilities
Tracked app vulnerabilities
796 CVEs affect a tracked app or OS (Medium, iOS). 8 of them are in the CISA KEV catalog, meaning exploitation is confirmed.
- Matching CVEs
- 796
- Actively exploited
- 8
- Publication window
- 2017-04-02 → 2026-11-09
Chronological sort: newest to oldest. Use the KEV / severity filters above to prioritize.
| CVE |
|---|
|
CVE-2023-42916
An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 17.1.2 and iPadOS 17.1.2, macOS Sonoma 14.1.2, Safari 17.1.2. Pr… |
|
CVE-2023-6277
An out-of-memory flaw was found in libtiff. Passing a crafted tiff file to TIFFOpen() API may allow a remote attacker to cause a denial of service via a craft … |
|
CVE-2023-43582
MEDIUM 5.5
Improper authorization in some Zoom clients may allow an authorized user to conduct an escalation of privilege via network access. |
|
CVE-2023-39205
MEDIUM 4.3
Improper conditions check in Zoom Team Chat for Zoom clients may allow an authenticated user to conduct a denial of service via network access. |
|
CVE-2023-39204
MEDIUM 4.3
Buffer overflow in some Zoom clients may allow an unauthenticated user to conduct a denial of service via network access. |
|
CVE-2023-39199
MEDIUM 4.9
Cryptographic issues with In-Meeting Chat for some Zoom clients may allow a privileged user to conduct an information disclosure via network access. |
|
CVE-2022-20917
MEDIUM 4.3
A vulnerability in the Extensible Messaging and Presence Protocol (XMPP) message processing feature of Cisco Jabber could allow an authenticated, remote attack… |
|
CVE-2023-39218
MEDIUM 6.1
Client-side enforcement of server-side security in Zoom clients before 5.14.10 may allow a privileged user to enable information disclosure via network access. |
|
CVE-2023-36532
MEDIUM 5.9
Buffer overflow in Zoom Clients before 5.14.5 may allow an unauthenticated user to enable a denial of service via network access. |
|
CVE-2023-36883
MEDIUM 4.3
Microsoft Edge for iOS Spoofing Vulnerability |
|
CVE-2023-36539
MEDIUM 5.3
Exposure of information intended to be encrypted by some Zoom clients may lead to disclosure of sensitive information. |
|
CVE-2023-34658
MEDIUM 5.3
Telegram v9.6.3 on iOS allows attackers to hide critical information on the User Interface via calling the function SFSafariViewController. |
|
CVE-2023-28599
MEDIUM 4.3
Zoom clients prior to 5.13.10 contain an HTML injection vulnerability. A malicious user could inject HTML into their display name potentially leading a victi… |
|
CVE-2023-24890
MEDIUM 6.5
Microsoft OneDrive for iOS Security Feature Bypass Vulnerability |
|
CVE-2022-43363
MEDIUM 6.1
Telegram Web 15.3.1 allows XSS via a certain payload derived from a Target Corporation website. NOTE: some third parties have been unable to discern any relati… |
|
CVE-2022-32550
MEDIUM 4.8
An issue was discovered in AgileBits 1Password, involving the method various 1Password apps and integrations used to create connections to the 1Password servic… |
|
CVE-2020-20096
MEDIUM 6.5
Whatsapp iOS 2.19.80 and prior and Android 2.19.222 and prior user interface does not properly represent URI messages to the user, which results in URI spoofin… |
|
CVE-2021-36769
MEDIUM 5.3
A reordering issue exists in Telegram before 7.8.1 for Android, Telegram before 7.8.3 for iOS, and Telegram Desktop before 2.8.8. An attacker can cause the ser… |
|
CVE-2021-31323
MEDIUM 5.5
Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Heap Buffer Overflow in the LottieParserImpl::parseDashProperty fu… |
|
CVE-2021-31322
MEDIUM 5.5
Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Heap Buffer Overflow in the LOTGradient::populate function of thei… |
|
CVE-2021-31319
MEDIUM 5.5
Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by an Integer Overflow in the LOTGradient::populate function of their c… |
|
CVE-2021-31318
MEDIUM 5.5
Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Type Confusion in the LOTCompLayerItem::LOTCompLayerItem function … |
|
CVE-2021-31317
MEDIUM 5.5
Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Type Confusion in the VDasher constructor of their custom fork of … |
|
CVE-2021-31315
MEDIUM 5.5
Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Stack Based Overflow in the blit function of their custom fork of … |
|
CVE-2021-21211
MEDIUM 6.5
Inappropriate implementation in Navigation in Google Chrome on iOS prior to 90.0.4430.72 allowed a remote attacker to leak cross-origin data via a crafted HTML… |
|
CVE-2021-30496
MEDIUM 5.7
The Telegram app 7.6.2 for iOS allows remote authenticated users to cause a denial of service (application crash) if the victim pastes an attacker-supplied mes… |
|
CVE-2021-24114
MEDIUM 5.7
Microsoft Teams iOS Information Disclosure Vulnerability |
|
CVE-2021-27205
MEDIUM 5.5
Telegram before 7.4 (212543) Stable on macOS stores the local copy of self-destructed messages in a sandbox path, leading to sensitive information disclosure. |
|
CVE-2021-27204
MEDIUM 5.5
Telegram before 7.4 (212543) Stable on macOS stores the local passcode in cleartext, leading to information disclosure. |
|
CVE-2020-1908
MEDIUM 4.6
Improper authorization of the Screen Lock feature in WhatsApp and WhatsApp Business for iOS prior to v2.20.100 could have permitted use of Siri to interact wit… |
|
CVE-2020-1904
MEDIUM 5.5
A path validation issue in WhatsApp for iOS prior to v2.20.61 and WhatsApp Business for iOS prior to v2.20.61 could have allowed for directory traversal overwr… |
|
CVE-2020-1903
MEDIUM 5.5
An issue when unzipping docx, pptx, and xlsx documents in WhatsApp for iOS prior to v2.20.61 and WhatsApp Business for iOS prior to v2.20.61 could have resulte… |
|
CVE-2020-1901
MEDIUM 5.3
Receiving a large text message containing URLs in WhatsApp for iOS prior to v2.20.91.4 could have caused the application to freeze while processing the message. |
|
CVE-2020-12474
MEDIUM 6.5
Telegram Desktop through 2.0.1, Telegram through 6.0.1 for Android, and Telegram through 6.0.1 for iOS allow an IDN Homograph attack via Punycode in a public U… |
|
CVE-2019-14319
MEDIUM 6.5
The TikTok (formerly Musical.ly) application 12.2.0 for Android and iOS performs unencrypted transmission of images, videos, and likes. This allows an attacker… |
|
CVE-2019-15514
MEDIUM 5.3
The Privacy > Phone Number feature in the Telegram app 5.10 for Android and iOS provides an incorrect indication that the access level is Nobody, because attac… |
|
CVE-2019-1948
MEDIUM 5.9
A vulnerability in Cisco Webex Meetings Mobile (iOS) could allow an unauthenticated, remote attacker to gain unauthorized read access to sensitive data by usin… |
|
CVE-2019-1218
MEDIUM 5.4
A spoofing vulnerability exists in the way Microsoft Outlook iOS software parses specifically crafted email messages. An authenticated attacker could exploit t… |
|
CVE-2019-1084
MEDIUM 6.5
+1
An information disclosure vulnerability exists when Exchange allows creation of entities with Display Names having non-printable characters. An authenticated a… |
|
CVE-2018-6976
MEDIUM 5.3
The VMware Content Locker for iOS prior to 4.14 contains a data protection vulnerability in the SQLite database. This vulnerability relates to unencrypted file… |
|
CVE-2018-12271
MEDIUM 6.4
An issue was discovered in the com.getdropbox.Dropbox app 100.2 for iOS. The LAContext class for Biometric (TouchID) validation allows authentication bypass by… |
|
CVE-2017-17689
MEDIUM 5.9
+1
The S/MIME specification allows a Cipher Block Chaining (CBC) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL. |
|
CVE-2018-6849
MEDIUM 4.3
In the WebRTC component in DuckDuckGo 4.2.0, after visiting a web site that attempts to gather complete client information (such as https://ip.voidsec.com), th… |
|
CVE-2016-10511
MEDIUM 5.9
The Twitter iOS client versions 6.62 and 6.62.1 fail to validate Twitter's server certificates for the /1.1/help/settings.json configuration endpoint, permitti… |
|
CVE-2016-4075
MEDIUM 6.1
Opera Mini 13 and Opera Stable 36 allow remote attackers to spoof the displayed URL via a crafted HTML document, related to the about:blank URL. |
|
CVE-2017-2391
MEDIUM 5.3
+2
An issue was discovered in certain Apple products. Pages before 6.1, Numbers before 4.1, and Keynote before 7.1 on macOS and Pages before 3.1, Numbers before 3… |
Manage your fleet with Appaloosa
Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.