Vulnerabilities
Tracked app vulnerabilities
19,673 CVEs affect a tracked app or OS (all severities, Windows). 303 of them are in the CISA KEV catalog, meaning exploitation is confirmed.
- Matching CVEs
- 19,673
- Actively exploited
- 303
- Publication window
- 1997-01-01 → 2026-10-20
Chronological sort: newest to oldest. Use the KEV / severity filters above to prioritize.
| CVE |
|---|
|
CVE-2025-50177
CRITICAL · vendor
Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability |
|
CVE-2025-50176
CRITICAL · vendor
DirectX Graphics Kernel Remote Code Execution Vulnerability |
|
CVE-2025-50173
HIGH · vendor
Windows Installer Elevation of Privilege Vulnerability |
|
CVE-2025-50172
HIGH · vendor
DirectX Graphics Kernel Denial of Service Vulnerability |
|
CVE-2025-50171
HIGH · vendor
Remote Desktop Spoofing Vulnerability |
|
CVE-2025-50170
HIGH · vendor
Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability |
|
CVE-2025-50169
HIGH · vendor
Windows SMB Remote Code Execution Vulnerability |
|
CVE-2025-50168
HIGH · vendor
Win32k Elevation of Privilege Vulnerability |
|
CVE-2025-50167
HIGH · vendor
Windows Hyper-V Elevation of Privilege Vulnerability |
|
CVE-2025-50166
HIGH · vendor
Windows Distributed Transaction Coordinator (MSDTC) Information Disclosure Vulnerability |
|
CVE-2025-50165
CRITICAL · vendor
Windows Graphics Component Remote Code Execution Vulnerability |
|
CVE-2025-50164
HIGH · vendor
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability |
|
CVE-2025-50163
HIGH · vendor
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability |
|
CVE-2025-50162
HIGH · vendor
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability |
|
CVE-2025-50161
HIGH · vendor
Win32k Elevation of Privilege Vulnerability |
|
CVE-2025-50160
HIGH · vendor
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability |
|
CVE-2025-50159
HIGH · vendor
Remote Access Point-to-Point Protocol (PPP) EAP-TLS Elevation of Privilege Vulnerability |
|
CVE-2025-50158
HIGH · vendor
Windows NTFS Information Disclosure Vulnerability |
|
CVE-2025-50157
HIGH · vendor
Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability |
|
CVE-2025-50156
HIGH · vendor
Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability |
|
CVE-2025-50155
HIGH · vendor
Windows Push Notifications Apps Elevation of Privilege Vulnerability |
|
CVE-2025-50154
HIGH · vendor
Microsoft Windows File Explorer Spoofing Vulnerability |
|
CVE-2025-50153
HIGH · vendor
Desktop Window Manager Elevation of Privilege Vulnerability |
|
CVE-2025-49762
HIGH · vendor
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability |
|
CVE-2025-49761
HIGH · vendor
Windows Kernel Elevation of Privilege Vulnerability |
|
CVE-2025-49757
HIGH · vendor
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability |
|
CVE-2025-49751
HIGH · vendor
Windows Hyper-V Denial of Service Vulnerability |
|
CVE-2025-49743
HIGH · vendor
Windows Graphics Component Elevation of Privilege Vulnerability |
|
CVE-2025-48807
CRITICAL · vendor
Windows Hyper-V Remote Code Execution Vulnerability |
|
CVE-2025-55188
LOW 3.6
7-Zip before 25.01 does not always properly handle symbolic links during extraction. |
|
CVE-2025-8088
A path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute arbitrary code by crafting malicious archive files. This… |
|
CVE-2025-8583
MEDIUM 4.3
Inappropriate implementation in Permissions in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (… |
|
CVE-2025-8582
MEDIUM 4.3
Insufficient validation of untrusted input in Core in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to spoof the contents of the Omnibox (URL … |
|
CVE-2025-8581
MEDIUM 4.3
Inappropriate implementation in Extensions in Google Chrome prior to 139.0.7258.66 allowed a remote attacker who convinced a user to engage in specific UI gest… |
|
CVE-2025-8580
MEDIUM 4.3
Inappropriate implementation in Filesystems in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (… |
|
CVE-2025-8579
MEDIUM 4.3
Inappropriate implementation in Picture In Picture in Google Chrome prior to 139.0.7258.66 allowed a remote attacker who convinced a user to engage in specific… |
|
CVE-2025-8578
HIGH 8.8
Use after free in Cast in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chrom… |
|
CVE-2025-8577
MEDIUM 4.3
Inappropriate implementation in Picture In Picture in Google Chrome prior to 139.0.7258.66 allowed a remote attacker who convinced a user to engage in specific… |
|
CVE-2025-8576
HIGH 8.8
Use after free in Extensions in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to potentially exploit heap corruption via a crafted Chrome Exte… |
|
CVE-2025-8292
HIGH 8.8
Use after free in Media Stream in Google Chrome prior to 138.0.7204.183 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML pag… |
|
CVE-2025-8011
HIGH 8.8
Type Confusion in V8 in Google Chrome prior to 138.0.7204.168 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromi… |
|
CVE-2025-8010
HIGH 8.8
Type Confusion in V8 in Google Chrome prior to 138.0.7204.168 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromi… |
|
CVE-2025-8044
CRITICAL 9.8
Memory safety bugs present in Firefox 140 and Thunderbird 140. Some of these bugs showed evidence of memory corruption and we presume that with enough effort s… |
|
CVE-2025-8043
CRITICAL 9.8
Focus incorrectly truncated URLs towards the beginning instead of around the origin. This vulnerability was fixed in Firefox 141. |
|
CVE-2025-8040
HIGH 8.8
Memory safety bugs present in Firefox ESR 140.0, Thunderbird ESR 140.0, Firefox 140 and Thunderbird 140. Some of these bugs showed evidence of memory corruptio… |
|
CVE-2025-8039
HIGH 8.1
In some cases search terms persisted in the URL bar even after navigating away from the search page. This vulnerability was fixed in Firefox 141, Firefox ESR 1… |
|
CVE-2025-8038
CRITICAL 9.8
Thunderbird ignored paths when checking the validity of navigations in a frame. This vulnerability was fixed in Firefox 141, Firefox ESR 140.1, Thunderbird 141… |
|
CVE-2025-8037
CRITICAL 9.1
Setting a nameless cookie with an equals sign in the value shadowed other cookies. Even if the nameless cookie was set over HTTP and the shadowed cookie includ… |
|
CVE-2025-8036
HIGH 8.1
Thunderbird cached CORS preflight responses across IP address changes. This allowed circumventing CORS with DNS rebinding. This vulnerability was fixed in Fire… |
|
CVE-2025-8035
HIGH 8.8
Memory safety bugs present in Firefox ESR 128.12, Thunderbird ESR 128.12, Firefox ESR 140.0, Thunderbird ESR 140.0, Firefox 140 and Thunderbird 140. Some of th… |
Manage your fleet with Appaloosa
Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.