Vulnerabilities
Tracked app vulnerabilities
19,673 CVEs affect a tracked app or OS (all severities, Windows). 303 of them are in the CISA KEV catalog, meaning exploitation is confirmed.
- Matching CVEs
- 19,673
- Actively exploited
- 303
- Publication window
- 1997-01-01 → 2026-10-20
Chronological sort: newest to oldest. Use the KEV / severity filters above to prioritize.
| CVE |
|---|
|
CVE-2025-30394
HIGH · vendor
Windows Remote Desktop Gateway (RD Gateway) Denial of Service Vulnerability |
|
CVE-2025-30385
HIGH · vendor
Windows Common Log File System Driver Elevation of Privilege Vulnerability |
|
CVE-2025-29974
HIGH · vendor
Windows Kernel Information Disclosure Vulnerability |
|
CVE-2025-29971
HIGH · vendor
Web Threat Defense (WTD.sys) Denial of Service Vulnerability |
|
CVE-2025-29970
HIGH · vendor
Microsoft Brokering File System Elevation of Privilege Vulnerability |
|
CVE-2025-29969
HIGH · vendor
MS-EVEN RPC Remote Code Execution Vulnerability |
|
CVE-2025-29968
HIGH · vendor
Active Directory Certificate Services (AD CS) Denial of Service Vulnerability |
|
CVE-2025-29967
CRITICAL · vendor
Remote Desktop Client Remote Code Execution Vulnerability |
|
CVE-2025-29966
CRITICAL · vendor
Remote Desktop Client Remote Code Execution Vulnerability |
|
CVE-2025-29964
HIGH · vendor
Windows Media Remote Code Execution Vulnerability |
|
CVE-2025-29963
HIGH · vendor
Windows Media Remote Code Execution Vulnerability |
|
CVE-2025-29962
HIGH · vendor
Windows Media Remote Code Execution Vulnerability |
|
CVE-2025-29961
HIGH · vendor
Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability |
|
CVE-2025-29960
HIGH · vendor
Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability |
|
CVE-2025-29959
HIGH · vendor
Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability |
|
CVE-2025-29958
HIGH · vendor
Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability |
|
CVE-2025-29957
HIGH · vendor
Windows Deployment Services Denial of Service Vulnerability |
|
CVE-2025-29956
HIGH · vendor
Windows SMB Information Disclosure Vulnerability |
|
CVE-2025-29955
HIGH · vendor
Windows Hyper-V Denial of Service Vulnerability |
|
CVE-2025-29954
HIGH · vendor
Windows Lightweight Directory Access Protocol (LDAP) Denial of Service Vulnerability |
|
CVE-2025-29842
HIGH · vendor
UrlMon Security Feature Bypass Vulnerability |
|
CVE-2025-29841
HIGH · vendor
Universal Print Management Service Elevation of Privilege Vulnerability |
|
CVE-2025-29840
HIGH · vendor
Windows Media Remote Code Execution Vulnerability |
|
CVE-2025-29839
HIGH · vendor
Windows Multiple UNC Provider Driver Information Disclosure Vulnerability |
|
CVE-2025-29838
HIGH · vendor
Windows ExecutionContext Driver Elevation of Privilege Vulnerability |
|
CVE-2025-29837
HIGH · vendor
Windows Installer Information Disclosure Vulnerability |
|
CVE-2025-29836
HIGH · vendor
Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability |
|
CVE-2025-29835
HIGH · vendor
Windows Remote Access Connection Manager Information Disclosure Vulnerability |
|
CVE-2025-29833
CRITICAL · vendor
Microsoft Virtual Machine Bus (VMBus) Remote Code Execution Vulnerability |
|
CVE-2025-29832
HIGH · vendor
Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability |
|
CVE-2025-29831
HIGH · vendor
Windows Remote Desktop Services Remote Code Execution Vulnerability |
|
CVE-2025-29830
HIGH · vendor
Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability |
|
CVE-2025-29829
HIGH · vendor
Windows Trusted Runtime Interface Driver Information Disclosure Vulnerability |
|
CVE-2025-27468
HIGH · vendor
Windows Kernel-Mode Driver Elevation of Privilege Vulnerability |
|
CVE-2025-26677
HIGH · vendor
Windows Remote Desktop Gateway (RD Gateway) Denial of Service Vulnerability |
|
CVE-2025-24063
HIGH · vendor
Kernel Streaming Service Driver Elevation of Privilege Vulnerability |
|
CVE-2025-4372
HIGH 8.8
Use after free in WebAudio in Google Chrome prior to 136.0.7103.92 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (C… |
|
CVE-2025-4096
HIGH 8.8
Heap buffer overflow in HTML in Google Chrome prior to 136.0.7103.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. … |
|
CVE-2025-4052
CRITICAL 9.8
Inappropriate implementation in DevTools in Google Chrome prior to 136.0.7103.59 allowed a remote attacker who convinced a user to engage in specific UI gestur… |
|
CVE-2025-4051
MEDIUM 6.3
Insufficient data validation in DevTools in Google Chrome prior to 136.0.7103.59 allowed a remote attacker who convinced a user to engage in specific UI gestur… |
|
CVE-2025-4050
HIGH 8.8
Out of bounds memory access in DevTools in Google Chrome prior to 136.0.7103.59 allowed a remote attacker who convinced a user to engage in specific UI gesture… |
|
CVE-2025-4093
HIGH 8.1
Memory safety bug present in Firefox ESR 128.9, and Thunderbird 128.9. This bug showed evidence of memory corruption and we presume that with enough effort thi… |
|
CVE-2025-4092
MEDIUM 6.5
Memory safety bugs present in Firefox 137 and Thunderbird 137. Some of these bugs showed evidence of memory corruption and we presume that with enough effort s… |
|
CVE-2025-4091
HIGH 8.1
Memory safety bugs present in Firefox 137, Thunderbird 137, Firefox ESR 128.9, and Thunderbird 128.9. Some of these bugs showed evidence of memory corruption a… |
|
CVE-2025-4089
MEDIUM 5.1
Due to insufficient escaping of special characters in the "copy as cURL" feature, an attacker could trick a user into using this command, potentially leading t… |
|
CVE-2025-4088
MEDIUM 6.5
A security vulnerability in Thunderbird allowed malicious sites to use redirects to send credentialed requests to arbitrary endpoints on any site that had invo… |
|
CVE-2025-4087
MEDIUM 4.8
A vulnerability was identified in Thunderbird where XPath parsing could trigger undefined behavior due to missing null checks during attribute access. This cou… |
|
CVE-2025-4085
HIGH 7.1
An attacker with control over a content process could potentially leverage the privileged UITour actor to leak sensitive information or escalate privileges. Th… |
|
CVE-2025-4084
MEDIUM 5.7
Due to insufficient escaping of the special characters in the "copy as cURL" feature, an attacker could trick a user into using this command, potentially leadi… |
|
CVE-2025-4083
CRITICAL 9.1
A process isolation vulnerability in Thunderbird stemmed from improper handling of javascript: URIs, which could allow content to execute in the top-level docu… |
Manage your fleet with Appaloosa
Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.