Vulnerabilities
Tracked app vulnerabilities
19,673 CVEs affect a tracked app or OS (all severities, Windows). 303 of them are in the CISA KEV catalog, meaning exploitation is confirmed.
- Matching CVEs
- 19,673
- Actively exploited
- 303
- Publication window
- 1997-01-01 → 2026-10-20
Chronological sort: newest to oldest. Use the KEV / severity filters above to prioritize.
| CVE |
|---|
|
CVE-2025-21204
HIGH · vendor
Windows Process Activation Elevation of Privilege Vulnerability |
|
CVE-2025-21203
HIGH · vendor
Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability |
|
CVE-2025-21197
HIGH · vendor
Windows NTFS Information Disclosure Vulnerability |
|
CVE-2025-21191
HIGH · vendor
Windows Local Security Authority (LSA) Elevation of Privilege Vulnerability |
|
CVE-2025-21174
HIGH · vendor
Windows Standards-Based Storage Management Service Denial of Service Vulnerability |
|
CVE-2025-31334
MEDIUM 6.8
Issue that bypasses the "Mark of the Web" security warning function for files when opening a symbolic link that points to an executable file exists in WinRAR v… |
|
CVE-2025-3074
MEDIUM 5.4
Inappropriate implementation in Downloads in Google Chrome prior to 135.0.7049.52 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Ch… |
|
CVE-2025-3073
MEDIUM 5.4
Inappropriate implementation in Autofill in Google Chrome prior to 135.0.7049.52 allowed a remote attacker who convinced a user to engage in specific UI gestur… |
|
CVE-2025-3072
MEDIUM 5.4
Inappropriate implementation in Custom Tabs in Google Chrome prior to 135.0.7049.52 allowed a remote attacker who convinced a user to engage in specific UI ges… |
|
CVE-2025-3071
MEDIUM 5.4
Inappropriate implementation in Navigations in Google Chrome prior to 135.0.7049.52 allowed a remote attacker who convinced a user to engage in specific UI ges… |
|
CVE-2025-3070
MEDIUM 6.5
Insufficient validation of untrusted input in Extensions in Google Chrome prior to 135.0.7049.52 allowed a remote attacker to perform privilege escalation via … |
|
CVE-2025-3069
HIGH 8.8
Inappropriate implementation in Extensions in Google Chrome prior to 135.0.7049.52 allowed a remote attacker to perform privilege escalation via a crafted HTML… |
|
CVE-2025-3068
HIGH 8.8
Inappropriate implementation in Intents in Google Chrome on Android prior to 135.0.7049.52 allowed a remote attacker to perform privilege escalation via a craf… |
|
CVE-2025-3067
HIGH 8.8
Inappropriate implementation in Custom Tabs in Google Chrome on Android prior to 135.0.7049.52 allowed a remote attacker who convinced a user to engage in spec… |
|
CVE-2025-3066
HIGH 8.8
Use after free in Site Isolation in Google Chrome prior to 135.0.7049.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML pa… |
|
CVE-2025-3035
MEDIUM 5.3
By first using the AI chatbot in one tab and later activating it in another tab, the document title of the previous tab would leak into the chat prompt. This v… |
|
CVE-2025-3034
HIGH 8.1
Memory safety bugs present in Firefox 136 and Thunderbird 136. Some of these bugs showed evidence of memory corruption and we presume that with enough effort s… |
|
CVE-2025-3033
HIGH 7.7
After selecting a malicious Windows `.url` shortcut from the local filesystem, an unexpected file could be uploaded. *This bug only affects Firefox on Window… |
|
CVE-2025-3032
HIGH 7.4
Leaking of file descriptors from the fork server to web content processes could allow for privilege escalation attacks. This vulnerability was fixed in Firefox… |
|
CVE-2025-3031
MEDIUM 6.5
An attacker could read 32 bits of values spilled onto the stack in a JIT compiled function. This vulnerability was fixed in Firefox 137 and Thunderbird 137. |
|
CVE-2025-3030
HIGH 8.1
Memory safety bugs present in Firefox 136, Thunderbird 136, Firefox ESR 128.8, and Thunderbird 128.8. Some of these bugs showed evidence of memory corruption a… |
|
CVE-2025-3029
HIGH 7.3
A crafted URL containing specific Unicode characters could have hidden the true origin of the page, resulting in a potential spoofing attack. This vulnerabilit… |
|
CVE-2025-3028
MEDIUM 6.5
JavaScript code running while transforming a document with the XSLTProcessor could lead to a use-after-free. This vulnerability was fixed in Firefox 137, Firef… |
|
CVE-2025-2857
CRITICAL 10.0
Following the recent Chrome sandbox escape (CVE-2025-2783), various Firefox developers identified a similar pattern in our IPC code. A compromised child proces… |
|
CVE-2025-2783
HIGH 8.3
KEV
Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 134.0.6998.177 allowed a remote attacker to perform a sandb… |
|
CVE-2025-2476
HIGH 8.8
Use after free in Lens in Google Chrome prior to 134.0.6998.117 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chro… |
|
CVE-2025-26633
Improper neutralization in Microsoft Management Console allows an unauthorized attacker to bypass a security feature locally. |
|
CVE-2025-24993
Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally. |
|
CVE-2025-24082
HIGH 7.8
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
|
CVE-2025-24081
HIGH 7.8
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
|
CVE-2025-24079
HIGH 7.8
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally. |
|
CVE-2025-24078
HIGH 7.0
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally. |
|
CVE-2025-24075
HIGH 7.8
Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
|
CVE-2025-26645
CRITICAL · vendor
Remote Desktop Client Remote Code Execution Vulnerability |
|
CVE-2025-26634
HIGH · vendor
Windows Core Messaging Elevation of Privileges Vulnerability |
|
CVE-2025-25008
HIGH · vendor
Windows Server Elevation of Privilege Vulnerability |
|
CVE-2025-24997
HIGH · vendor
DirectX Graphics Kernel File Denial of Service Vulnerability |
|
CVE-2025-24996
HIGH · vendor
NTLM Hash Disclosure Spoofing Vulnerability |
|
CVE-2025-24995
HIGH · vendor
Kernel Streaming WOW Thunk Service Driver Elevation of Privilege Vulnerability |
|
CVE-2025-24994
HIGH · vendor
Microsoft Windows Cross Device Service Elevation of Privilege Vulnerability |
|
CVE-2025-24992
HIGH · vendor
Windows NTFS Information Disclosure Vulnerability |
|
CVE-2025-24991
Windows NTFS Information Disclosure Vulnerability |
|
CVE-2025-24988
HIGH · vendor
Windows USB Video Class System Driver Elevation of Privilege Vulnerability |
|
CVE-2025-24987
HIGH · vendor
Windows USB Video Class System Driver Elevation of Privilege Vulnerability |
|
CVE-2025-24985
Windows Fast FAT File System Driver Remote Code Execution Vulnerability |
|
CVE-2025-24984
Windows NTFS Information Disclosure Vulnerability |
|
CVE-2025-24983
Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability |
|
CVE-2025-24084
CRITICAL · vendor
Windows Subsystem for Linux (WSL2) Kernel Remote Code Execution Vulnerability |
|
CVE-2025-24076
HIGH · vendor
Microsoft Windows Cross Device Service Elevation of Privilege Vulnerability |
|
CVE-2025-24072
HIGH · vendor
Microsoft Local Security Authority (LSA) Server Elevation of Privilege Vulnerability |
Manage your fleet with Appaloosa
Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.