Vulnerabilities
Tracked app vulnerabilities
2,721 CVEs affect a tracked app or OS (Critical, all platforms). 48 of them are in the CISA KEV catalog, meaning exploitation is confirmed.
- Matching CVEs
- 2,721
- Actively exploited
- 48
- Publication window
- 2007-08-28 → 2026-11-10
Chronological sort: newest to oldest. Use the KEV / severity filters above to prioritize.
| CVE |
|---|
|
CVE-2026-11082
CRITICAL 9.6
Race in GPU in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sand… |
|
CVE-2026-11070
CRITICAL 9.6
Insufficient validation of untrusted input in Chromoting in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the n… |
|
CVE-2026-11066
CRITICAL 9.6
Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape v… |
|
CVE-2026-11065
CRITICAL 9.6
Use after free in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a san… |
|
CVE-2026-11063
CRITICAL 9.6
Insufficient validation of untrusted input in WebNN in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the render… |
|
CVE-2026-11061
CRITICAL 9.6
Type Confusion in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chr… |
|
CVE-2026-11056
CRITICAL 9.6
Insufficient validation of untrusted input in SiteIsolation in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised th… |
|
CVE-2026-11052
CRITICAL 9.6
Type Confusion in GPU in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perf… |
|
CVE-2026-11047
CRITICAL 9.6
Inappropriate implementation in Base in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to p… |
|
CVE-2026-11043
CRITICAL 9.6
Out of bounds write in ANGLE in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially p… |
|
CVE-2026-11037
CRITICAL 9.6
Out of bounds write in Codecs in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted video fil… |
|
CVE-2026-11029
CRITICAL 9.6
Insufficient validation of untrusted input in Drag and Drop in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised th… |
|
CVE-2026-11021
CRITICAL 9.6
Insufficient validation of untrusted input in GPU in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer… |
|
CVE-2026-11009
CRITICAL 9.6
Use after free in USB in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML p… |
|
CVE-2026-11002
CRITICAL 9.6
Use after free in Autofill in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a … |
|
CVE-2026-10990
CRITICAL 9.6
Use after free in Glic in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sand… |
|
CVE-2026-10983
CRITICAL 9.6
Insufficient validation of untrusted input in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape vi… |
|
CVE-2026-10974
CRITICAL 9.6
Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape v… |
|
CVE-2026-10972
CRITICAL 9.6
Use after free in Ozone in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML p… |
|
CVE-2026-10971
CRITICAL 9.6
Insufficient validation of untrusted input in Printing in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the ren… |
|
CVE-2026-10966
CRITICAL 9.6
Inappropriate implementation in Codecs in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted … |
|
CVE-2026-10931
CRITICAL 9.6
Use after free in FileSystem in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.… |
|
CVE-2026-10892
CRITICAL 9.6
Out of bounds write in GPU in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted H… |
|
CVE-2026-10886
CRITICAL 9.6
Use after free in FileSystem in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.… |
|
CVE-2026-10881
CRITICAL 9.6
Out of bounds read and write in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted H… |
|
CVE-2026-9967
CRITICAL 9.6
Out of bounds write in GPU in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. … |
|
CVE-2026-9918
CRITICAL 9.6
Inappropriate implementation in Tint in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to potentially perform a sandbox escape via a crafted H… |
|
CVE-2026-9891
CRITICAL 9.0
Use after free in Extensions in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform… |
|
CVE-2026-9886
CRITICAL 9.6
Use after free in Base in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML pag… |
|
CVE-2026-9881
CRITICAL 9.0
Use after free in Bluetooth in Google Chrome on Mac prior to 148.0.7778.216 allowed an attacker who convinced a user to install a malicious extension to potent… |
|
CVE-2026-9876
CRITICAL 9.6
Use after free in WebGL in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTM… |
|
CVE-2026-9875
CRITICAL 9.6
Out of bounds read in WebGL in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker to potentially perform a sandbox escape via a crafted… |
|
CVE-2026-9874
CRITICAL 9.6
Use after free in Dawn in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chr… |
|
CVE-2026-9872
CRITICAL 9.6
Out of bounds write in GPU in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker to potentially perform a sandbox escape via a crafted … |
|
CVE-2026-8959
CRITICAL 9.6
Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbir… |
|
CVE-2026-8956
CRITICAL 9.8
Integer overflow in the Networking: JAR component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11. |
|
CVE-2026-8953
CRITICAL 9.6
Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 151, Firefox ESR 115.36, Firefox ESR 140.… |
|
CVE-2026-8950
CRITICAL 9.3
Same-origin policy bypass in the Networking: HTTP component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird … |
|
CVE-2026-8948
CRITICAL 9.1
Same-origin policy bypass in the DOM: Networking component. This vulnerability was fixed in Firefox 151 and Thunderbird 151. |
|
CVE-2026-8580
CRITICAL 9.6
Use after free in Mojo in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chr… |
|
CVE-2026-8511
CRITICAL 9.6
Use after free in UI in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chrom… |
|
CVE-2026-41615
CRITICAL 9.6
Exposure of sensitive information to an unauthorized actor in Microsoft Authenticator allows an unauthorized attacker to disclose information over a network. |
|
CVE-2026-41096
CRITICAL 9.8
Heap-based buffer overflow in Microsoft Windows DNS allows an unauthorized attacker to execute code over a network. |
|
CVE-2026-41089
CRITICAL 9.8
Stack-based buffer overflow in Windows Netlogon allows an unauthorized attacker to execute code over a network. |
|
CVE-2026-40402
CRITICAL 9.3
Use after free in Windows Hyper-V allows an unauthorized attacker to elevate privileges locally. |
|
CVE-2026-8401
CRITICAL 9.8
Sandbox escape in the Profile Backup component. This vulnerability was fixed in Firefox 150.0.3, Firefox ESR 115.36, Firefox ESR 140.11, and Thunderbird 140.11. |
|
CVE-2026-33823
CRITICAL 9.6
Improper authorization in Microsoft Teams allows an authorized attacker to disclose information over a network. |
|
CVE-2026-8094
CRITICAL 9.8
Other issue in the WebRTC component. This vulnerability was fixed in Firefox ESR 140.10.2 and Thunderbird 140.10.2. |
|
CVE-2026-8091
CRITICAL 9.8
Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 150, Thunderbird 150, Firefox ESR 140.10.1, Thund… |
|
CVE-2026-7910
CRITICAL 9.6
Use after free in Views in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to bypass site isolation via… |
Manage your fleet with Appaloosa
Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.