Vulnerabilities
Tracked app vulnerabilities
19,673 CVEs affect a tracked app or OS (all severities, Windows). 303 of them are in the CISA KEV catalog, meaning exploitation is confirmed.
- Matching CVEs
- 19,673
- Actively exploited
- 303
- Publication window
- 1997-01-01 → 2026-10-20
Chronological sort: newest to oldest. Use the KEV / severity filters above to prioritize.
| CVE |
|---|
|
CVE-2025-24071
HIGH · vendor
Microsoft Windows File Explorer Spoofing Vulnerability |
|
CVE-2025-24067
HIGH · vendor
Kernel Streaming Service Driver Elevation of Privilege Vulnerability |
|
CVE-2025-24066
HIGH · vendor
Kernel Streaming Service Driver Elevation of Privilege Vulnerability |
|
CVE-2025-24064
CRITICAL · vendor
Windows Domain Name Service Remote Code Execution Vulnerability |
|
CVE-2025-24061
HIGH · vendor
Windows Mark of the Web Security Feature Bypass Vulnerability |
|
CVE-2025-24059
HIGH · vendor
Windows Common Log File System Driver Elevation of Privilege Vulnerability |
|
CVE-2025-24056
HIGH · vendor
Windows Telephony Service Remote Code Execution Vulnerability |
|
CVE-2025-24055
HIGH · vendor
Windows USB Video Class System Driver Information Disclosure Vulnerability |
|
CVE-2025-24054
NTLM Hash Disclosure Spoofing Vulnerability |
|
CVE-2025-24051
HIGH · vendor
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability |
|
CVE-2025-24050
HIGH · vendor
Windows Hyper-V Elevation of Privilege Vulnerability |
|
CVE-2025-24048
HIGH · vendor
Windows Hyper-V Elevation of Privilege Vulnerability |
|
CVE-2025-24046
HIGH · vendor
Kernel Streaming Service Driver Elevation of Privilege Vulnerability |
|
CVE-2025-24045
CRITICAL · vendor
Windows Remote Desktop Services Remote Code Execution Vulnerability |
|
CVE-2025-24044
HIGH · vendor
Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability |
|
CVE-2025-24035
CRITICAL · vendor
Windows Remote Desktop Services Remote Code Execution Vulnerability |
|
CVE-2025-21247
HIGH · vendor
MapUrlToZone Security Feature Bypass Vulnerability |
|
CVE-2025-21180
HIGH · vendor
Windows exFAT File System Remote Code Execution Vulnerability |
|
CVE-2024-9157
HIGH · vendor
Synaptics: CVE-2024-9157 Synaptics Service Binaries DLL Loading Vulnerability |
|
CVE-2025-2137
HIGH 8.8
Out of bounds read in V8 in Google Chrome prior to 134.0.6998.88 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chr… |
|
CVE-2025-2136
HIGH 8.8
Use after free in Inspector in Google Chrome prior to 134.0.6998.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (… |
|
CVE-2025-2135
HIGH 8.8
Type Confusion in V8 in Google Chrome prior to 134.0.6998.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromiu… |
|
CVE-2025-1920
HIGH 8.8
Type Confusion in V8 in Google Chrome prior to 134.0.6998.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromiu… |
|
CVE-2025-26696
HIGH 7.0
Certain crafted MIME email messages that claimed to contain an encrypted OpenPGP message, which instead contained an OpenPGP signed message, were wrongly shown… |
|
CVE-2025-26695
MEDIUM 5.3
When requesting an OpenPGP key from a WKD server, an incorrect padding size was used and a network observer could have learned the length of the requested emai… |
|
CVE-2025-1923
MEDIUM 4.3
Inappropriate implementation in Permission Prompts in Google Chrome prior to 134.0.6998.35 allowed an attacker who convinced a user to install a malicious exte… |
|
CVE-2025-1922
MEDIUM 4.3
Inappropriate implementation in Selection in Google Chrome on Android prior to 134.0.6998.35 allowed a remote attacker who convinced a user to engage in specif… |
|
CVE-2025-1921
MEDIUM 6.5
Inappropriate implementation in Media Stream in Google Chrome prior to 134.0.6998.35 allowed a remote attacker to obtain information about a peripheral via a c… |
|
CVE-2025-1919
HIGH 8.8
Out of bounds read in Media in Google Chrome prior to 134.0.6998.35 allowed a remote attacker to potentially perform out of bounds memory access via a crafted … |
|
CVE-2025-1918
HIGH 8.8
Out of bounds read in PDFium in Google Chrome prior to 134.0.6998.35 allowed a remote attacker to potentially perform out of bounds memory access via a crafted… |
|
CVE-2025-1917
MEDIUM 4.3
Inappropriate implementation in Browser UI in Google Chrome on Android prior to 134.0.6998.35 allowed a remote attacker to perform UI spoofing via a crafted HT… |
|
CVE-2025-1916
HIGH 8.8
Use after free in Profiles in Google Chrome prior to 134.0.6998.35 allowed an attacker who convinced a user to install a malicious extension to potentially exp… |
|
CVE-2025-1915
HIGH 8.1
Improper Limitation of a Pathname to a Restricted Directory in DevTools in Google Chrome on Windows prior to 134.0.6998.35 allowed an attacker who convinced a … |
|
CVE-2025-1914
HIGH 8.8
Out of bounds read in V8 in Google Chrome prior to 134.0.6998.35 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chr… |
|
CVE-2025-1943
HIGH 8.2
Memory safety bugs present in Firefox 135 and Thunderbird 135. Some of these bugs showed evidence of memory corruption and we presume that with enough effort s… |
|
CVE-2025-1942
CRITICAL 9.8
When String.toUpperCase() caused a string to get longer it was possible for uninitialized memory to be incorporated into the result string. This vulnerability … |
|
CVE-2025-1941
CRITICAL 9.1
Under certain circumstances, a user opt-in setting that Focus should require authentication before use could have been be bypassed (distinct from CVE-2025-0245… |
|
CVE-2025-1940
HIGH 7.1
A select option could partially obscure the confirmation prompt shown before launching external apps. This could be used to trick a user in to launching an ext… |
|
CVE-2025-1939
LOW 3.9
Android apps can load web pages using the Custom Tabs feature. This feature supports a transition animation that could have been used to trick a user into gran… |
|
CVE-2025-1938
MEDIUM 6.5
Memory safety bugs present in Firefox 135, Thunderbird 135, Firefox ESR 128.7, and Thunderbird 128.7. Some of these bugs showed evidence of memory corruption a… |
|
CVE-2025-1937
HIGH 7.5
Memory safety bugs present in Firefox 135, Thunderbird 135, Firefox ESR 115.20, Firefox ESR 128.7, and Thunderbird 128.7. Some of these bugs showed evidence of… |
|
CVE-2025-1936
HIGH 7.3
jar: URLs retrieve local file content packaged in a ZIP archive. The null and everything after it was ignored when retrieving the content from the archive, but… |
|
CVE-2025-1935
MEDIUM 4.3
A web page could trick a user into setting that site as the default handler for a custom URL protocol. This vulnerability was fixed in Firefox 136, Firefox ESR… |
|
CVE-2025-1934
MEDIUM 6.5
It was possible to interrupt the processing of a RegExp bailout and run additional JavaScript, potentially triggering garbage collection when the engine was no… |
|
CVE-2025-1933
HIGH 7.6
On 64-bit CPUs, when the JIT compiles WASM i32 return values they can pick up bits from left over memory. This can potentially cause them to be treated as a di… |
|
CVE-2025-1932
HIGH 8.1
An inconsistent comparator in xslt/txNodeSorter could have resulted in potentially exploitable out-of-bounds access. Only affected version 122 and later. This … |
|
CVE-2025-1931
HIGH 7.5
It was possible to cause a use-after-free in the content process side of a WebTransport connection, leading to a potentially exploitable crash. This vulnerabil… |
|
CVE-2025-1930
HIGH 8.8
On Windows, a compromised content process could use bad StreamData sent over AudioIPC to trigger a use-after-free in the Browser process. This could have led t… |
|
CVE-2025-1426
HIGH 8.8
Heap buffer overflow in GPU in Google Chrome on Android prior to 133.0.6943.126 allowed a remote attacker to potentially exploit heap corruption via a crafted … |
|
CVE-2025-1006
HIGH 8.8
Use after free in Network in Google Chrome prior to 133.0.6943.126 allowed a remote attacker to potentially exploit heap corruption via a crafted web app. (Chr… |
Manage your fleet with Appaloosa
Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.