Vulnerabilities
Tracked app vulnerabilities
19,673 CVEs affect a tracked app or OS (all severities, Windows). 303 of them are in the CISA KEV catalog, meaning exploitation is confirmed.
- Matching CVEs
- 19,673
- Actively exploited
- 303
- Publication window
- 1997-01-01 → 2026-10-20
Chronological sort: newest to oldest. Use the KEV / severity filters above to prioritize.
| CVE |
|---|
|
CVE-2025-0444
MEDIUM 6.3
Use after free in Skia in Google Chrome prior to 133.0.6943.53 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chrom… |
|
CVE-2025-1020
CRITICAL 9.8
Memory safety bugs present in Firefox 134 and Thunderbird 134. Some of these bugs showed evidence of memory corruption and we presume that with enough effort s… |
|
CVE-2025-1019
MEDIUM 4.3
The z-order of the browser windows could be manipulated to hide the fullscreen notification. This could potentially be leveraged to perform a spoofing attack. … |
|
CVE-2025-1018
MEDIUM 5.3
The fullscreen notification is prematurely hidden when fullscreen is re-requested quickly by the user. This could have been leveraged to perform a potential sp… |
|
CVE-2025-1017
CRITICAL 9.8
Memory safety bugs present in Firefox 134, Thunderbird 134, Firefox ESR 128.6, and Thunderbird 128.6. Some of these bugs showed evidence of memory corruption a… |
|
CVE-2025-1016
CRITICAL 9.8
Memory safety bugs present in Firefox 134, Thunderbird 134, Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19, and Thunderbird 128.6. Some of these bug… |
|
CVE-2025-1015
MEDIUM 5.4
The Thunderbird Address Book URI fields contained unsanitized links. This could be used by an attacker to create and export an address book containing a malici… |
|
CVE-2025-1014
HIGH 8.8
Certificate length was not properly checked when added to a certificate store. In practice only trusted data was processed. This vulnerability was fixed in Fir… |
|
CVE-2025-1013
MEDIUM 6.5
A race condition could have led to private browsing tabs being opened in normal browsing windows. This could have resulted in a potential privacy leak. This vu… |
|
CVE-2025-1012
HIGH 7.5
A race during concurrent delazification could have led to a use-after-free. This vulnerability was fixed in Firefox 135, Firefox ESR 115.20, Firefox ESR 128.7,… |
|
CVE-2025-1011
HIGH 8.8
A bug in WebAssembly code generation could have lead to a crash. It may have been possible for an attacker to leverage this to achieve code execution. This vul… |
|
CVE-2025-1010
HIGH 8.8
An attacker could have caused a use-after-free via the Custom Highlight API, leading to a potentially exploitable crash. This vulnerability was fixed in Firefo… |
|
CVE-2025-1009
CRITICAL 9.8
An attacker could have caused a use-after-free via crafted XSLT data, leading to a potentially exploitable crash. This vulnerability was fixed in Firefox 135, … |
|
CVE-2025-0510
MEDIUM 6.5
Thunderbird displayed an incorrect sender address if the From field of an email used the invalid group name syntax that is described in CVE-2024-49040. This vu… |
|
CVE-2025-0762
HIGH 8.8
Use after free in DevTools in Google Chrome prior to 132.0.6834.159 allowed a remote attacker to potentially exploit heap corruption via a crafted Chrome Exten… |
|
CVE-2025-0411
7-Zip Mark-of-the-Web Bypass Vulnerability. This vulnerability allows remote attackers to bypass the Mark-of-the-Web protection mechanism on affected installat… |
|
CVE-2025-0612
HIGH 7.5
Out of bounds memory access in V8 in Google Chrome prior to 132.0.6834.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML … |
|
CVE-2025-0611
HIGH 8.2
Object corruption in V8 in Google Chrome prior to 132.0.6834.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chr… |
|
CVE-2025-0448
MEDIUM 4.3
Inappropriate implementation in Compositing in Google Chrome prior to 132.0.6834.83 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (… |
|
CVE-2025-0447
HIGH 8.8
Inappropriate implementation in Navigation in Google Chrome prior to 132.0.6834.83 allowed a remote attacker to perform privilege escalation via a crafted HTML… |
|
CVE-2025-0446
MEDIUM 4.3
Inappropriate implementation in Extensions in Google Chrome prior to 132.0.6834.83 allowed a remote attacker who convinced a user to engage in specific UI gest… |
|
CVE-2025-0443
HIGH 8.8
Insufficient data validation in Extensions in Google Chrome prior to 132.0.6834.83 allowed a remote attacker who convinced a user to engage in specific UI gest… |
|
CVE-2025-0442
MEDIUM 6.5
Inappropriate implementation in Payments in Google Chrome prior to 132.0.6834.83 allowed a remote attacker who convinced a user to engage in specific UI gestur… |
|
CVE-2025-0441
MEDIUM 6.5
Inappropriate implementation in Fenced Frames in Google Chrome prior to 132.0.6834.83 allowed a remote attacker to obtain potentially sensitive information fro… |
|
CVE-2025-0440
MEDIUM 6.5
Inappropriate implementation in Fullscreen in Google Chrome on Windows prior to 132.0.6834.83 allowed a remote attacker to perform UI spoofing via a crafted HT… |
|
CVE-2025-0439
MEDIUM 6.5
Race in Frames in Google Chrome prior to 132.0.6834.83 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing … |
|
CVE-2025-0438
HIGH 8.8
Stack buffer overflow in Tracing in Google Chrome prior to 132.0.6834.83 allowed a remote attacker to potentially exploit stack corruption via a crafted HTML p… |
|
CVE-2025-0437
HIGH 8.8
Out of bounds read in Metrics in Google Chrome prior to 132.0.6834.83 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.… |
|
CVE-2025-0436
HIGH 8.8
Integer overflow in Skia in Google Chrome prior to 132.0.6834.83 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chr… |
|
CVE-2025-0435
MEDIUM 6.5
Inappropriate implementation in Navigation in Google Chrome on Android prior to 132.0.6834.83 allowed a remote attacker to perform UI spoofing via a crafted HT… |
|
CVE-2025-0434
HIGH 8.8
Out of bounds memory access in V8 in Google Chrome prior to 132.0.6834.83 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML p… |
|
CVE-2025-21362
HIGH 8.4
Microsoft Excel Remote Code Execution Vulnerability |
|
CVE-2025-21357
MEDIUM 6.7
Microsoft Outlook Remote Code Execution Vulnerability |
|
CVE-2025-21338
HIGH · vendor
GDI+ Remote Code Execution Vulnerability |
|
CVE-2025-21335
Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability |
|
CVE-2025-21417
HIGH · vendor
Windows Telephony Service Remote Code Execution Vulnerability |
|
CVE-2025-21413
HIGH · vendor
Windows Telephony Service Remote Code Execution Vulnerability |
|
CVE-2025-21411
HIGH · vendor
Windows Telephony Service Remote Code Execution Vulnerability |
|
CVE-2025-21409
HIGH · vendor
Windows Telephony Service Remote Code Execution Vulnerability |
|
CVE-2025-21389
HIGH · vendor
Windows Universal Plug and Play (UPnP) Device Host Denial of Service Vulnerability |
|
CVE-2025-21382
HIGH · vendor
Windows Graphics Component Elevation of Privilege Vulnerability |
|
CVE-2025-21378
HIGH · vendor
Windows CSC Service Elevation of Privilege Vulnerability |
|
CVE-2025-21374
HIGH · vendor
Windows CSC Service Information Disclosure Vulnerability |
|
CVE-2025-21372
HIGH · vendor
Microsoft Brokering File System Elevation of Privilege Vulnerability |
|
CVE-2025-21370
HIGH · vendor
Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability |
|
CVE-2025-21343
HIGH · vendor
Windows Web Threat Defense User Service Information Disclosure Vulnerability |
|
CVE-2025-21341
HIGH · vendor
Windows Digital Media Elevation of Privilege Vulnerability |
|
CVE-2025-21340
HIGH · vendor
Windows Virtualization-Based Security (VBS) Security Feature Bypass Vulnerability |
|
CVE-2025-21339
HIGH · vendor
Windows Telephony Service Remote Code Execution Vulnerability |
|
CVE-2025-21336
HIGH · vendor
Windows Cryptographic Information Disclosure Vulnerability |
Manage your fleet with Appaloosa
Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.