Vulnerabilities
Tracked app vulnerabilities
19,679 CVEs affect a tracked app or OS (all severities, Windows). 303 of them are in the CISA KEV catalog, meaning exploitation is confirmed.
- Matching CVEs
- 19,679
- Actively exploited
- 303
- Publication window
- 1997-01-01 → 2026-10-20
Chronological sort: newest to oldest. Use the KEV / severity filters above to prioritize.
| CVE |
|---|
|
CVE-2023-32057
CRITICAL · vendor
Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability |
|
CVE-2023-32056
HIGH · vendor
Windows Server Update Service (WSUS) Elevation of Privilege Vulnerability |
|
CVE-2023-32055
HIGH · vendor
Active Template Library Elevation of Privilege Vulnerability |
|
CVE-2023-32054
HIGH · vendor
Volume Shadow Copy Elevation of Privilege Vulnerability |
|
CVE-2023-32053
HIGH · vendor
Windows Installer Elevation of Privilege Vulnerability |
|
CVE-2023-32049
Windows SmartScreen Security Feature Bypass Vulnerability |
|
CVE-2023-32046
Windows MSHTML Platform Elevation of Privilege Vulnerability |
|
CVE-2023-32045
HIGH · vendor
Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability |
|
CVE-2023-32044
HIGH · vendor
Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability |
|
CVE-2023-32043
HIGH · vendor
Windows Remote Desktop Security Feature Bypass Vulnerability |
|
CVE-2023-32042
HIGH · vendor
OLE Automation Information Disclosure Vulnerability |
|
CVE-2023-32041
HIGH · vendor
Windows Update Orchestrator Service Information Disclosure Vulnerability |
|
CVE-2023-32040
HIGH · vendor
Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability |
|
CVE-2023-32039
HIGH · vendor
Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability |
|
CVE-2023-32038
HIGH · vendor
Microsoft ODBC Driver Remote Code Execution Vulnerability |
|
CVE-2023-32037
HIGH · vendor
Windows Layer-2 Bridge Network Driver Information Disclosure Vulnerability |
|
CVE-2023-32035
HIGH · vendor
Remote Procedure Call Runtime Denial of Service Vulnerability |
|
CVE-2023-32034
HIGH · vendor
Remote Procedure Call Runtime Denial of Service Vulnerability |
|
CVE-2023-32033
HIGH · vendor
Microsoft Failover Cluster Remote Code Execution Vulnerability |
|
CVE-2023-21756
HIGH · vendor
Windows Win32k Elevation of Privilege Vulnerability |
|
CVE-2023-21526
HIGH · vendor
Windows Netlogon Information Disclosure Vulnerability |
|
CVE-2023-37211
HIGH 8.8
Memory safety bugs present in Firefox 114, Firefox ESR 102.12, and Thunderbird 102.12. Some of these bugs showed evidence of memory corruption and we presume t… |
|
CVE-2023-37208
HIGH 7.8
When opening Diagcab files, Firefox did not warn the user that these files may contain malicious code. This vulnerability affects Firefox < 115, Firefox ESR < … |
|
CVE-2023-37207
MEDIUM 6.5
A website could have obscured the fullscreen notification by using a URL with a scheme handled by an external program, such as a mailto URL. This could have le… |
|
CVE-2023-37202
HIGH 8.8
Cross-compartment wrappers wrapping a scripted proxy could have caused objects from other compartments to be stored in the main compartment resulting in a use-… |
|
CVE-2023-37201
HIGH 8.8
An attacker could have triggered a use-after-free condition when creating a WebRTC connection over HTTPS. This vulnerability affects Firefox < 115, Firefox ESR… |
|
CVE-2023-3497
MEDIUM 4.6
Out of bounds read in Google Security Processor firmware in Google Chrome on Chrome OS prior to 114.0.5735.90 allowed a local attacker to perform denial of ser… |
|
CVE-2023-36539
MEDIUM 5.3
Exposure of information intended to be encrypted by some Zoom clients may lead to disclosure of sensitive information. |
|
CVE-2023-3422
HIGH 8.8
Use after free in Guest View in Google Chrome prior to 114.0.5735.198 allowed an attacker who convinced a user to install a malicious extension to potentially … |
|
CVE-2023-3421
HIGH 8.8
Use after free in Media in Google Chrome prior to 114.0.5735.198 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chr… |
|
CVE-2023-3420
HIGH 8.8
Type Confusion in V8 in Google Chrome prior to 114.0.5735.198 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromi… |
|
CVE-2023-36632
HIGH 7.5
The legacy email.utils.parseaddr function in Python through 3.11.4 allows attackers to trigger "RecursionError: maximum recursion depth exceeded while calling … |
|
CVE-2023-32353
HIGH 7.8
A logic issue was addressed with improved checks. This issue is fixed in iTunes 12.12.9 for Windows. An app may be able to elevate privileges. |
|
CVE-2023-32351
HIGH 7.8
A logic issue was addressed with improved checks. This issue is fixed in iTunes 12.12.9 for Windows. An app may be able to gain elevated privileges. |
|
CVE-2023-34417
CRITICAL 9.8
Memory safety bugs present in Firefox 113. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could h… |
|
CVE-2023-34416
CRITICAL 9.8
Memory safety bugs present in Firefox 113, Firefox ESR 102.11, and Thunderbird 102.12. Some of these bugs showed evidence of memory corruption and we presume t… |
|
CVE-2023-34414
LOW 3.1
The error page for sites with invalid TLS certificates was missing the activation-delay Firefox uses to protect prompts and permission dialogs from attacks tha… |
|
CVE-2023-29545
MEDIUM 6.5
Similar to CVE-2023-28163, this time when choosing 'Save Link As', suggested filenames containing environment variable names would have resolved those in the c… |
|
CVE-2023-29542
CRITICAL 9.8
A newline in a filename could have been used to bypass the file extension security mechanisms that replace malicious file extensions such as .lnk with .downlo… |
|
CVE-2023-32214
HIGH 7.5
Protocol handlers `ms-cxh` and `ms-cxh-full` could have been leveraged to trigger a denial of service. *Note: This attack only affects Windows. Other operating… |
|
CVE-2023-32208
MEDIUM 5.3
Service workers could reveal script base URL due to dynamic `import()`. This vulnerability affects Firefox < 113. |
|
CVE-2023-29532
MEDIUM 5.5
A local attacker can trick the Mozilla Maintenance Service into applying an unsigned update file by pointing the service at an update file on a malicious SMB s… |
|
CVE-2023-29531
CRITICAL 9.8
An attacker could have caused an out of bounds memory access using WebGL APIs, leading to memory corruption and a potentially exploitable crash. *This bug onl… |
|
CVE-2023-33133
HIGH 7.8
Microsoft Excel Remote Code Execution Vulnerability |
|
CVE-2023-33131
HIGH 8.8
Microsoft Outlook Remote Code Execution Vulnerability |
|
CVE-2023-32029
HIGH 7.8
Microsoft Excel Remote Code Execution Vulnerability |
|
CVE-2023-3217
HIGH 8.8
Use after free in WebXR in Google Chrome prior to 114.0.5735.133 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chr… |
|
CVE-2023-3216
HIGH 8.8
Type confusion in V8 in Google Chrome prior to 114.0.5735.133 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromi… |
|
CVE-2023-3215
HIGH 8.8
Use after free in WebRTC in Google Chrome prior to 114.0.5735.133 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Ch… |
|
CVE-2023-3214
HIGH 8.8
Use after free in Autofill payments in Google Chrome prior to 114.0.5735.133 allowed a remote attacker to potentially exploit heap corruption via a crafted HTM… |
Manage your fleet with Appaloosa
Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.