Vulnerabilities
Tracked app vulnerabilities
12,531 CVEs affect a tracked app or OS (High, Windows). 246 of them are in the CISA KEV catalog, meaning exploitation is confirmed.
- Matching CVEs
- 12,531
- Actively exploited
- 246
- Publication window
- 2004-07-27 → 2026-11-11
Chronological sort: newest to oldest. Use the KEV / severity filters above to prioritize.
| CVE |
|---|
|
CVE-2019-1179
HIGH · vendor
Windows Elevation of Privilege Vulnerability |
|
CVE-2019-1178
HIGH · vendor
Windows Elevation of Privilege Vulnerability |
|
CVE-2019-1177
HIGH · vendor
Windows Elevation of Privilege Vulnerability |
|
CVE-2019-1176
HIGH · vendor
DirectX Elevation of Privilege Vulnerability |
|
CVE-2019-1175
HIGH · vendor
Windows Elevation of Privilege Vulnerability |
|
CVE-2019-1174
HIGH · vendor
Windows Elevation of Privilege Vulnerability |
|
CVE-2019-1173
HIGH · vendor
Windows Elevation of Privilege Vulnerability |
|
CVE-2019-1172
HIGH · vendor
Windows Information Disclosure Vulnerability |
|
CVE-2019-1171
HIGH · vendor
SymCrypt Information Disclosure Vulnerability |
|
CVE-2019-1170
HIGH · vendor
Windows NTFS Elevation of Privilege Vulnerability |
|
CVE-2019-1168
HIGH · vendor
Microsoft Windows p2pimsvc Elevation of Privilege Vulnerability |
|
CVE-2019-1164
HIGH · vendor
Windows Kernel Elevation of Privilege Vulnerability |
|
CVE-2019-1163
HIGH · vendor
Windows File Signature Security Feature Bypass Vulnerability |
|
CVE-2019-1162
HIGH · vendor
Windows ALPC Elevation of Privilege Vulnerability |
|
CVE-2019-1159
HIGH · vendor
Windows Kernel Elevation of Privilege Vulnerability |
|
CVE-2019-1158
HIGH · vendor
Windows Graphics Component Information Disclosure Vulnerability |
|
CVE-2019-1157
HIGH · vendor
Jet Database Engine Remote Code Execution Vulnerability |
|
CVE-2019-1156
HIGH · vendor
Jet Database Engine Remote Code Execution Vulnerability |
|
CVE-2019-1155
HIGH · vendor
Jet Database Engine Remote Code Execution Vulnerability |
|
CVE-2019-1153
HIGH · vendor
Microsoft Graphics Component Information Disclosure Vulnerability |
|
CVE-2019-1148
HIGH · vendor
Microsoft Graphics Component Information Disclosure Vulnerability |
|
CVE-2019-1147
HIGH · vendor
Jet Database Engine Remote Code Execution Vulnerability |
|
CVE-2019-1146
HIGH · vendor
Jet Database Engine Remote Code Execution Vulnerability |
|
CVE-2019-1143
HIGH · vendor
Windows Graphics Component Information Disclosure Vulnerability |
|
CVE-2019-1125
HIGH · vendor
Windows Kernel Information Disclosure Vulnerability |
|
CVE-2019-1078
HIGH · vendor
Microsoft Graphics Component Information Disclosure Vulnerability |
|
CVE-2019-1057
HIGH · vendor
MS XML Remote Code Execution Vulnerability |
|
CVE-2019-0723
HIGH · vendor
Windows Hyper-V Denial of Service Vulnerability |
|
CVE-2019-0718
HIGH · vendor
Windows Hyper-V Denial of Service Vulnerability |
|
CVE-2019-0717
HIGH · vendor
Windows Hyper-V Denial of Service Vulnerability |
|
CVE-2019-0716
HIGH · vendor
Windows Denial of Service Vulnerability |
|
CVE-2019-0715
HIGH · vendor
Windows Hyper-V Denial of Service Vulnerability |
|
CVE-2019-0714
HIGH · vendor
Windows Hyper-V Denial of Service Vulnerability |
|
CVE-2019-5459
HIGH 7.1
An Integer underflow in VLC Media Player versions < 3.0.7 leads to an out-of-band read. |
|
CVE-2019-9818
HIGH 8.3
A race condition is present in the crash generation server used to generate data for the crash reporter. This issue can lead to a use-after-free in the main pr… |
|
CVE-2019-9815
HIGH 8.1
If hyperthreading is not disabled, a timing attack vulnerability exists, similar to previous Spectre attacks. Apple has shipped macOS 10.14.5 with an option to… |
|
CVE-2019-9811
HIGH 8.3
As part of a winning Pwn2Own entry, a researcher demonstrated a sandbox escape by installing a malicious language pack and then opening a browser feature that … |
|
CVE-2019-11729
HIGH 7.5
Empty or malformed p256-ECDH public keys may trigger a segmentation fault due values being improperly sanitized before being copied into memory and used. This … |
|
CVE-2019-11719
HIGH 7.5
When importing a curve25519 private key in PKCS#8format with leading 0x00 bytes, it is possible to trigger an out-of-bounds read in the Network Security Servic… |
|
CVE-2019-11712
HIGH 8.8
POST requests made by NPAPI plugins, such as Flash, that receive a status 308 redirect response can bypass CORS requirements. This can allow an attacker to per… |
|
CVE-2019-11711
HIGH 8.8
When an inner window is reused, it does not consider the use of document.domain for cross-origin protections. If pages on different subdomains ever cooperative… |
|
CVE-2019-11707
HIGH 8.8
KEV
A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow for an exploitable crash. We are aware… |
|
CVE-2019-11706
HIGH 7.5
A flaw in Thunderbird's implementation of iCal causes a type confusion in icaltimezone_get_vtimezone_properties when processing certain email messages, resulti… |
|
CVE-2019-11694
HIGH 7.5
A vulnerability exists in the Windows sandbox where an uninitialized value in memory can be leaked to a renderer from a broker when making a call to access an … |
|
CVE-2019-1130
An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows Elevation of Privileg… |
|
CVE-2019-1111
HIGH 8.8
A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Excel Rem… |
|
CVE-2019-1110
HIGH 8.8
A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Excel Rem… |
|
CVE-2019-1107
HIGH 7.5
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Eng… |
|
CVE-2019-1106
HIGH 7.5
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Eng… |
|
CVE-2019-1104
HIGH 7.5
A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory, aka 'Microsoft Browser Memory Corruption Vulnerabilit… |
Manage your fleet with Appaloosa
Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.