Vulnerabilities

Tracked app vulnerabilities

12,531 CVEs affect a tracked app or OS (High, Windows). 246 of them are in the CISA KEV catalog, meaning exploitation is confirmed.

Matching CVEs: 12,531
Actively exploited: 246
Publication window: 2004-07-27 → 2026-11-11

All CVEs 12,531 CISA KEV 246 Public exploit 358 All severities Critical High Medium Low Hide N/A

All platforms iOS Android macOS Windows

Chronological sort: newest to oldest. Use the KEV / severity filters above to prioritize.

12,531 entries High Windows Clear all

CVE	Severity	KEV	Apps	Published
CVE-2018-18354 HIGH 8.8 2018-12-11 Insufficient validate of external protocols in Shell Integration in Google Chrome on Windows prior to 71.0.3578.80 allowed a remote attacker to launch external…	HIGH 8.8	—		2018-12-11
CVE-2018-18347 HIGH 8.8 2018-12-11 Incorrect handling of failed navigations with invalid URLs in Navigation in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to trick a user into …	HIGH 8.8	—		2018-12-11
CVE-2018-18343 HIGH 8.8 2018-12-11 Incorrect handing of paths leading to a use after free in Skia in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap cor…	HIGH 8.8	—		2018-12-11
CVE-2018-18342 HIGH 8.8 2018-12-11 Execution of user supplied Javascript during object deserialization can update object length leading to an out of bounds write in V8 in Google Chrome prior to …	HIGH 8.8	—		2018-12-11
CVE-2018-18341 HIGH 8.8 2018-12-11 An integer overflow leading to a heap buffer overflow in Blink in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap cor…	HIGH 8.8	—		2018-12-11
CVE-2018-18340 HIGH 8.8 2018-12-11 Incorrect object lifecycle in MediaRecorder in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a craft…	HIGH 8.8	—		2018-12-11
CVE-2018-18339 HIGH 8.8 2018-12-11 Incorrect object lifecycle in WebAudio in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HT…	HIGH 8.8	—		2018-12-11
CVE-2018-18338 HIGH 8.8 2018-12-11 Incorrect, thread-unsafe use of SkImage in Canvas in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a…	HIGH 8.8	—		2018-12-11
CVE-2018-18337 HIGH 8.8 2018-12-11 Incorrect handling of stylesheets leading to a use after free in Blink in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit …	HIGH 8.8	—		2018-12-11
CVE-2018-18336 HIGH 8.8 2018-12-11 Incorrect object lifecycle in PDFium in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF …	HIGH 8.8	—		2018-12-11
CVE-2018-18335 HIGH 8.8 2018-12-11 Heap buffer overflow in Skia in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.	HIGH 8.8	—		2018-12-11
CVE-2018-17481 HIGH 8.8 2018-12-11 Incorrect object lifecycle handling in PDFium in Google Chrome prior to 71.0.3578.98 allowed a remote attacker to potentially exploit heap corruption via a cra…	HIGH 8.8	—		2018-12-11
CVE-2018-17480 HIGH 8.8 2018-12-11 Execution of user supplied Javascript during array deserialization leading to an out of bounds write in V8 in Google Chrome prior to 71.0.3578.80 allowed a rem…	HIGH 8.8	—		2018-12-11
CVE-2018-8649 HIGH · vendor Windows 2018-12-11 Windows Denial of Service Vulnerability	HIGH · vendor	—	Windows	2018-12-11
CVE-2018-8641 HIGH · vendor Windows 2018-12-11 Win32k Elevation of Privilege Vulnerability	HIGH · vendor	—	Windows	2018-12-11
CVE-2018-8639 HIGH · vendor KEV Windows 2018-12-11 Win32k Elevation of Privilege Vulnerability	HIGH · vendor	KEV	Windows	2018-12-11
CVE-2018-8638 HIGH · vendor Windows 2018-12-11 DirectX Information Disclosure Vulnerability	HIGH · vendor	—	Windows	2018-12-11
CVE-2018-8637 HIGH · vendor Windows 2018-12-11 Win32k Information Disclosure Vulnerability	HIGH · vendor	—	Windows	2018-12-11
CVE-2018-8612 HIGH · vendor Windows 2018-12-11 Connected User Experiences and Telemetry Service Denial of Service Vulnerability	HIGH · vendor	—	Windows	2018-12-11
CVE-2018-8611 HIGH · vendor KEV Windows 2018-12-11 Windows Kernel Elevation of Privilege Vulnerability	HIGH · vendor	KEV	Windows	2018-12-11
CVE-2018-8599 HIGH · vendor Windows 2018-12-11 Diagnostics Hub Standard Collector Service Elevation of Privilege Vulnerability	HIGH · vendor	—	Windows	2018-12-11
CVE-2018-8596 HIGH · vendor Windows 2018-12-11 Windows GDI Information Disclosure Vulnerability	HIGH · vendor	—	Windows	2018-12-11
CVE-2018-8595 HIGH · vendor Windows 2018-12-11 Windows GDI Information Disclosure Vulnerability	HIGH · vendor	—	Windows	2018-12-11
CVE-2018-8514 HIGH · vendor Windows 2018-12-11 Windows Remote Procedure Call Information Disclosure Vulnerability	HIGH · vendor	—	Windows	2018-12-11
CVE-2018-8477 HIGH · vendor Windows 2018-12-11 Windows Kernel Information Disclosure Vulnerability	HIGH · vendor	—	Windows	2018-12-11
CVE-2018-6101 HIGH 7.5 2018-12-04 A lack of host validation in DevTools in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code via a crafted HTML page, if t…	HIGH 7.5	—		2018-12-04
CVE-2018-6094 HIGH 8.8 2018-12-04 Inline metadata in GarbageCollection in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to potentially exploit heap corruption via a crafted HTM…	HIGH 8.8	—		2018-12-04
CVE-2018-6092 HIGH 8.8 2018-12-04 An integer overflow on 32-bit systems in WebAssembly in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code inside a sandb…	HIGH 8.8	—		2018-12-04
CVE-2018-6090 HIGH 8.8 2018-12-04 An integer overflow that lead to a heap buffer-overflow in Skia in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code ins…	HIGH 8.8	—		2018-12-04
CVE-2018-6088 HIGH 8.8 2018-12-04 An iterator-invalidation bug in PDFium in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code inside a sandbox via a craft…	HIGH 8.8	—		2018-12-04
CVE-2018-6087 HIGH 8.8 2018-12-04 A use-after-free in WebAssembly in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML…	HIGH 8.8	—		2018-12-04
CVE-2018-6086 HIGH 8.8 2018-12-04 A double-eviction in the Incognito mode cache that lead to a user-after-free in Networking Disk Cache in Google Chrome prior to 66.0.3359.117 allowed a remote …	HIGH 8.8	—		2018-12-04
CVE-2018-6085 HIGH 8.8 2018-12-04 Re-entry of a destructor in Networking Disk Cache in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code via a crafted HTM…	HIGH 8.8	—		2018-12-04
CVE-2018-6083 HIGH 8.8 2018-11-14 Failure to disallow PWA installation from CSP sandboxed pages in AppManifest in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to access privil…	HIGH 8.8	—		2018-11-14
CVE-2018-6074 HIGH 8.8 2018-11-14 Failure to apply Mark-of-the-Web in Downloads in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to bypass OS level controls via a crafted HTML …	HIGH 8.8	—		2018-11-14
CVE-2018-6073 HIGH 8.8 2018-11-14 A heap buffer overflow in WebGL in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML p…	HIGH 8.8	—		2018-11-14
CVE-2018-6072 HIGH 8.8 2018-11-14 An integer overflow leading to use after free in PDFium in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to potentially exploit heap corruptio…	HIGH 8.8	—		2018-11-14
CVE-2018-6071 HIGH 8.8 2018-11-14 An integer overflow in Skia in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.	HIGH 8.8	—		2018-11-14
CVE-2018-6067 HIGH 8.8 2018-11-14 Incorrect IPC serialization in Skia in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML…	HIGH 8.8	—		2018-11-14
CVE-2018-6065 HIGH 8.8 2018-11-14 Integer overflow in computing the required allocation size when instantiating a new javascript object in V8 in Google Chrome prior to 65.0.3325.146 allowed a r…	HIGH 8.8	—		2018-11-14
CVE-2018-6064 HIGH 8.8 2018-11-14 Type Confusion in the implementation of __defineGetter__ in V8 in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to potentially exploit heap co…	HIGH 8.8	—		2018-11-14
CVE-2018-6063 HIGH 8.8 2018-11-14 Incorrect use of mojo::WrapSharedMemoryHandle in Mojo in Google Chrome prior to 65.0.3325.146 allowed a remote attacker who had compromised the renderer proces…	HIGH 8.8	—		2018-11-14
CVE-2018-6062 HIGH 8.8 2018-11-14 Heap overflow write in Skia in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page.	HIGH 8.8	—		2018-11-14
CVE-2018-6061 HIGH 7.5 2018-11-14 A race in the handling of SharedArrayBuffers in WebAssembly in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to potentially exploit heap corru…	HIGH 7.5	—		2018-11-14
CVE-2018-6060 HIGH 8.8 2018-11-14 Use after free in WebAudio in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.	HIGH 8.8	—		2018-11-14
CVE-2018-6057 HIGH 8.8 2018-11-14 Lack of special casing of Android ashmem in Google Chrome prior to 65.0.3325.146 allowed a remote attacker who had compromised the renderer process to bypass i…	HIGH 8.8	—		2018-11-14
CVE-2018-17474 HIGH 8.8 2018-11-14 Use after free in HTMLImportsController in Blink in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to potentially exploit heap corruption via a …	HIGH 8.8	—		2018-11-14
CVE-2018-17469 HIGH 8.8 2018-11-14 Incorrect handling of PDF filter chains in PDFium in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to perform an out of bounds memory read via …	HIGH 8.8	—		2018-11-14
CVE-2018-17466 HIGH 8.8 2018-11-14 Incorrect texture handling in Angle in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML…	HIGH 8.8	—		2018-11-14
CVE-2018-17465 HIGH 8.8 2018-11-14 Incorrect implementation of object trimming in V8 in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to potentially exploit object corruption via…	HIGH 8.8	—		2018-11-14

Manage your fleet with Appaloosa

Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.

Discover Appaloosa MDM