Vulnerabilities
Tracked app vulnerabilities
12,531 CVEs affect a tracked app or OS (High, Windows). 246 of them are in the CISA KEV catalog, meaning exploitation is confirmed.
- Matching CVEs
- 12,531
- Actively exploited
- 246
- Publication window
- 2004-07-27 → 2026-11-11
Chronological sort: newest to oldest. Use the KEV / severity filters above to prioritize.
| CVE |
|---|
|
CVE-2018-8212
HIGH · vendor
Device Guard Code Integrity Policy Security Feature Bypass Vulnerability |
|
CVE-2018-8211
HIGH · vendor
Device Guard Code Integrity Policy Security Feature Bypass Vulnerability |
|
CVE-2018-8210
HIGH · vendor
Windows Remote Code Execution Vulnerability |
|
CVE-2018-8209
HIGH · vendor
Windows Wireless Network Profile Information Disclosure Vulnerability |
|
CVE-2018-8208
HIGH · vendor
Windows Desktop Bridge Elevation of Privilege Vulnerability |
|
CVE-2018-8207
HIGH · vendor
Windows Kernel Information Disclosure Vulnerability |
|
CVE-2018-8205
HIGH · vendor
Windows Denial of Service Vulnerability |
|
CVE-2018-8201
HIGH · vendor
Device Guard Code Integrity Policy Security Feature Bypass Vulnerability |
|
CVE-2018-8175
HIGH · vendor
WEBDAV Denial of Service Vulnerability |
|
CVE-2018-8169
HIGH · vendor
HIDParser Elevation of Privilege Vulnerability |
|
CVE-2018-8140
HIGH · vendor
Cortana Elevation of Privilege Vulnerability |
|
CVE-2018-8121
HIGH · vendor
Windows Kernel Information Disclosure Vulnerability |
|
CVE-2018-1040
HIGH · vendor
Windows Code Integrity Module Denial of Service Vulnerability |
|
CVE-2018-1036
HIGH · vendor
NTFS Elevation of Privilege Vulnerability |
|
CVE-2018-0982
HIGH · vendor
Windows Elevation of Privilege Vulnerability |
|
CVE-2018-5184
HIGH 7.5
Using remote content in encrypted messages can lead to the disclosure of plaintext. This vulnerability affects Thunderbird ESR < 52.8 and Thunderbird < 52.8. |
|
CVE-2018-5178
HIGH 8.1
A buffer overflow was found during UTF8 to Unicode string conversion within JavaScript with extremely large amounts of data. This vulnerability requires the us… |
|
CVE-2018-5174
HIGH 7.5
In the Windows 10 April 2018 Update, Windows Defender SmartScreen honors the "SEE_MASK_FLAG_NO_UI" flag associated with downloaded files and will not show any … |
|
CVE-2018-5162
HIGH 7.5
Plaintext of decrypted emails can leak through the src attribute of remote images, or links. This vulnerability affects Thunderbird ESR < 52.8 and Thunderbird … |
|
CVE-2018-5144
HIGH 7.3
An integer overflow can occur during conversion of text to some Unicode character sets due to an unchecked length parameter. This vulnerability affects Firefox… |
|
CVE-2018-5129
HIGH 8.6
A lack of parameter validation on IPC messages results in a potential out-of-bounds write through malformed IPC messages. This can potentially allow for sandbo… |
|
CVE-2018-5127
HIGH 8.8
A buffer overflow can occur when manipulating the SVG "animatedPathSegList" through script. This results in a potentially exploitable crash. This vulnerability… |
|
CVE-2018-5125
HIGH 8.8
Memory safety bugs were reported in Firefox 58 and Firefox ESR 52.6. Some of these bugs showed evidence of memory corruption and we presume that with enough ef… |
|
CVE-2017-7846
HIGH 8.8
It is possible to execute JavaScript in the parsed RSS feed when RSS feed is viewed as a website, e.g. via "View -> Feed article -> Website" or in the standard… |
|
CVE-2017-7845
HIGH 8.8
A buffer overflow occurs when drawing and validating elements using Direct 3D 9 with the ANGLE graphics library, used for WebGL content. This is due to an inco… |
|
CVE-2017-7814
HIGH 7.8
File downloads encoded with "blob:" and "data:" URL elements bypassed normal file download checks though the Phishing and Malware Protection feature and its bl… |
|
CVE-2017-7807
HIGH 8.1
A mechanism that uses AppCache to hijack a URL in a domain using fallback by serving the files from a sub-path on the domain. This has been addressed by requir… |
|
CVE-2017-7805
HIGH 7.5
During TLS 1.2 exchanges, handshake hashes are generated which point to a message buffer. This saved data is used for later messages but in some cases, the han… |
|
CVE-2017-7804
HIGH 7.5
The destructor function for the "WindowsDllDetourPatcher" class can be re-purposed by malicious code in concert with another vulnerability to write arbitrary d… |
|
CVE-2017-7803
HIGH 7.5
When a page's content security policy (CSP) header contains a "sandbox" directive, other directives are ignored. This results in the incorrect enforcement of C… |
|
CVE-2017-7787
HIGH 7.5
Same-origin policy protections can be bypassed on pages with embedded iframes during page reloads, allowing the iframes to access content on the top level page… |
|
CVE-2017-7765
HIGH 7.5
The "Mark of the Web" was not correctly saved on Windows when files with very long names were downloaded from the Internet. Without the Mark of the Web data, t… |
|
CVE-2017-7755
HIGH 7.8
The Firefox installer on Windows can be made to load malicious DLL files stored in the same directory as the installer when it is run. This allows privileged e… |
|
CVE-2017-7754
HIGH 7.5
An out-of-bounds read in WebGL with a maliciously crafted "ImageInfo" object during WebGL operations. This vulnerability affects Firefox < 54, Firefox ESR < 52… |
|
CVE-2017-7752
HIGH 8.8
A use-after-free vulnerability during specific user interactions with the input method editor (IME) in some languages due to how events are handled. This resul… |
|
CVE-2017-5467
HIGH 7.5
A potential memory corruption and crash when using Skia content when drawing content outside of the bounds of a clipping region. This vulnerability affects Thu… |
|
CVE-2017-5454
HIGH 7.5
A mechanism to bypass file system access protections in the sandbox to use the file picker to access different files than those selected in the file picker thr… |
|
CVE-2017-5449
HIGH 7.5
A possibly exploitable crash triggered during layout and manipulation of bidirectional unicode text in concert with CSS animations. This vulnerability affects … |
|
CVE-2017-5445
HIGH 7.5
A vulnerability while parsing "application/http-index-format" format content where uninitialized values are used to create an array. This could allow the readi… |
|
CVE-2017-5444
HIGH 7.5
A buffer overflow vulnerability while parsing "application/http-index-format" format content when the header contains improperly formatted data. This allows fo… |
|
CVE-2017-5436
HIGH 8.8
An out-of-bounds write in the Graphite 2 library triggered with a maliciously crafted Graphite font. This results in a potentially exploitable crash. This issu… |
|
CVE-2017-5425
HIGH 7.5
The Gecko Media Plugin sandbox allows access to local files that match specific regular expressions. On OS OX, this matching allows access to some data in subd… |
|
CVE-2017-5422
HIGH 7.5
If a malicious site uses the "view-source:" protocol in a series within a single hyperlink, it can trigger a non-exploitable browser crash when the hyperlink i… |
|
CVE-2017-5421
HIGH 7.5
A malicious site could spoof the contents of the print preview window if popup windows are enabled, resulting in user confusion of what site is currently loade… |
|
CVE-2017-5419
HIGH 7.5
If a malicious site repeatedly triggers a modal authentication prompt, eventually the browser UI will become non-responsive, requiring shutdown through the ope… |
|
CVE-2017-5416
HIGH 7.5
In certain circumstances a networking event listener can be prematurely released. This appears to result in a null dereference in practice. This vulnerability … |
|
CVE-2017-5412
HIGH 7.5
A buffer overflow read during SVG filter color value operations, resulting in data exposure. This vulnerability affects Firefox < 52 and Thunderbird < 52. |
|
CVE-2017-5411
HIGH 7.5
A use-after-free can occur during buffer storage operations within the ANGLE graphics library, used for WebGL content. The buffer storage can be freed while st… |
|
CVE-2017-5406
HIGH 7.5
A segmentation fault can occur in the Skia graphics library during some canvas operations due to issues with mask/clip intersection and empty masks. This vulne… |
|
CVE-2017-5378
HIGH 7.5
Hashed codes of JavaScript objects are shared between pages. This allows for pointer leaks because an object's address can be discovered through hash codes, an… |
Manage your fleet with Appaloosa
Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.