Vulnerabilities
Tracked app vulnerabilities
1,721 CVEs affect a tracked app or OS (Critical, Windows). 37 of them are in the CISA KEV catalog, meaning exploitation is confirmed.
- Matching CVEs
- 1,721
- Actively exploited
- 37
- Publication window
- 2007-08-28 → 2026-11-10
Chronological sort: newest to oldest. Use the KEV / severity filters above to prioritize.
| CVE |
|---|
|
CVE-2022-46882
CRITICAL 9.8
A use-after-free in WebGL extensions could have led to a potentially exploitable crash. This vulnerability affects Firefox < 107, Firefox ESR < 102.6, and Thun… |
|
CVE-2022-45406
CRITICAL 9.8
If an out-of-memory condition occurred when creating a JavaScript global, a JavaScript realm may be deleted while references to it lived on in a BaseShape. Thi… |
|
CVE-2022-34470
CRITICAL 9.8
Session history navigations may have led to a use-after-free and potentially exploitable crash. This vulnerability affects Firefox < 102, Firefox ESR < 91.11, … |
|
CVE-2022-31747
CRITICAL 9.8
Mozilla developers Andrew McCreight, Nicolas B. Pierron, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 100 and Firefox ESR 91.9. … |
|
CVE-2022-31737
CRITICAL 9.8
A malicious webpage could have caused an out-of-bounds write in WebGL, leading to memory corruption and a potentially exploitable crash. This vulnerability aff… |
|
CVE-2022-31736
CRITICAL 9.8
A malicious website could have learned the size of a cross-origin resource that supported Range requests. This vulnerability affects Thunderbird < 91.10, Firef… |
|
CVE-2022-29917
CRITICAL 9.8
Mozilla developers Andrew McCreight, Gabriele Svelto, Tom Ritter and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 99 and Firefox ESR… |
|
CVE-2022-26384
CRITICAL 9.6
If an attacker could control the contents of an iframe sandboxed with <code>allow-popups</code> but not <code>allow-scripts</code>, they were able to craft a l… |
|
CVE-2022-22759
CRITICAL 9.6
If a document created a sandboxed iframe without <code>allow-scripts</code>, and subsequently appended an element to the iframe's document that e.g. had a Java… |
|
CVE-2021-4140
CRITICAL 10.0
It was possible to construct specific XSLT markup that would be able to bypass an iframe sandbox. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, … |
|
CVE-2021-4129
CRITICAL 9.8
Mozilla developers and community members Julian Hector, Randell Jesup, Gabriele Svelto, Tyson Smith, Christian Holler, and Masayuki Nakano reported memory safe… |
|
CVE-2021-4127
CRITICAL 9.8
An out of date graphics library (Angle) likely contained vulnerabilities that could potentially be exploited. This vulnerability affects Thunderbird < 78.9 and… |
|
CVE-2022-44676
CRITICAL · vendor
Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability |
|
CVE-2022-44670
CRITICAL · vendor
Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability |
|
CVE-2022-41076
CRITICAL · vendor
PowerShell Remote Code Execution Vulnerability |
|
CVE-2022-4135
CRITICAL 9.6
KEV
Heap buffer overflow in GPU in Google Chrome prior to 107.0.5304.121 allowed a remote attacker who had compromised the renderer process to potentially perform … |
|
CVE-2022-37454
CRITICAL 9.8
The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary … |
|
CVE-2022-41081
CRITICAL · vendor
Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability |
|
CVE-2022-38047
CRITICAL · vendor
Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability |
|
CVE-2022-38000
CRITICAL · vendor
Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability |
|
CVE-2022-37979
CRITICAL · vendor
Windows Hyper-V Elevation of Privilege Vulnerability |
|
CVE-2022-37976
CRITICAL · vendor
Active Directory Certificate Services Elevation of Privilege Vulnerability |
|
CVE-2022-34689
CRITICAL · vendor
Windows CryptoAPI Spoofing Vulnerability |
|
CVE-2022-33634
CRITICAL · vendor
Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability |
|
CVE-2022-30198
CRITICAL · vendor
Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability |
|
CVE-2022-24504
CRITICAL · vendor
Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability |
|
CVE-2022-22035
CRITICAL · vendor
Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability |
|
CVE-2022-3075
CRITICAL 9.6
KEV
Insufficient data validation in Mojo in Google Chrome prior to 105.0.5195.102 allowed a remote attacker who had compromised the renderer process to potentially… |
|
CVE-2022-34718
CRITICAL 9.8
Windows TCP/IP Remote Code Execution Vulnerability |
|
CVE-2022-37958
CRITICAL · vendor
SPNEGO Extended Negotiation (NEGOEX) Security Mechanism Remote Code Execution Vulnerability |
|
CVE-2022-34722
CRITICAL · vendor
Windows Internet Key Exchange (IKE) Protocol Extensions Remote Code Execution Vulnerability |
|
CVE-2022-34721
CRITICAL · vendor
Windows Internet Key Exchange (IKE) Protocol Extensions Remote Code Execution Vulnerability |
|
CVE-2022-2587
CRITICAL 9.8
Out of bounds write in Chrome OS Audio Server in Google Chrome on Chrome OS prior to 102.0.5005.125 allowed a remote attacker to potentially exploit heap corru… |
|
CVE-2022-35804
CRITICAL · vendor
SMB Client and Server Remote Code Execution Vulnerability |
|
CVE-2022-35794
CRITICAL · vendor
Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability |
|
CVE-2022-35767
CRITICAL · vendor
Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability |
|
CVE-2022-35766
CRITICAL · vendor
Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability |
|
CVE-2022-35753
CRITICAL · vendor
Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability |
|
CVE-2022-35752
CRITICAL · vendor
Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability |
|
CVE-2022-35745
CRITICAL · vendor
Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability |
|
CVE-2022-35744
CRITICAL · vendor
Windows Point-to-Point Protocol (PPP) Remote Code Execution Vulnerability |
|
CVE-2022-34714
CRITICAL · vendor
Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability |
|
CVE-2022-34702
CRITICAL · vendor
Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability |
|
CVE-2022-34696
CRITICAL · vendor
Windows Hyper-V Remote Code Execution Vulnerability |
|
CVE-2022-34691
CRITICAL · vendor
Active Directory Domain Services Elevation of Privilege Vulnerability |
|
CVE-2022-30133
CRITICAL · vendor
Windows Point-to-Point Protocol (PPP) Remote Code Execution Vulnerability |
|
CVE-2022-2010
CRITICAL 9.3
Out of bounds read in compositing in Google Chrome prior to 102.0.5005.115 allowed a remote attacker who had compromised the renderer process to potentially pe… |
|
CVE-2022-1853
CRITICAL 9.6
Use after free in Indexed DB in Google Chrome prior to 102.0.5005.61 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. |
|
CVE-2022-1312
CRITICAL 9.6
Use after free in storage in Google Chrome prior to 100.0.4896.88 allowed an attacker who convinced a user to install a malicious extension to potentially perf… |
|
CVE-2022-1309
CRITICAL 9.6
Insufficient policy enforcement in developer tools in Google Chrome prior to 100.0.4896.88 allowed a remote attacker to potentially perform a sandbox escape vi… |
Manage your fleet with Appaloosa
Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.