Vulnerabilities
Tracked app vulnerabilities
12,531 CVEs affect a tracked app or OS (High, Windows). 246 of them are in the CISA KEV catalog, meaning exploitation is confirmed.
- Matching CVEs
- 12,531
- Actively exploited
- 246
- Publication window
- 2004-07-27 → 2026-11-11
Chronological sort: newest to oldest. Use the KEV / severity filters above to prioritize.
| CVE |
|---|
|
CVE-2016-9905
HIGH 8.8
A potentially exploitable crash in "EnumerateSubDocuments" while adding or removing sub-documents. This vulnerability affects Firefox ESR < 45.6 and Thunderbir… |
|
CVE-2016-9904
HIGH 7.5
An attacker could use a JavaScript Map/Set timing attack to determine whether an atom is used by another compartment/zone in specific contexts. This could be u… |
|
CVE-2016-9900
HIGH 7.5
External resources that should be blocked when loaded by SVG images can bypass security restrictions through the use of "data:" URLs. This could allow for cros… |
|
CVE-2016-9897
HIGH 7.5
Memory corruption resulting in a potentially exploitable crash during WebGL functions using a vector constructor with a varying array within libGLES. This vuln… |
|
CVE-2016-9079
HIGH 7.5
KEV
A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been discovered in the wild targeting Firefox a… |
|
CVE-2016-9066
HIGH 7.5
A buffer overflow resulting in a potentially exploitable crash due to memory allocation issues when handling large amounts of incoming data. This vulnerability… |
|
CVE-2016-5296
HIGH 7.5
A heap-buffer-overflow in Cairo when processing SVG content caused by compiler optimization, resulting in a potentially exploitable crash. This vulnerability a… |
|
CVE-2018-11235
HIGH 7.8
In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, remote code execution can occur. With a craft… |
|
CVE-2018-11233
HIGH 7.5
In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, code to sanity-check pathnames on NTFS can re… |
|
CVE-2018-8179
HIGH 7.5
A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory Corruption Vulnerability." T… |
|
CVE-2018-8178
HIGH 7.5
A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory, aka "Microsoft Browser Memory Corruption Vulnerabilit… |
|
CVE-2018-8177
HIGH 7.5
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Eng… |
|
CVE-2018-8174
A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows VBScript Engine Remote Code Execution … |
|
CVE-2018-8162
HIGH 7.8
A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka "Microsoft Excel Rem… |
|
CVE-2018-8161
HIGH 7.8
A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory, aka "Microsoft Office R… |
|
CVE-2018-8148
HIGH 7.8
A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka "Microsoft Excel Rem… |
|
CVE-2018-8147
HIGH 7.8
A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka "Microsoft Excel Rem… |
|
CVE-2018-8145
HIGH 7.5
An information disclosure vulnerability exists when Chakra improperly discloses the contents of its memory, which could provide an attacker with information to… |
|
CVE-2018-8139
HIGH 7.5
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka "Scripting Engine Memory Cor… |
|
CVE-2018-8137
HIGH 7.5
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka "Scripting Engine Memory Cor… |
|
CVE-2018-8133
HIGH 7.5
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Eng… |
|
CVE-2018-8130
HIGH 7.5
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Eng… |
|
CVE-2018-8128
HIGH 7.5
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka "Scripting Engine Memory Cor… |
|
CVE-2018-1022
HIGH 7.5
A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka "Scripting Engine Memory Corr… |
|
CVE-2018-0954
HIGH 7.5
A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka "Scripting Engine Memory Corr… |
|
CVE-2018-0953
HIGH 7.5
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka "Scripting Engine Memory Cor… |
|
CVE-2018-0951
HIGH 7.5
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka "Scripting Engine Memory Cor… |
|
CVE-2018-0946
HIGH 7.5
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka "Scripting Engine Memory Cor… |
|
CVE-2018-0945
HIGH 7.5
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka "Scripting Engine Memory Cor… |
|
CVE-2018-0943
HIGH 7.5
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Eng… |
|
CVE-2018-8897
HIGH · vendor
Windows Kernel Elevation of Privilege Vulnerability |
|
CVE-2018-8170
HIGH · vendor
Windows Image Elevation of Privilege Vulnerability |
|
CVE-2018-8167
HIGH · vendor
Windows Common Log File System Driver Elevation of Privilege Vulnerability |
|
CVE-2018-8166
HIGH · vendor
Win32k Elevation of Privilege Vulnerability |
|
CVE-2018-8165
HIGH · vendor
DirectX Graphics Kernel Elevation of Privilege Vulnerability |
|
CVE-2018-8164
HIGH · vendor
Win32k Elevation of Privilege Vulnerability |
|
CVE-2018-8142
HIGH · vendor
Windows Security Feature Bypass Vulnerability |
|
CVE-2018-8141
HIGH · vendor
Windows Kernel Information Disclosure Vulnerability |
|
CVE-2018-8134
HIGH · vendor
Windows Elevation of Privilege Vulnerability |
|
CVE-2018-8132
HIGH · vendor
Windows Security Feature Bypass Vulnerability |
|
CVE-2018-8129
HIGH · vendor
Windows Security Feature Bypass Vulnerability |
|
CVE-2018-8127
HIGH · vendor
Windows Kernel Information Disclosure Vulnerability |
|
CVE-2018-8124
HIGH · vendor
Win32k Elevation of Privilege Vulnerability |
|
CVE-2018-0958
HIGH · vendor
Windows Security Feature Bypass Vulnerability |
|
CVE-2018-0854
HIGH · vendor
Windows Security Feature Bypass Vulnerability |
|
CVE-2018-0824
Microsoft COM for Windows Remote Code Execution Vulnerability |
|
CVE-2018-10115
HIGH 7.8
Incorrect initialization logic of RAR decoder objects in 7-Zip 18.03 and before can lead to usage of uninitialized memory, allowing remote attackers to cause a… |
|
CVE-2018-10172
HIGH 8.8
7-Zip through 18.01 on Windows implements the "Large memory pages" option by calling the LsaAddAccountRights function to add the SeLockMemoryPrivilege privileg… |
|
CVE-2018-1029
HIGH 7.8
A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka "Microsoft Excel Rem… |
|
CVE-2018-1027
HIGH 7.8
A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka "Microsoft Excel Rem… |
Manage your fleet with Appaloosa
Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.