Vulnerabilities
Tracked app vulnerabilities
19,681 CVEs affect a tracked app or OS (all severities, Windows). 303 of them are in the CISA KEV catalog, meaning exploitation is confirmed.
- Matching CVEs
- 19,681
- Actively exploited
- 303
- Publication window
- 1997-01-01 → 2026-10-20
Chronological sort: newest to oldest. Use the KEV / severity filters above to prioritize.
| CVE |
|---|
|
CVE-2021-43883
HIGH · vendor
Windows Installer Elevation of Privilege Vulnerability |
|
CVE-2021-43880
HIGH · vendor
Windows Mobile Device Management Elevation of Privilege Vulnerability |
|
CVE-2021-43248
HIGH · vendor
Windows Digital Media Receiver Elevation of Privilege Vulnerability |
|
CVE-2021-43247
HIGH · vendor
Windows TCP/IP Driver Elevation of Privilege Vulnerability |
|
CVE-2021-43246
HIGH · vendor
Windows Hyper-V Denial of Service Vulnerability |
|
CVE-2021-43244
HIGH · vendor
Windows Kernel Information Disclosure Vulnerability |
|
CVE-2021-43240
HIGH · vendor
NTFS Set Short Name Elevation of Privilege Vulnerability |
|
CVE-2021-43239
HIGH · vendor
Windows Recovery Environment Agent Elevation of Privilege Vulnerability |
|
CVE-2021-43238
HIGH · vendor
Windows Remote Access Elevation of Privilege Vulnerability |
|
CVE-2021-43237
HIGH · vendor
Windows Setup Elevation of Privilege Vulnerability |
|
CVE-2021-43236
HIGH · vendor
Microsoft Message Queuing Information Disclosure Vulnerability |
|
CVE-2021-43235
HIGH · vendor
Storage Spaces Controller Information Disclosure Vulnerability |
|
CVE-2021-43234
HIGH · vendor
Windows Fax Service Remote Code Execution Vulnerability |
|
CVE-2021-43233
CRITICAL · vendor
Remote Desktop Client Remote Code Execution Vulnerability |
|
CVE-2021-43232
HIGH · vendor
Windows Event Tracing Remote Code Execution Vulnerability |
|
CVE-2021-43231
HIGH · vendor
Windows NTFS Elevation of Privilege Vulnerability |
|
CVE-2021-43230
HIGH · vendor
Windows NTFS Elevation of Privilege Vulnerability |
|
CVE-2021-43229
HIGH · vendor
Windows NTFS Elevation of Privilege Vulnerability |
|
CVE-2021-43228
HIGH · vendor
SymCrypt Denial of Service Vulnerability |
|
CVE-2021-43227
HIGH · vendor
Storage Spaces Controller Information Disclosure Vulnerability |
|
CVE-2021-43224
HIGH · vendor
Windows Common Log File System Driver Information Disclosure Vulnerability |
|
CVE-2021-43223
HIGH · vendor
Windows Remote Access Connection Manager Elevation of Privilege Vulnerability |
|
CVE-2021-43222
HIGH · vendor
Microsoft Message Queuing Information Disclosure Vulnerability |
|
CVE-2021-43219
HIGH · vendor
DirectX Graphics Kernel File Denial of Service Vulnerability |
|
CVE-2021-43217
CRITICAL · vendor
Windows Encrypting File System (EFS) Remote Code Execution Vulnerability |
|
CVE-2021-43216
HIGH · vendor
Microsoft Local Security Authority (LSA) Server Information Disclosure Vulnerability |
|
CVE-2021-43215
CRITICAL · vendor
iSNS Server Memory Corruption Vulnerability Can Lead to Remote Code Execution |
|
CVE-2021-43207
HIGH · vendor
Windows Common Log File System Driver Elevation of Privilege Vulnerability |
|
CVE-2021-41333
HIGH · vendor
Windows Print Spooler Elevation of Privilege Vulnerability |
|
CVE-2021-43546
MEDIUM 4.3
It was possible to recreate previous cursor spoofing attacks against users with a zoomed native cursor. This vulnerability affects Thunderbird < 91.4.0, Firefo… |
|
CVE-2021-43545
MEDIUM 6.5
Using the Location API in a loop could have caused severe application hangs and crashes. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0,… |
|
CVE-2021-43543
MEDIUM 6.1
Documents loaded with the CSP sandbox directive could have escaped the sandbox's script restriction by embedding additional content. This vulnerability affects… |
|
CVE-2021-43542
MEDIUM 6.5
Using XMLHttpRequest, an attacker could have identified installed applications by probing error messages for loading external protocols. This vulnerability aff… |
|
CVE-2021-43541
MEDIUM 6.5
When invoking protocol handlers for external protocols, a supplied parameter URL containing spaces was not properly escaped. This vulnerability affects Thunder… |
|
CVE-2021-43539
HIGH 8.8
Failure to correctly record the location of live pointers across wasm instance calls resulted in a GC occurring within the call not tracing those live pointers… |
|
CVE-2021-43538
MEDIUM 4.3
By misusing a race in our notification code, an attacker could have forcefully hidden the notification for pages that had received full screen and pointer lock… |
|
CVE-2021-43537
HIGH 8.8
An incorrect type conversion of sizes from 64bit to 32bit integers allowed an attacker to corrupt memory leading to a potentially exploitable crash. This vulne… |
|
CVE-2021-43536
MEDIUM 6.5
Under certain circumstances, asynchronous functions could have caused a navigation to fail but expose the target URL. This vulnerability affects Thunderbird < … |
|
CVE-2021-43535
HIGH 8.8
A use-after-free could have occured when an HTTP2 session object was released on a different thread, leading to memory corruption and a potentially exploitable… |
|
CVE-2021-43534
HIGH 8.8
Mozilla developers and community members reported memory safety bugs present in Firefox 93 and Firefox ESR 91.2. Some of these bugs showed evidence of memory c… |
|
CVE-2021-43528
MEDIUM 6.5
Thunderbird unexpectedly enabled JavaScript in the composition area. The JavaScript execution context was limited to this area and did not receive chrome-level… |
|
CVE-2021-38510
HIGH 8.8
The executable file warning was not presented when downloading .inetloc files, which, due to a flaw in Mac OS, can run commands on a user's computer.*Note: Thi… |
|
CVE-2021-38509
MEDIUM 4.3
Due to an unusual sequence of attacker-controlled events, a Javascript alert() dialog with arbitrary (although unstyled) contents could be displayed over top a… |
|
CVE-2021-38508
MEDIUM 4.3
By displaying a form validity message in the correct location at the same time as a permission prompt (such as for geolocation), the validity message could hav… |
|
CVE-2021-38507
MEDIUM 6.5
The Opportunistic Encryption feature of HTTP2 (RFC 8164) allows a connection to be transparently upgraded to TLS while retaining the visual properties of an HT… |
|
CVE-2021-38506
MEDIUM 4.3
Through a series of navigations, Firefox could have entered fullscreen mode without notification or warning to the user. This could lead to spoofing attacks on… |
|
CVE-2021-38505
MEDIUM 6.5
Microsoft introduced a new feature in Windows 10 known as Cloud Clipboard which, if enabled, will record data copied to the clipboard to the cloud, and make it… |
|
CVE-2021-38504
HIGH 8.8
When interacting with an HTML input element's file picker dialog with webkitdirectory set, a use-after-free could have resulted, leading to memory corruption a… |
|
CVE-2021-38503
CRITICAL 10.0
The iframe sandbox rules were not correctly applied to XSLT stylesheets, allowing an iframe to bypass restrictions such as executing scripts or navigating the … |
|
CVE-2021-38004
MEDIUM 4.3
Insufficient policy enforcement in Autofill in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
Manage your fleet with Appaloosa
Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.