Vulnerabilities
Tracked app vulnerabilities
19,685 CVEs affect a tracked app or OS (all severities, Windows). 303 of them are in the CISA KEV catalog, meaning exploitation is confirmed.
- Matching CVEs
- 19,685
- Actively exploited
- 303
- Publication window
- 1997-01-01 → 2026-10-20
Chronological sort: newest to oldest. Use the KEV / severity filters above to prioritize.
| CVE |
|---|
|
CVE-2021-38505
MEDIUM 6.5
Microsoft introduced a new feature in Windows 10 known as Cloud Clipboard which, if enabled, will record data copied to the clipboard to the cloud, and make it… |
|
CVE-2021-38504
HIGH 8.8
When interacting with an HTML input element's file picker dialog with webkitdirectory set, a use-after-free could have resulted, leading to memory corruption a… |
|
CVE-2021-38503
CRITICAL 10.0
The iframe sandbox rules were not correctly applied to XSLT stylesheets, allowing an iframe to bypass restrictions such as executing scripts or navigating the … |
|
CVE-2021-38004
MEDIUM 4.3
Insufficient policy enforcement in Autofill in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
|
CVE-2021-38003
HIGH 8.8
KEV
Inappropriate implementation in V8 in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML p… |
|
CVE-2021-38002
CRITICAL 9.6
Use after free in Web Transport in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML pag… |
|
CVE-2021-38001
HIGH 8.8
Type confusion in V8 in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
|
CVE-2021-38000
MEDIUM 6.1
KEV
Insufficient validation of untrusted input in Intents in Google Chrome on Android prior to 95.0.4638.69 allowed a remote attacker to arbitrarily browser to a m… |
|
CVE-2021-37999
MEDIUM 6.1
Insufficient data validation in New Tab Page in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to inject arbitrary scripts or HTML in a new brow… |
|
CVE-2021-37998
HIGH 8.8
Use after free in Garbage Collection in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML… |
|
CVE-2021-37997
HIGH 8.8
Use after free in Sign-In in Google Chrome prior to 95.0.4638.69 allowed a remote attacker who convinced a user to sign into Chrome to potentially exploit heap… |
|
CVE-2021-42296
HIGH 7.8
Microsoft Word Remote Code Execution Vulnerability |
|
CVE-2021-42292
HIGH 7.8
KEV
Microsoft Excel Security Feature Bypass Vulnerability |
|
CVE-2021-42291
HIGH 7.5
Active Directory Domain Services Elevation of Privilege Vulnerability |
|
CVE-2021-42288
MEDIUM 5.7
Windows Hello Security Feature Bypass Vulnerability |
|
CVE-2021-42287
Active Directory Domain Services Elevation of Privilege Vulnerability |
|
CVE-2021-42286
HIGH 7.8
Windows Core Shell SI Host Extension Framework for Composable Shell Elevation of Privilege Vulnerability |
|
CVE-2021-42285
HIGH 7.8
Windows Kernel Elevation of Privilege Vulnerability |
|
CVE-2021-42284
MEDIUM 6.8
Windows Hyper-V Denial of Service Vulnerability |
|
CVE-2021-42283
HIGH 8.8
NTFS Elevation of Privilege Vulnerability |
|
CVE-2021-42282
HIGH 7.5
Active Directory Domain Services Elevation of Privilege Vulnerability |
|
CVE-2021-42280
MEDIUM 5.5
Windows Feedback Hub Elevation of Privilege Vulnerability |
|
CVE-2021-42279
MEDIUM 4.2
Chakra Scripting Engine Memory Corruption Vulnerability |
|
CVE-2021-42278
Active Directory Domain Services Elevation of Privilege Vulnerability |
|
CVE-2021-42277
MEDIUM 5.5
Diagnostics Hub Standard Collector Elevation of Privilege Vulnerability |
|
CVE-2021-42276
HIGH 7.8
Microsoft Windows Media Foundation Remote Code Execution Vulnerability |
|
CVE-2021-42275
HIGH 8.8
Microsoft COM for Windows Remote Code Execution Vulnerability |
|
CVE-2021-42274
MEDIUM 6.8
Windows Hyper-V Discrete Device Assignment (DDA) Denial of Service Vulnerability |
|
CVE-2021-41379
Windows Installer Elevation of Privilege Vulnerability |
|
CVE-2021-41378
HIGH 7.8
Windows NTFS Remote Code Execution Vulnerability |
|
CVE-2021-41377
HIGH 7.8
Windows Fast FAT File System Driver Elevation of Privilege Vulnerability |
|
CVE-2021-41371
MEDIUM 4.4
Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability |
|
CVE-2021-41370
HIGH 7.8
NTFS Elevation of Privilege Vulnerability |
|
CVE-2021-41368
MEDIUM 6.1
Microsoft Access Remote Code Execution Vulnerability |
|
CVE-2021-41367
HIGH 7.8
NTFS Elevation of Privilege Vulnerability |
|
CVE-2021-41366
HIGH 7.8
Credential Security Support Provider Protocol (CredSSP) Elevation of Privilege Vulnerability |
|
CVE-2021-41356
HIGH 7.5
Windows Denial of Service Vulnerability |
|
CVE-2021-41351
MEDIUM 4.3
Microsoft Edge (Chrome based) Spoofing on IE Mode |
|
CVE-2021-40442
HIGH 7.8
Microsoft Excel Remote Code Execution Vulnerability |
|
CVE-2021-38666
HIGH 8.8
Remote Desktop Client Remote Code Execution Vulnerability |
|
CVE-2021-38665
HIGH 7.4
Remote Desktop Protocol Client Information Disclosure Vulnerability |
|
CVE-2021-38631
MEDIUM 4.4
Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability |
|
CVE-2021-36957
HIGH 7.8
Windows Desktop Bridge Elevation of Privilege Vulnerability |
|
CVE-2021-26443
CRITICAL 9.0
Microsoft Virtual Machine Bus (VMBus) Remote Code Execution Vulnerability |
|
CVE-2021-38502
MEDIUM 5.9
Thunderbird ignored the configuration to require STARTTLS security for an SMTP connection. A MITM could perform a downgrade attack to intercept transmitted mes… |
|
CVE-2021-38501
HIGH 8.8
Mozilla developers reported memory safety bugs present in Firefox 92 and Firefox ESR 91.1. Some of these bugs showed evidence of memory corruption and we presu… |
|
CVE-2021-38500
HIGH 8.8
Mozilla developers reported memory safety bugs present in Firefox 92 and Firefox ESR 91.1. Some of these bugs showed evidence of memory corruption and we presu… |
|
CVE-2021-38498
HIGH 7.5
During process shutdown, a document could have caused a use-after-free of a languages service object, leading to memory corruption and a potentially exploitabl… |
|
CVE-2021-38497
MEDIUM 6.5
Through use of reportValidity() and window.open(), a plain-text validation message could have been overlaid on another origin, leading to possible user confusi… |
|
CVE-2021-38496
HIGH 8.8
During operations on MessageTasks, a task may have been removed while it was still scheduled, resulting in memory corruption and a potentially exploitable cras… |
Manage your fleet with Appaloosa
Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.