Vulnerabilities
Tracked app vulnerabilities
28,052 CVEs affect a tracked app or OS (all severities, all platforms). 374 of them are in the CISA KEV catalog, meaning exploitation is confirmed.
- Matching CVEs
- 28,052
- Actively exploited
- 374
- Publication window
- 1997-01-01 → 2026-10-20
Chronological sort: newest to oldest. Use the KEV / severity filters above to prioritize.
| CVE |
|---|
|
CVE-2024-27823
A race condition was addressed with improved locking. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Monterey 12.7.5, mac… |
|
CVE-2024-27809
MEDIUM 5.5
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sonoma 14.4. An app may be able to access user… |
|
CVE-2024-23261
HIGH 7.5
A logic issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.7.6, macOS Sonoma 14.4, macOS Ventura 13.6.8. An attacker … |
|
CVE-2024-38103
MEDIUM 5.9
Microsoft Edge (Chromium-based) Information Disclosure Vulnerability |
|
CVE-2024-7014
HIGH 8.1
EvilVideo vulnerability allows sending malicious apps disguised as videos in Telegram for Android application affecting versions 10.14.4 and older. |
|
CVE-2024-38156
MEDIUM 6.1
Microsoft Edge (Chromium-based) Spoofing Vulnerability |
|
CVE-2024-5500
MEDIUM 6.5
Inappropriate implementation in Sign-In in Google Chrome prior to 1.3.36.351 allowed a remote attacker to bypass navigation restrictions via a crafted HTML pag… |
|
CVE-2024-3176
HIGH 8.8
Out of bounds write in SwiftShader in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to perform an out of bounds memory write via a crafted HTM… |
|
CVE-2024-3175
MEDIUM 6.3
Insufficient data validation in Extensions in Google Chrome prior to 120.0.6099.62 allowed a remote attacker to perform privilege escalation via a crafted Chro… |
|
CVE-2024-3174
HIGH 8.8
Inappropriate implementation in V8 in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to potentially exploit object corruption via a crafted HT… |
|
CVE-2024-3173
HIGH 8.8
Insufficient data validation in Updater in Google Chrome prior to 120.0.6099.62 allowed a remote attacker to perform OS-level privilege escalation via a malici… |
|
CVE-2024-3172
HIGH 8.8
Insufficient data validation in DevTools in Google Chrome prior to 121.0.6167.85 allowed a remote attacker who convinced a user to engage in specific UI gestur… |
|
CVE-2024-3171
HIGH 8.8
Use after free in Accessibility in Google Chrome prior to 122.0.6261.57 allowed a remote attacker who convinced a user to engage in specific UI gestures to pot… |
|
CVE-2024-3170
HIGH 8.8
Use after free in WebRTC in Google Chrome prior to 121.0.6167.85 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chr… |
|
CVE-2024-3169
HIGH 8.8
Use after free in V8 in Google Chrome prior to 121.0.6167.139 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromi… |
|
CVE-2024-3168
HIGH 8.8
Use after free in DevTools in Google Chrome prior to 122.0.6261.57 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (C… |
|
CVE-2024-2884
MEDIUM 6.5
Out of bounds read in V8 in Google Chrome prior to 121.0.6167.139 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HT… |
|
CVE-2023-7013
MEDIUM 4.7
Inappropriate implementation in Compositing in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to potentially spoof security UI via a crafted H… |
|
CVE-2023-7012
CRITICAL 9.6
Insufficient data validation in Permission Prompts in Google Chrome prior to 117.0.5938.62 allowed an attacker who convinced a user to install a malicious app … |
|
CVE-2023-7011
MEDIUM 6.5
Inappropriate implementation in Picture in Picture in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to spoof the contents of the Omnibox (URL… |
|
CVE-2023-7010
HIGH 8.8
Use after free in WebRTC in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chr… |
|
CVE-2023-4860
CRITICAL 9.6
Inappropriate implementation in Skia in Google Chrome prior to 115.0.5790.98 allowed a remote attacker who had compromised the renderer process to potentially … |
|
CVE-2020-36765
MEDIUM 6.5
Insufficient policy enforcement in Navigation in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to leak cross-origin data via a crafted HTML pag… |
|
CVE-2019-25154
CRITICAL 9.6
Inappropriate implementation in iframe in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to potentially perform a sandbox escape via a crafted H… |
|
CVE-2024-6779
CRITICAL 9.6
Out of bounds memory access in V8 in Google Chrome prior to 126.0.6478.182 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML… |
|
CVE-2024-6778
HIGH 7.5
Race in DevTools in Google Chrome prior to 126.0.6478.182 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML i… |
|
CVE-2024-6777
MEDIUM 6.5
Use after free in Navigation in Google Chrome prior to 126.0.6478.182 allowed an attacker who convinced a user to install a malicious extension to potentially … |
|
CVE-2024-6776
HIGH 8.8
Use after free in Audio in Google Chrome prior to 126.0.6478.182 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chr… |
|
CVE-2024-6775
HIGH 8.8
Use after free in Media Stream in Google Chrome prior to 126.0.6478.182 allowed a remote attacker who convinced a user to engage in specific UI gestures to pot… |
|
CVE-2024-6774
HIGH 8.8
Use after free in Screen Capture in Google Chrome prior to 126.0.6478.182 allowed a remote attacker who convinced a user to engage in specific UI gestures to p… |
|
CVE-2024-6773
HIGH 8.8
Inappropriate implementation in V8 in Google Chrome prior to 126.0.6478.182 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML… |
|
CVE-2024-6772
HIGH 8.8
Inappropriate implementation in V8 in Google Chrome prior to 126.0.6478.182 allowed a remote attacker to perform out of bounds memory access via a crafted HTML… |
|
CVE-2024-38020
MEDIUM 6.5
Microsoft Outlook Spoofing Vulnerability |
|
CVE-2024-6615
HIGH · vendor
Memory safety bugs present in Firefox 127 and Thunderbird 127. Some of these bugs showed evidence of memory corruption and we presume that with enough effort s… |
|
CVE-2024-6614
MEDIUM · vendor
The frame iterator could get stuck in a loop when encountering certain wasm frames leading to incorrect stack traces. This vulnerability affects Firefox < 128 … |
|
CVE-2024-6613
MEDIUM · vendor
The frame iterator could get stuck in a loop when encountering certain wasm frames leading to incorrect stack traces. This vulnerability affects Firefox < 128 … |
|
CVE-2024-6612
MEDIUM · vendor
CSP violations generated links in the console tab of the developer tools, pointing to the violating resource. This caused a DNS prefetch which leaked that a CS… |
|
CVE-2024-6611
CRITICAL · vendor
A nested iframe, triggering a cross-site navigation, could send SameSite=Strict or Lax cookies. This vulnerability affects Firefox < 128 and Thunderbird < 128. |
|
CVE-2024-6610
MEDIUM · vendor
Form validation popups could capture escape key presses. Therefore, spamming form validation messages could be used to prevent users from exiting full-screen m… |
|
CVE-2024-6609
HIGH 8.8
When almost out-of-memory an elliptic curve key which was never allocated could have been freed again. This vulnerability affects Firefox < 128 and Thunderbird… |
|
CVE-2024-6608
MEDIUM · vendor
It was possible to move the cursor using pointerlock from an iframe. This allowed moving the cursor outside of the viewport and the Firefox window. This vulner… |
|
CVE-2024-6607
HIGH 8.8
It was possible to prevent a user from exiting pointerlock when pressing escape and to overlay customValidity notifications from a `<select>` element ove… |
|
CVE-2024-6606
CRITICAL · vendor
Clipboard code failed to check the index on an array access. This could have led to an out-of-bounds read. This vulnerability affects Firefox < 128 and Thunder… |
|
CVE-2024-6604
HIGH · vendor
Memory safety bugs present in Firefox 127, Firefox ESR 115.12, and Thunderbird 115.12. Some of these bugs showed evidence of memory corruption and we presume t… |
|
CVE-2024-6603
MEDIUM · vendor
In an out-of-memory scenario an allocation could fail but free would have been called on the pointer afterwards leading to memory corruption. This vulnerabilit… |
|
CVE-2024-6602
CRITICAL 9.8
A mismatch between allocator and deallocator could have led to memory corruption. This vulnerability affects Firefox < 128, Firefox ESR < 115.13, Thunderbird <… |
|
CVE-2024-6601
MEDIUM · vendor
A race condition could lead to a cross-origin container obtaining permissions of the top-level origin. This vulnerability affects Firefox < 128, Firefox ESR < … |
|
CVE-2024-6600
MEDIUM 6.3
Due to large allocation checks in Angle for GLSL shaders being too lenient an out-of-bounds access could occur when allocating more than 8192 ints in private s… |
|
CVE-2024-3596
CRITICAL 9.0
RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access… |
|
CVE-2024-39684
MEDIUM · vendor
Github: CVE-2024-39684 TenCent RapidJSON Elevation of Privilege Vulnerability |
Manage your fleet with Appaloosa
Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.