Vulnerabilities
Tracked app vulnerabilities
12,531 CVEs affect a tracked app or OS (High, Windows). 246 of them are in the CISA KEV catalog, meaning exploitation is confirmed.
- Matching CVEs
- 12,531
- Actively exploited
- 246
- Publication window
- 2004-07-27 → 2026-11-11
Chronological sort: newest to oldest. Use the KEV / severity filters above to prioritize.
| CVE |
|---|
|
CVE-2016-3272
HIGH · vendor
Windows Kernel Information Disclosure Vulnerability |
|
CVE-2016-3258
HIGH · vendor
Windows File System Security Feature Bypass Vulnerability |
|
CVE-2016-3256
HIGH · vendor
Windows Secure Kernel Mode Information Disclosure Vulnerability |
|
CVE-2016-3254
HIGH · vendor
Windows Kernel Elevation of Privilege Vulnerability |
|
CVE-2016-3252
HIGH · vendor
Windows Kernel Elevation of Privilege Vulnerability |
|
CVE-2016-3251
HIGH · vendor
Windows GDI Information Disclosure Vulnerability |
|
CVE-2016-3250
HIGH · vendor
Windows Kernel Elevation of Privilege Vulnerability |
|
CVE-2016-3249
HIGH · vendor
Windows Graphics Component Elevation of Privilege Vulnerability |
|
CVE-2016-3239
HIGH · vendor
Windows Print Spooler Elevation of Privilege Vulnerability |
|
CVE-2016-1704
HIGH 8.8
Multiple unspecified vulnerabilities in Google Chrome before 51.0.2704.103 allow attackers to cause a denial of service or possibly have other impact via unkno… |
|
CVE-2016-4472
HIGH 8.1
The overflow protection in Expat is removed by compilers with certain optimization settings, which allows remote attackers to cause a denial of service (crash)… |
|
CVE-2016-3233
HIGH 7.3
Microsoft Excel 2007 SP3, Excel 2010 SP2, and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code via a crafted Office document, aka… |
|
CVE-2016-3231
HIGH 7.8
The Standard Collector service in Windows Diagnostics Hub mishandles library loading, which allows local users to gain privileges via a crafted application, ak… |
|
CVE-2016-3225
HIGH 7.8
The SMB server component in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windo… |
|
CVE-2016-3223
HIGH 8.1
Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Go… |
|
CVE-2016-3222
HIGH 8.8
Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Edge M… |
|
CVE-2016-3221
HIGH 7.8
The kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Window… |
|
CVE-2016-3220
HIGH 7.8
atmfd.dll in the Adobe Type Manager Font Driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server … |
|
CVE-2016-3219
HIGH 7.8
The kernel-mode driver in Microsoft Windows 10 Gold and 1511 allows local users to gain privileges via a crafted application, aka "Win32k Elevation of Privileg… |
|
CVE-2016-3218
HIGH 7.8
The kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Window… |
|
CVE-2016-3214
HIGH 8.8
The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted… |
|
CVE-2016-3213
HIGH 8.8
The Web Proxy Auto Discovery (WPAD) protocol implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Win… |
|
CVE-2016-3203
HIGH 7.8
Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows 10 Gold and 1511, and Microsoft Edge allow remote attackers to execute arbitrary code via a cra… |
|
CVE-2016-3199
HIGH 8.8
The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted… |
|
CVE-2016-0025
HIGH 7.3
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office 2016, Word 2016, Word for Mac 2011, Word 2016 for Mac, Office … |
|
CVE-2016-2335
HIGH 8.8
The CInArchive::ReadFileItem method in Archive/Udf/UdfIn.cpp in 7zip 9.20 and 15.05 beta and p7zip allows remote attackers to cause a denial of service (out-of… |
|
CVE-2016-1703
HIGH 8.8
Multiple unspecified vulnerabilities in Google Chrome before 51.0.2704.79 allow attackers to cause a denial of service or possibly have other impact via unknow… |
|
CVE-2016-1701
HIGH 8.8
The Autofill implementation in Google Chrome before 51.0.2704.79 mishandles the interaction between field updates and JavaScript code that triggers a frame del… |
|
CVE-2016-1700
HIGH 7.5
extensions/renderer/runtime_custom_bindings.cc in Google Chrome before 51.0.2704.79 does not consider side effects during creation of an array of extension vie… |
|
CVE-2016-1697
HIGH 8.8
The FrameLoader::startLoad function in WebKit/Source/core/loader/FrameLoader.cpp in Blink, as used in Google Chrome before 51.0.2704.79, does not prevent frame… |
|
CVE-2016-1696
HIGH 8.8
The extensions subsystem in Google Chrome before 51.0.2704.79 does not properly restrict bindings access, which allows remote attackers to bypass the Same Orig… |
|
CVE-2016-1695
HIGH 8.8
Multiple unspecified vulnerabilities in Google Chrome before 51.0.2704.63 allow attackers to cause a denial of service or possibly have other impact via unknow… |
|
CVE-2016-1691
HIGH 7.5
Skia, as used in Google Chrome before 51.0.2704.63, mishandles coincidence runs, which allows remote attackers to cause a denial of service (heap-based buffer … |
|
CVE-2016-1690
HIGH 7.5
The Autofill implementation in Google Chrome before 51.0.2704.63 mishandles the interaction between field updates and JavaScript code that triggers a frame del… |
|
CVE-2016-1684
HIGH 7.5
numbers.c in libxslt before 1.1.29, as used in Google Chrome before 51.0.2704.63, mishandles the i format token for xsl:number data, which allows remote attack… |
|
CVE-2016-1683
HIGH 7.5
numbers.c in libxslt before 1.1.29, as used in Google Chrome before 51.0.2704.63, mishandles namespace nodes, which allows remote attackers to cause a denial o… |
|
CVE-2016-1681
HIGH 8.8
Heap-based buffer overflow in the opj_j2k_read_SPCod_SPCoc function in j2k.c in OpenJPEG, as used in PDFium in Google Chrome before 51.0.2704.63, allows remote… |
|
CVE-2016-1680
HIGH 8.8
Use-after-free vulnerability in ports/SkFontHost_FreeType.cpp in Skia, as used in Google Chrome before 51.0.2704.63, allows remote attackers to cause a denial … |
|
CVE-2016-1679
HIGH 8.8
The ToV8Value function in content/child/v8_value_converter_impl.cc in the V8 bindings in Google Chrome before 51.0.2704.63 does not properly restrict use of ge… |
|
CVE-2016-1678
HIGH 8.8
objects.cc in Google V8 before 5.0.71.32, as used in Google Chrome before 51.0.2704.63, does not properly restrict lazy deoptimization, which allows remote att… |
|
CVE-2016-1676
HIGH 8.8
extensions/renderer/resources/binding.js in the extension bindings in Google Chrome before 51.0.2704.63 does not properly use prototypes, which allows remote a… |
|
CVE-2016-1675
HIGH 8.8
Blink, as used in Google Chrome before 51.0.2704.63, allows remote attackers to bypass the Same Origin Policy by leveraging the mishandling of Document reattac… |
|
CVE-2016-1674
HIGH 8.8
The extensions subsystem in Google Chrome before 51.0.2704.63 allows remote attackers to bypass the Same Origin Policy via unspecified vectors. |
|
CVE-2016-1673
HIGH 8.8
Blink, as used in Google Chrome before 51.0.2704.63, allows remote attackers to bypass the Same Origin Policy via unspecified vectors. |
|
CVE-2016-1672
HIGH 8.8
The ModuleSystem::RequireForJsInner function in extensions/renderer/module_system.cc in the extension bindings in Google Chrome before 51.0.2704.63 mishandles … |
|
CVE-2016-1671
HIGH 8.1
Google Chrome before 50.0.2661.102 on Android mishandles / (slash) and \ (backslash) characters, which allows attackers to conduct directory traversal attacks … |
|
CVE-2016-1669
HIGH 8.8
The Zone::New function in zone.cc in Google V8 before 5.0.71.47, as used in Google Chrome before 50.0.2661.102, does not properly determine when to expand cert… |
|
CVE-2016-1668
HIGH 8.8
The forEachForBinding function in WebKit/Source/bindings/core/v8/Iterable.h in the V8 bindings in Blink, as used in Google Chrome before 50.0.2661.102, uses an… |
|
CVE-2016-1667
HIGH 8.8
The TreeScope::adoptIfNeeded function in WebKit/Source/core/dom/TreeScope.cpp in the DOM implementation in Blink, as used in Google Chrome before 50.0.2661.102… |
|
CVE-2016-1663
HIGH 8.8
The SerializedScriptValue::transferArrayBuffers function in WebKit/Source/bindings/core/v8/SerializedScriptValue.cpp in the V8 bindings in Blink, as used in Go… |
Manage your fleet with Appaloosa
Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.