Vulnerabilities
Tracked app vulnerabilities
2,721 CVEs affect a tracked app or OS (Critical, all platforms). 48 of them are in the CISA KEV catalog, meaning exploitation is confirmed.
- Matching CVEs
- 2,721
- Actively exploited
- 48
- Publication window
- 2007-08-28 → 2026-11-10
Chronological sort: newest to oldest. Use the KEV / severity filters above to prioritize.
| CVE |
|---|
|
CVE-2024-49126
CRITICAL · vendor
Windows Local Security Authority Subsystem Service (LSASS) Remote Code Execution Vulnerability |
|
CVE-2024-49124
CRITICAL · vendor
Lightweight Directory Access Protocol (LDAP) Client Remote Code Execution Vulnerability |
|
CVE-2024-49123
CRITICAL · vendor
Windows Remote Desktop Services Remote Code Execution Vulnerability |
|
CVE-2024-49122
CRITICAL · vendor
Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability |
|
CVE-2024-49120
CRITICAL · vendor
Windows Remote Desktop Services Remote Code Execution Vulnerability |
|
CVE-2024-49119
CRITICAL · vendor
Windows Remote Desktop Services Remote Code Execution Vulnerability |
|
CVE-2024-49118
CRITICAL · vendor
Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability |
|
CVE-2024-49117
CRITICAL · vendor
Windows Hyper-V Remote Code Execution Vulnerability |
|
CVE-2024-49116
CRITICAL · vendor
Windows Remote Desktop Services Remote Code Execution Vulnerability |
|
CVE-2024-49115
CRITICAL · vendor
Windows Remote Desktop Services Remote Code Execution Vulnerability |
|
CVE-2024-49108
CRITICAL · vendor
Windows Remote Desktop Services Remote Code Execution Vulnerability |
|
CVE-2024-49106
CRITICAL · vendor
Windows Remote Desktop Services Remote Code Execution Vulnerability |
|
CVE-2024-49105
CRITICAL · vendor
Remote Desktop Client Remote Code Execution Vulnerability |
|
CVE-2024-9369
CRITICAL 9.6
Insufficient data validation in Mojo in Google Chrome prior to 129.0.6668.89 allowed a remote attacker who had compromised the renderer process to perform an o… |
|
CVE-2024-11705
CRITICAL 9.1
`NSC_DeriveKey` inadvertently assumed that the `phKey` parameter is always non-NULL. When it was passed as NULL, a segmentation fault (SEGV) occurred, leading … |
|
CVE-2024-11704
CRITICAL 9.8
A double-free issue could have occurred in `sec_pkcs7_decoder_start_decrypt()` when handling an error path. Under specific conditions, the same symmetric key c… |
|
CVE-2024-11698
CRITICAL 9.8
A flaw in handling fullscreen transitions may have inadvertently caused the application to become stuck in fullscreen mode when a modal dialog was opened durin… |
|
CVE-2024-11693
CRITICAL 9.8
The executable file warning was not presented when downloading .library-ms files. *Note: This issue only affected Windows operating systems. Other operating … |
|
CVE-2024-43639
CRITICAL · vendor
Windows KDC Proxy Remote Code Execution Vulnerability |
|
CVE-2024-43625
CRITICAL · vendor
Microsoft Windows VMSwitch Elevation of Privilege Vulnerability |
|
CVE-2024-38408
CRITICAL · vendor
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2024-44217
CRITICAL 9.1
A permissions issue was addressed by removing vulnerable code and adding additional checks. This issue is fixed in iOS 18 and iPadOS 18. Password autofill may … |
|
CVE-2024-40867
CRITICAL 9.6
A custom URL scheme handling issue was addressed with improved input validation. This issue is fixed in iOS 18.1 and iPadOS 18.1. A remote attacker may be able… |
|
CVE-2024-44206
An issue in the handling of URL protocols was addressed with improved logic. This issue is fixed in Safari 17.6, iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6, t… |
|
CVE-2024-9680
CRITICAL 9.8
KEV
An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines. We have had reports of this vulner… |
|
CVE-2024-43582
CRITICAL · vendor
Remote Desktop Protocol Server Remote Code Execution Vulnerability |
|
CVE-2024-9402
CRITICAL 9.8
Memory safety bugs present in Firefox 130, Firefox ESR 128.2, and Thunderbird 128.2. Some of these bugs showed evidence of memory corruption and we presume tha… |
|
CVE-2024-9401
CRITICAL 9.8
Memory safety bugs present in Firefox 130, Firefox ESR 115.15, Firefox ESR 128.2, and Thunderbird 128.2. Some of these bugs showed evidence of memory corruptio… |
|
CVE-2024-9392
CRITICAL 9.8
A compromised content process could have allowed for the arbitrary loading of cross-origin pages. This vulnerability affects Firefox < 131, Firefox ESR < 128.3… |
|
CVE-2024-7024
CRITICAL 9.6
Inappropriate implementation in V8 in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML… |
|
CVE-2024-44148
CRITICAL 10.0
This issue was addressed with improved validation of file attributes. This issue is fixed in macOS Sequoia 15. An app may be able to break out of its sandbox. |
|
CVE-2024-44146
CRITICAL 10.0
A logic issue was addressed with improved file handling. This issue is fixed in macOS Sequoia 15. An app may be able to break out of its sandbox. |
|
CVE-2024-8387
CRITICAL 9.8
Memory safety bugs present in Firefox 129, Firefox ESR 128.1, and Thunderbird 128.1. Some of these bugs showed evidence of memory corruption and we presume tha… |
|
CVE-2024-33052
CRITICAL · vendor
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2024-33042
CRITICAL · vendor
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2024-7971
CRITICAL 9.6
KEV
Type confusion in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to exploit heap corruption via a crafted HTML page. (Chromium security s… |
|
CVE-2024-38160
CRITICAL · vendor
Windows Network Virtualization Remote Code Execution Vulnerability |
|
CVE-2024-38159
CRITICAL · vendor
Windows Network Virtualization Remote Code Execution Vulnerability |
|
CVE-2024-38140
CRITICAL · vendor
Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability |
|
CVE-2024-38063
CRITICAL · vendor
Windows TCP/IP Remote Code Execution Vulnerability |
|
CVE-2024-7519
CRITICAL · vendor
Insufficient checks when processing graphics shared memory could have led to memory corruption. This could be leveraged by an attacker to perform a sandbox esc… |
|
CVE-2024-23350
CRITICAL · vendor
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2023-7012
CRITICAL 9.6
Insufficient data validation in Permission Prompts in Google Chrome prior to 117.0.5938.62 allowed an attacker who convinced a user to install a malicious app … |
|
CVE-2023-4860
CRITICAL 9.6
Inappropriate implementation in Skia in Google Chrome prior to 115.0.5790.98 allowed a remote attacker who had compromised the renderer process to potentially … |
|
CVE-2019-25154
CRITICAL 9.6
Inappropriate implementation in iframe in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to potentially perform a sandbox escape via a crafted H… |
|
CVE-2024-6779
CRITICAL 9.6
Out of bounds memory access in V8 in Google Chrome prior to 126.0.6478.182 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML… |
|
CVE-2024-6611
CRITICAL · vendor
A nested iframe, triggering a cross-site navigation, could send SameSite=Strict or Lax cookies. This vulnerability affects Firefox < 128 and Thunderbird < 128. |
|
CVE-2024-6606
CRITICAL · vendor
Clipboard code failed to check the index on an array access. This could have led to an out-of-bounds read. This vulnerability affects Firefox < 128 and Thunder… |
|
CVE-2024-6602
CRITICAL 9.8
A mismatch between allocator and deallocator could have led to memory corruption. This vulnerability affects Firefox < 128, Firefox ESR < 115.13, Thunderbird <… |
|
CVE-2024-3596
CRITICAL 9.0
RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access… |
Manage your fleet with Appaloosa
Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.