Vulnerabilities
Tracked app vulnerabilities
19,910 CVEs affect a tracked app or OS (all severities, Windows). 303 of them are in the CISA KEV catalog, meaning exploitation is confirmed.
- Matching CVEs
- 19,910
- Actively exploited
- 303
- Publication window
- 1997-01-01 → 2026-10-27
Chronological sort: newest to oldest. Use the KEV / severity filters above to prioritize.
| CVE |
|---|
|
CVE-2020-16032
MEDIUM 4.3
Insufficient data validation in sharing in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a c… |
|
CVE-2020-16031
MEDIUM 4.3
Insufficient data validation in UI in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafte… |
|
CVE-2020-16030
MEDIUM 6.1
Insufficient data validation in Blink in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted… |
|
CVE-2020-16029
HIGH 8.8
Inappropriate implementation in PDFium in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to bypass navigation restrictions via a crafted PDF fil… |
|
CVE-2020-16028
HIGH 8.8
Heap buffer overflow in WebRTC in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
|
CVE-2020-16027
MEDIUM 6.5
Insufficient policy enforcement in developer tools in Google Chrome prior to 87.0.4280.66 allowed an attacker who convinced a user to install a malicious exten… |
|
CVE-2020-16026
HIGH 8.8
Use after free in WebRTC in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
|
CVE-2020-16025
CRITICAL 9.6
Heap buffer overflow in clipboard in Google Chrome prior to 87.0.4280.66 allowed a remote attacker who had compromised the renderer process to potentially perf… |
|
CVE-2020-16024
CRITICAL 9.6
Heap buffer overflow in UI in Google Chrome prior to 87.0.4280.66 allowed a remote attacker who had compromised the renderer process to potentially perform a s… |
|
CVE-2020-16023
HIGH 8.8
Use after free in WebCodecs in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
|
CVE-2020-16022
HIGH 8.8
Insufficient policy enforcement in networking in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to potentially bypass firewall controls via a cr… |
|
CVE-2020-16021
HIGH 7.5
Race in image burner in Google Chrome on ChromeOS prior to 87.0.4280.66 allowed a remote attacker who had compromised the browser process to perform OS-level p… |
|
CVE-2020-16020
HIGH 8.8
Inappropriate implementation in cryptohome in Google Chrome on ChromeOS prior to 87.0.4280.66 allowed a remote attacker who had compromised the browser process… |
|
CVE-2020-16019
HIGH 8.8
Inappropriate implementation in filesystem in Google Chrome on ChromeOS prior to 87.0.4280.66 allowed a remote attacker who had compromised the browser process… |
|
CVE-2020-16018
CRITICAL 9.6
Use after free in payments in Google Chrome prior to 87.0.4280.66 allowed a remote attacker who had compromised the renderer process to potentially perform a s… |
|
CVE-2020-16017
CRITICAL 9.6
Use after free in site isolation in Google Chrome prior to 86.0.4240.198 allowed a remote attacker who had compromised the renderer process to potentially perf… |
|
CVE-2020-16016
CRITICAL 9.6
Inappropriate implementation in base in Google Chrome prior to 86.0.4240.193 allowed a remote attacker who had compromised the renderer process to potentially … |
|
CVE-2020-16015
HIGH 8.8
Insufficient data validation in WASM in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML… |
|
CVE-2020-16014
CRITICAL 9.6
Use after free in PPAPI in Google Chrome prior to 87.0.4280.66 allowed a remote attacker who had compromised the renderer process to potentially perform a sand… |
|
CVE-2020-16013
HIGH 8.8
Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.198 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML … |
|
CVE-2020-16012
MEDIUM 4.3
Side-channel information leakage in graphics in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
|
CVE-2020-26664
HIGH 7.8
A vulnerability in EbmlTypeDispatcher::send in VideoLAN VLC media player 3.0.11 allows attackers to trigger a heap-based buffer overflow via a crafted .mkv fil… |
|
CVE-2020-35113
HIGH 8.8
Mozilla developers reported memory safety bugs present in Firefox 83 and Firefox ESR 78.5. Some of these bugs showed evidence of memory corruption and we presu… |
|
CVE-2020-35112
HIGH 8.8
If a user downloaded a file lacking an extension on Windows, and then "Open"-ed it from the downloads panel, if there was an executable file in the downloads d… |
|
CVE-2020-35111
MEDIUM 4.3
When an extension with the proxy permission registered to receive <all_urls>, the proxy.onRequest callback was not triggered for view-source URLs. While web co… |
|
CVE-2020-26978
MEDIUM 6.1
Using techniques that built on the slipstream research, a malicious webpage could have exposed both an internal network's hosts as well as services running on … |
|
CVE-2020-26974
HIGH 8.8
When flex-basis was used on a table wrapper, a StyleGenericFlexBasis object could have been incorrectly cast to the wrong type. This resulted in a heap user-af… |
|
CVE-2020-26973
HIGH 8.8
Certain input to the CSS Sanitizer confused it, resulting in incorrect components being removed. This could have been used as a sanitizer bypass. This vulnerab… |
|
CVE-2020-26971
HIGH 8.8
Certain blit values provided by the user were not properly constrained leading to a heap buffer overflow on some video drivers. This vulnerability affects Fire… |
|
CVE-2020-17131
MEDIUM 4.2
Chakra Scripting Engine Memory Corruption Vulnerability |
|
CVE-2020-17130
MEDIUM 6.5
Microsoft Excel Security Feature Bypass Vulnerability |
|
CVE-2020-17129
HIGH 7.8
Microsoft Excel Remote Code Execution Vulnerability |
|
CVE-2020-17128
HIGH 7.8
Microsoft Excel Remote Code Execution Vulnerability |
|
CVE-2020-17127
HIGH 7.8
Microsoft Excel Remote Code Execution Vulnerability |
|
CVE-2020-17126
MEDIUM 5.5
Microsoft Excel Information Disclosure Vulnerability |
|
CVE-2020-17125
HIGH 7.8
Microsoft Excel Remote Code Execution Vulnerability |
|
CVE-2020-17124
HIGH 7.8
Microsoft PowerPoint Remote Code Execution Vulnerability |
|
CVE-2020-17123
HIGH 7.8
Microsoft Excel Remote Code Execution Vulnerability |
|
CVE-2020-17119
MEDIUM 6.5
Microsoft Outlook Information Disclosure Vulnerability |
|
CVE-2020-26970
HIGH 8.8
When reading SMTP server status codes, Thunderbird writes an integer value to a position on the stack that is intended to contain just one byte. Depending on p… |
|
CVE-2020-26968
HIGH 8.8
Mozilla developers reported memory safety bugs present in Firefox 82 and Firefox ESR 78.4. Some of these bugs showed evidence of memory corruption and we presu… |
|
CVE-2020-26966
MEDIUM 6.5
Searching for a single word from the address bar caused an mDNS request to be sent on the local network searching for a hostname consisting of that string; res… |
|
CVE-2020-26965
MEDIUM 6.5
Some websites have a feature "Show Password" where clicking a button will change a password field into a textbook field, revealing the typed password. If, when… |
|
CVE-2020-26961
MEDIUM 6.5
When DNS over HTTPS is in use, it intentionally filters RFC1918 and related IP ranges from the responses as these do not make sense coming from a DoH resolver.… |
|
CVE-2020-26960
HIGH 8.8
If the Compact() method was called on an nsTArray, the array could have been reallocated without updating other pointers, leading to a potential use-after-free… |
|
CVE-2020-26959
HIGH 8.8
During browser shutdown, reference decrementing could have occured on a previously freed object, resulting in a use-after-free, memory corruption, and a potent… |
|
CVE-2020-26958
MEDIUM 6.1
Firefox did not block execution of scripts with incorrect MIME types when the response was intercepted and cached through a ServiceWorker. This could lead to a… |
|
CVE-2020-26956
MEDIUM 6.1
In some cases, removing HTML elements during sanitization would keep existing SVG event handlers and therefore lead to XSS. This vulnerability affects Firefox … |
|
CVE-2020-26953
MEDIUM 4.3
It was possible to cause the browser to enter fullscreen mode without displaying the security UI; thus making it possible to attempt a phishing attack or other… |
|
CVE-2020-26951
MEDIUM 6.1
A parsing and event loading mismatch in Firefox's SVG code could have allowed load events to fire, even after sanitization. An attacker already capable of expl… |
Manage your fleet with Appaloosa
Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.