Vulnerabilities
Tracked app vulnerabilities
1,409 CVEs affect a tracked app or OS (all severities, iOS). 28 of them are in the CISA KEV catalog, meaning exploitation is confirmed.
- Matching CVEs
- 1,409
- Actively exploited
- 28
- Publication window
- 2013-04-24 → 2026-11-09
Chronological sort: newest to oldest. Use the KEV / severity filters above to prioritize.
| CVE |
|---|
|
CVE-2022-44708
HIGH 8.3
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability |
|
CVE-2022-43363
MEDIUM 6.1
Telegram Web 15.3.1 allows XSS via a certain payload derived from a Target Corporation website. NOTE: some third parties have been unable to discern any relati… |
|
CVE-2022-27492
HIGH 7.8
An integer underflow in WhatsApp could have caused remote code execution when receiving a crafted video file. |
|
CVE-2022-36934
CRITICAL 9.8
An integer overflow in WhatsApp could result in remote code execution in an established video call. |
|
CVE-2022-28755
CRITICAL 9.6
The Zoom Client for Meetings (for Android, iOS, Linux, macOS, and Windows) before version 5.11.0 are susceptible to a URL parsing vulnerability. If a malicious… |
|
CVE-2022-32550
MEDIUM 4.8
An issue was discovered in AgileBits 1Password, involving the method various 1Password apps and integrations used to create connections to the 1Password servic… |
|
CVE-2022-26704
A validation issue existed in the handling of symlinks and was addressed with improved validation of symlinks. This issue is fixed in macOS Monterey 12.4. An a… |
|
CVE-2021-44683
HIGH 8.2
The DuckDuckGo browser 7.64.4 on iOS allows Address Bar Spoofing due to mishandling of the JavaScript window.open function (used to open a secondary browser wi… |
|
CVE-2020-20096
MEDIUM 6.5
Whatsapp iOS 2.19.80 and prior and Android 2.19.222 and prior user interface does not properly represent URI messages to the user, which results in URI spoofin… |
|
CVE-2022-21965
HIGH 7.5
Microsoft Teams Denial of Service Vulnerability |
|
CVE-2021-24043
CRITICAL 9.1
A missing bound check in RTCP flag parsing code prior to WhatsApp for Android v2.21.23.2, WhatsApp Business for Android v2.21.23.2, WhatsApp for iOS v2.21.230.… |
|
CVE-2021-24042
CRITICAL 9.8
The calling logic for WhatsApp for Android prior to v2.21.23, WhatsApp Business for Android prior to v2.21.23, WhatsApp for iOS prior to v2.21.230, WhatsApp Bu… |
|
CVE-2021-36769
MEDIUM 5.3
A reordering issue exists in Telegram before 7.8.1 for Android, Telegram before 7.8.3 for iOS, and Telegram Desktop before 2.8.8. An attacker can cause the ser… |
|
CVE-2021-31323
MEDIUM 5.5
Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Heap Buffer Overflow in the LottieParserImpl::parseDashProperty fu… |
|
CVE-2021-31322
MEDIUM 5.5
Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Heap Buffer Overflow in the LOTGradient::populate function of thei… |
|
CVE-2021-31321
HIGH 7.1
Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Stack Based Overflow in the gray_split_cubic function of their cus… |
|
CVE-2021-31320
HIGH 7.1
Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Heap Buffer Overflow in the VGradientCache::generateGradientColorT… |
|
CVE-2021-31319
MEDIUM 5.5
Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by an Integer Overflow in the LOTGradient::populate function of their c… |
|
CVE-2021-31318
MEDIUM 5.5
Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Type Confusion in the LOTCompLayerItem::LOTCompLayerItem function … |
|
CVE-2021-31317
MEDIUM 5.5
Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Type Confusion in the VDasher constructor of their custom fork of … |
|
CVE-2021-31315
MEDIUM 5.5
Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Stack Based Overflow in the blit function of their custom fork of … |
|
CVE-2021-21211
MEDIUM 6.5
Inappropriate implementation in Navigation in Google Chrome on iOS prior to 90.0.4430.72 allowed a remote attacker to leak cross-origin data via a crafted HTML… |
|
CVE-2021-21205
HIGH 8.1
Insufficient policy enforcement in navigation in Google Chrome on iOS prior to 90.0.4430.72 allowed a remote attacker to bypass navigation restrictions via a c… |
|
CVE-2021-30496
MEDIUM 5.7
The Telegram app 7.6.2 for iOS allows remote authenticated users to cause a denial of service (application crash) if the victim pastes an attacker-supplied mes… |
|
CVE-2021-24026
CRITICAL 9.8
A missing bounds check within the audio decoding pipeline for WhatsApp calls in WhatsApp for Android prior to v2.21.3, WhatsApp Business for Android prior to v… |
|
CVE-2021-24114
MEDIUM 5.7
Microsoft Teams iOS Information Disclosure Vulnerability |
|
CVE-2021-27205
MEDIUM 5.5
Telegram before 7.4 (212543) Stable on macOS stores the local copy of self-destructed messages in a sandbox path, leading to sensitive information disclosure. |
|
CVE-2021-27204
MEDIUM 5.5
Telegram before 7.4 (212543) Stable on macOS stores the local passcode in cleartext, leading to information disclosure. |
|
CVE-2020-1909
CRITICAL 9.8
A use-after-free in a logging library in WhatsApp for iOS prior to v2.20.111 and WhatsApp Business for iOS prior to v2.20.111 could have resulted in memory cor… |
|
CVE-2020-1908
MEDIUM 4.6
Improper authorization of the Screen Lock feature in WhatsApp and WhatsApp Business for iOS prior to v2.20.100 could have permitted use of Siri to interact wit… |
|
CVE-2020-1907
CRITICAL 9.8
A stack overflow in WhatsApp for Android prior to v2.20.196.16, WhatsApp Business for Android prior to v2.20.196.12, WhatsApp for iOS prior to v2.20.90, WhatsA… |
|
CVE-2020-1904
MEDIUM 5.5
A path validation issue in WhatsApp for iOS prior to v2.20.61 and WhatsApp Business for iOS prior to v2.20.61 could have allowed for directory traversal overwr… |
|
CVE-2020-1903
MEDIUM 5.5
An issue when unzipping docx, pptx, and xlsx documents in WhatsApp for iOS prior to v2.20.61 and WhatsApp Business for iOS prior to v2.20.61 could have resulte… |
|
CVE-2020-1901
MEDIUM 5.3
Receiving a large text message containing URLs in WhatsApp for iOS prior to v2.20.91.4 could have caused the application to freeze while processing the message. |
|
CVE-2020-1894
HIGH 8.8
A stack write overflow in WhatsApp for Android prior to v2.20.35, WhatsApp Business for Android prior to v2.20.20, WhatsApp for iPhone prior to v2.20.30, and W… |
|
CVE-2020-1891
CRITICAL 9.8
A user controlled parameter used in video call in WhatsApp for Android prior to v2.20.17, WhatsApp Business for Android prior to v2.20.7, WhatsApp for iPhone p… |
|
CVE-2020-15502
HIGH 7.5
The DuckDuckGo application through 5.58.0 for Android, and through 7.47.1.0 for iOS, sends hostnames of visited web sites within HTTPS .ico requests to servers… |
|
CVE-2020-12474
MEDIUM 6.5
Telegram Desktop through 2.0.1, Telegram through 6.0.1 for Android, and Telegram through 6.0.1 for iOS allow an IDN Homograph attack via Punycode in a public U… |
|
CVE-2019-18426
A vulnerability in WhatsApp Desktop versions prior to 0.3.9309 when paired with WhatsApp for iPhone versions prior to 2.20.10 allows cross-site scripting and l… |
|
CVE-2019-11931
HIGH 7.8
A stack-based buffer overflow could be triggered in WhatsApp by sending a specially crafted MP4 file to a WhatsApp user. The issue was present in parsing the e… |
|
CVE-2019-11927
HIGH 7.8
An integer overflow in WhatsApp media parsing libraries allows a remote attacker to perform an out-of-bounds write on the heap via specially-crafted EXIF tags … |
|
CVE-2019-14319
MEDIUM 6.5
The TikTok (formerly Musical.ly) application 12.2.0 for Android and iOS performs unencrypted transmission of images, videos, and likes. This allows an attacker… |
|
CVE-2019-15514
MEDIUM 5.3
The Privacy > Phone Number feature in the Telegram app 5.10 for Android and iOS provides an incorrect indication that the access level is Nobody, because attac… |
|
CVE-2019-1948
MEDIUM 5.9
A vulnerability in Cisco Webex Meetings Mobile (iOS) could allow an unauthenticated, remote attacker to gain unauthorized read access to sensitive data by usin… |
|
CVE-2019-1218
MEDIUM 5.4
A spoofing vulnerability exists in the way Microsoft Outlook iOS software parses specifically crafted email messages. An authenticated attacker could exploit t… |
|
CVE-2019-1084
MEDIUM 6.5
+1
An information disclosure vulnerability exists when Exchange allows creation of entities with Display Names having non-printable characters. An authenticated a… |
|
CVE-2018-20655
CRITICAL 9.8
When receiving calls using WhatsApp for iOS, a missing size check when parsing a sender-provided packet allowed for a stack-based overflow. This issue affects … |
|
CVE-2019-5598
HIGH 7.5
In FreeBSD 11.3-PRERELEASE before r345378, 12.0-STABLE before r345377, 11.2-RELEASE before 11.2-RELEASE-p10, and 12.0-RELEASE before 12.0-RELEASE-p4, a bug in … |
|
CVE-2019-10044
HIGH 8.8
Telegram Desktop before 1.5.12 on Windows, and the Telegram applications for Android, iOS, and Linux, is vulnerable to an IDN homograph attack when displaying … |
|
CVE-2018-6976
MEDIUM 5.3
The VMware Content Locker for iOS prior to 4.14 contains a data protection vulnerability in the SQLite database. This vulnerability relates to unencrypted file… |
Manage your fleet with Appaloosa
Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.