Vulnerabilities
Tracked app vulnerabilities
1,726 CVEs affect a tracked app or OS (Critical, Windows). 37 of them are in the CISA KEV catalog, meaning exploitation is confirmed.
- Matching CVEs
- 1,726
- Actively exploited
- 37
- Publication window
- 2007-08-28 → 2026-11-11
Chronological sort: newest to oldest. Use the KEV / severity filters above to prioritize.
| CVE |
|---|
|
CVE-2019-1222
CRITICAL · vendor
Remote Desktop Services Remote Code Execution Vulnerability |
|
CVE-2019-1188
CRITICAL · vendor
LNK Remote Code Execution Vulnerability |
|
CVE-2019-1182
CRITICAL · vendor
Remote Desktop Services Remote Code Execution Vulnerability |
|
CVE-2019-1181
CRITICAL · vendor
Remote Desktop Services Remote Code Execution Vulnerability |
|
CVE-2019-1152
CRITICAL · vendor
Microsoft Graphics Remote Code Execution Vulnerability |
|
CVE-2019-1151
CRITICAL · vendor
Microsoft Graphics Remote Code Execution Vulnerability |
|
CVE-2019-1150
CRITICAL · vendor
Microsoft Graphics Remote Code Execution Vulnerability |
|
CVE-2019-1149
CRITICAL · vendor
Microsoft Graphics Remote Code Execution Vulnerability |
|
CVE-2019-1145
CRITICAL · vendor
Microsoft Graphics Remote Code Execution Vulnerability |
|
CVE-2019-1144
CRITICAL · vendor
Microsoft Graphics Remote Code Execution Vulnerability |
|
CVE-2019-0965
CRITICAL · vendor
Windows Hyper-V Remote Code Execution Vulnerability |
|
CVE-2019-0736
CRITICAL · vendor
Windows DHCP Client Remote Code Execution Vulnerability |
|
CVE-2019-0720
CRITICAL · vendor
Hyper-V Remote Code Execution Vulnerability |
|
CVE-2019-9820
CRITICAL 9.8
A use-after-free vulnerability can occur in the chrome event handler when it is freed while still in use. This results in a potentially exploitable crash. This… |
|
CVE-2019-9819
CRITICAL 9.8
A vulnerability where a JavaScript compartment mismatch can occur while working with the fetch API, resulting in a potentially exploitable crash. This vulnerab… |
|
CVE-2019-9800
CRITICAL 9.8
Mozilla developers and community members reported memory safety bugs present in Firefox 66, Firefox ESR 60.6, and Thunderbird 60.6. Some of these bugs showed e… |
|
CVE-2019-11713
CRITICAL 9.8
A use-after-free vulnerability can occur in HTTP/2 when a cached HTTP/2 stream is closed while still in use, resulting in a potentially exploitable crash. This… |
|
CVE-2019-11709
CRITICAL 9.8
Mozilla developers and community members reported memory safety bugs present in Firefox 67 and Firefox ESR 60.7. Some of these bugs showed evidence of memory c… |
|
CVE-2019-11708
CRITICAL 10.0
KEV
Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can result in the non-sandboxed parent process op… |
|
CVE-2019-11705
CRITICAL 9.8
A flaw in Thunderbird's implementation of iCal causes a stack buffer overflow in icalrecur_add_bydayrules when processing certain email messages, resulting in … |
|
CVE-2019-11704
CRITICAL 9.8
A flaw in Thunderbird's implementation of iCal causes a heap buffer overflow in icalmemory_strdup_and_dequote when processing certain email messages, resulting… |
|
CVE-2019-11703
CRITICAL 9.8
A flaw in Thunderbird's implementation of iCal causes a heap buffer overflow in parser_get_next_char when processing certain email messages, resulting in a pot… |
|
CVE-2019-11693
CRITICAL 9.8
The bufferdata function in WebGL is vulnerable to a buffer overflow with specific graphics drivers on Linux. This could result in malicious content freezing a … |
|
CVE-2019-11692
CRITICAL 9.8
A use-after-free vulnerability can occur when listeners are removed from the event listener manager while still in use, resulting in a potentially exploitable … |
|
CVE-2019-11691
CRITICAL 9.8
A use-after-free vulnerability can occur when working with XMLHttpRequest (XHR) in an event loop, causing the XHR main thread to be called after it has been fr… |
|
CVE-2019-13962
CRITICAL 9.8
lavc_CopyPicture in modules/codec/avcodec/video.c in VideoLAN VLC media player through 3.0.7 has a heap-based buffer over-read because it does not properly val… |
|
CVE-2019-1102
CRITICAL · vendor
GDI+ Remote Code Execution Vulnerability |
|
CVE-2019-0785
CRITICAL · vendor
Windows DHCP Server Remote Code Execution Vulnerability |
|
CVE-2019-12900
CRITICAL 9.8
BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many selectors. |
|
CVE-2019-12874
CRITICAL 9.8
An issue was discovered in zlib_decompress_extra in modules/demux/mkv/util.cpp in VideoLAN VLC media player 3.x through 3.0.7. The Matroska demuxer, while pars… |
|
CVE-2019-0888
CRITICAL · vendor
ActiveX Data Objects (ADO) Remote Code Execution Vulnerability |
|
CVE-2019-0722
CRITICAL · vendor
Windows Hyper-V Remote Code Execution Vulnerability |
|
CVE-2019-0709
CRITICAL · vendor
Windows Hyper-V Remote Code Execution Vulnerability |
|
CVE-2019-0620
CRITICAL · vendor
Windows Hyper-V Remote Code Execution Vulnerability |
|
CVE-2019-10160
CRITICAL 9.8
A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7, 3.5, 3.6, 3.7 and… |
|
CVE-2019-0938
CRITICAL 9.0
An elevation of privilege vulnerability exists in Microsoft Edge that could allow an attacker to escape from the AppContainer sandbox in the browser, aka 'Micr… |
|
CVE-2019-0903
GDI+ Remote Code Execution Vulnerability |
|
CVE-2019-0725
CRITICAL · vendor
Windows DHCP Server Remote Code Execution Vulnerability |
|
CVE-2019-9796
CRITICAL 9.8
A use-after-free vulnerability can occur when the SMIL animation controller incorrectly registers with the refresh driver twice when only a single registration… |
|
CVE-2019-9795
CRITICAL 9.8
A vulnerability where type-confusion in the IonMonkey just-in-time (JIT) compiler could potentially be used by malicious JavaScript to trigger a potentially ex… |
|
CVE-2019-9794
CRITICAL 9.8
A vulnerability was discovered where specific command line arguments are not properly discarded during Firefox invocation as a shell handler for URLs. This cou… |
|
CVE-2019-9792
CRITICAL 9.8
The IonMonkey just-in-time (JIT) compiler can leak an internal JS_OPTIMIZED_OUT magic value to the running script during a bailout. This magic value can then b… |
|
CVE-2019-9791
CRITICAL 9.8
The type inference system allows the compilation of functions that can cause type confusions between arbitrary objects when compiled through the IonMonkey just… |
|
CVE-2019-9790
CRITICAL 9.8
A use-after-free vulnerability can occur when a raw pointer to a DOM element on a page is obtained using JavaScript and the element is then removed while still… |
|
CVE-2019-9788
CRITICAL 9.8
Mozilla developers and community members reported memory safety bugs present in Firefox 65, Firefox ESR 60.5, and Thunderbird 60.5. Some of these bugs showed e… |
|
CVE-2018-18512
CRITICAL 9.8
A use-after-free vulnerability can occur while playing a sound notification in Thunderbird. The memory storing the sound data is immediately freed, although th… |
|
CVE-2019-0853
CRITICAL · vendor
GDI+ Remote Code Execution Vulnerability |
|
CVE-2019-0845
CRITICAL · vendor
Windows IOleCvt Interface Remote Code Execution Vulnerability |
|
CVE-2019-0795
CRITICAL · vendor
MS XML Remote Code Execution Vulnerability |
|
CVE-2019-0793
CRITICAL · vendor
MS XML Remote Code Execution Vulnerability |
Manage your fleet with Appaloosa
Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.