Vulnerabilities
Tracked app vulnerabilities
1,721 CVEs affect a tracked app or OS (Critical, Windows). 37 of them are in the CISA KEV catalog, meaning exploitation is confirmed.
- Matching CVEs
- 1,721
- Actively exploited
- 37
- Publication window
- 2007-08-28 → 2026-11-10
Chronological sort: newest to oldest. Use the KEV / severity filters above to prioritize.
| CVE |
|---|
|
CVE-2026-118305
CRITICAL 9.6
Type confusion in Turbolev in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML pa… |
|
CVE-2026-118177
CRITICAL 9.1
When looking for calendars in a directory on a server, during account setup or when adding a new network calendar, Thunderbird accepted calendar locations poin… |
|
CVE-2026-118027
CRITICAL 9.1
Frame poisoning in the Layout component. This vulnerability was fixed in Firefox ESR 115.44. |
|
CVE-2026-117997
CRITICAL 9.6
Sandbox escape due to use-after-free in the Widget component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird … |
|
CVE-2026-117990
CRITICAL 9.6
Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thund… |
|
CVE-2026-117988
CRITICAL 9.6
Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thu… |
|
CVE-2026-117985
CRITICAL 9.6
Sandbox escape due to use-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbir… |
|
CVE-2026-117982
CRITICAL 9.8
Invalid pointer in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. |
|
CVE-2026-117981
CRITICAL 9.8
Privilege escalation in the Toolkit component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. |
|
CVE-2026-117980
CRITICAL 9.8
Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. |
|
CVE-2026-117971
CRITICAL 9.6
Sandbox escape due to use-after-free in the Print Preview component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunde… |
|
CVE-2026-117962
CRITICAL 9.6
Sandbox escape due to incorrect boundary conditions in the Storage: Quota Manager component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Th… |
|
CVE-2026-117946
CRITICAL 9.8
Incorrect boundary conditions in the JavaScript Engine component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbi… |
|
CVE-2026-117945
CRITICAL 9.8
Incorrect boundary conditions in the XML component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. |
|
CVE-2026-117920
CRITICAL 9.6
Use-after-free in the DOM: HTML Parser component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. |
|
CVE-2026-117917
CRITICAL 9.8
Invalid pointer in the Graphics: WebRender component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and … |
|
CVE-2026-117868
CRITICAL 9.6
Sandbox escape in the DOM: Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thund… |
|
CVE-2026-117862
CRITICAL 9.8
Privilege escalation due to incorrect boundary conditions in the Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox… |
|
CVE-2026-117861
CRITICAL 9.6
Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. |
|
CVE-2026-113342
CRITICAL 9.6
Privilege elevation in Network in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass web origin policy via … |
|
CVE-2026-113336
CRITICAL 9.6
Use after free in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML… |
|
CVE-2026-113328
CRITICAL 9.6
Improper resource exposure in Privacy in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (C… |
|
CVE-2026-113300
CRITICAL 9.6
Observable discrepancy in Forms in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to leak sensitive information v… |
|
CVE-2026-113283
CRITICAL 9.6
Improper privilege management in CredentialProvider in Google Chrome on on Windows prior to 156.0.8078.47 allowed a local attacker to execute arbitrary code ou… |
|
CVE-2026-113270
CRITICAL 9.6
Missing authorization in Internals in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bypass site is… |
|
CVE-2026-113263
CRITICAL 9.6
Missing authorization in Core in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to obtain cross-ori… |
|
CVE-2026-113261
CRITICAL 9.6
Improper input validation in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system ac… |
|
CVE-2026-113252
CRITICAL 9.6
Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to rea… |
|
CVE-2026-113235
CRITICAL 9.6
Missing authorization in Passwords in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and leveraged soc… |
|
CVE-2026-113222
CRITICAL 9.6
Missing authorization in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium se… |
|
CVE-2026-113211
CRITICAL 9.6
Incorrect authorization in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bypass s… |
|
CVE-2026-113189
CRITICAL 9.6
Improper input validation in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to spoof UI elemen… |
|
CVE-2026-113186
CRITICAL 9.6
Missing authorization in DevTools in Google Chrome prior to 156.0.8078.47 allowed a local attacker to bypass system access restrictions via a local program. (C… |
|
CVE-2026-113171
CRITICAL 9.6
UI misrepresentation in Prompts in Google Chrome on on Android prior to 156.0.8078.47 allowed a local attacker leveraging social engineering to spoof UI elemen… |
|
CVE-2026-113169
CRITICAL 9.6
UI misrepresentation in WebAppInstalls in Google Chrome on on Android prior to 156.0.8078.47 allowed a local attacker leveraging social engineering to spoof UI… |
|
CVE-2026-113138
CRITICAL 9.6
UI misrepresentation in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spoof address bar via… |
|
CVE-2026-113126
CRITICAL 9.6
Improper resource exposure in PolicyContainer in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy into a privileged p… |
|
CVE-2026-113116
CRITICAL 9.6
Missing authorization in DevTools in Google Chrome prior to 156.0.8078.47 allowed a local attacker to bypass system access restrictions via a crafted Chrome ex… |
|
CVE-2026-113089
CRITICAL 9.6
Incorrect authorization in PrintPreview in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain sensitive information via a crafted Chrome … |
|
CVE-2026-113084
CRITICAL 9.6
Incorrect authorization in Permissions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system access … |
|
CVE-2026-113078
CRITICAL 9.6
Race condition in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to potentially execute… |
|
CVE-2026-113072
CRITICAL 9.6
Use after free in CSS in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (… |
|
CVE-2026-113056
CRITICAL 9.6
Observable discrepancy in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. … |
|
CVE-2026-113023
CRITICAL 9.6
Incorrect authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass system access restrictions via a crafted Chro… |
|
CVE-2026-113020
CRITICAL 9.6
Use after free in Date in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. … |
|
CVE-2026-113014
CRITICAL 9.6
Missing authorization in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain cross-origin data via a crafted HTML page.… |
|
CVE-2026-113007
CRITICAL 9.6
Incorrect calculation in Permissions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass system access restrictions via a crafted HTML … |
|
CVE-2026-112992
CRITICAL 9.6
Observable discrepancy in Canvas in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium… |
|
CVE-2026-113867
CRITICAL 9.1
Thunderbird did not escape attribute values when serializing outgoing XMPP stanzas. Because values from incoming requests were echoed back in automatic replies… |
|
CVE-2026-113399
CRITICAL 9.8
Incorrect boundary conditions in the SVG component. This vulnerability was fixed in Firefox 158.0.1 and Thunderbird 158.0.1. |
Manage your fleet with Appaloosa
Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.