Vulnerabilities
Tracked app vulnerabilities
1,726 CVEs affect a tracked app or OS (Critical, Windows). 37 of them are in the CISA KEV catalog, meaning exploitation is confirmed.
- Matching CVEs
- 1,726
- Actively exploited
- 37
- Publication window
- 2007-08-28 → 2026-11-11
Chronological sort: newest to oldest. Use the KEV / severity filters above to prioritize.
| CVE |
|---|
|
CVE-2019-0792
CRITICAL · vendor
MS XML Remote Code Execution Vulnerability |
|
CVE-2019-0791
CRITICAL · vendor
MS XML Remote Code Execution Vulnerability |
|
CVE-2019-0790
CRITICAL · vendor
MS XML Remote Code Execution Vulnerability |
|
CVE-2019-0786
CRITICAL · vendor
Hyper-V vSMB Remote Code Execution Vulnerability |
|
CVE-2019-9948
CRITICAL 9.1
urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist … |
|
CVE-2019-0784
CRITICAL · vendor
Windows ActiveX Remote Code Execution Vulnerability |
|
CVE-2019-0756
CRITICAL · vendor
MS XML Remote Code Execution Vulnerability |
|
CVE-2019-0726
CRITICAL · vendor
Windows DHCP Client Remote Code Execution Vulnerability |
|
CVE-2019-0698
CRITICAL · vendor
Windows DHCP Client Remote Code Execution Vulnerability |
|
CVE-2019-0697
CRITICAL · vendor
Windows DHCP Client Remote Code Execution Vulnerability |
|
CVE-2019-0603
CRITICAL · vendor
Windows Deployment Services TFTP Server Remote Code Execution Vulnerability |
|
CVE-2019-9636
CRITICAL 9.8
Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization. T… |
|
CVE-2018-18498
CRITICAL 9.8
A potential vulnerability leading to an integer overflow can occur during buffer size calculations for images when a raw value is used instead of the checked v… |
|
CVE-2018-18493
CRITICAL 9.8
A buffer overflow can occur in the Skia library during buffer offset calculations with hardware accelerated canvas 2D actions due to the use of 32-bit calculat… |
|
CVE-2018-18492
CRITICAL 9.8
A use-after-free vulnerability can occur after deleting a selection element due to a weak reference to the select element in the options collection. This resul… |
|
CVE-2018-12405
CRITICAL 9.8
Mozilla developers and community members reported memory safety bugs present in Firefox 63 and Firefox ESR 60.3. Some of these bugs showed evidence of memory c… |
|
CVE-2018-12392
CRITICAL 9.8
When manipulating user events in nested loops while opening a document through script, it is possible to trigger a potentially exploitable crash due to poor ev… |
|
CVE-2018-12390
CRITICAL 9.8
Mozilla developers and community members reported memory safety bugs present in Firefox 62 and Firefox ESR 60.2. Some of these bugs showed evidence of memory c… |
|
CVE-2019-5759
CRITICAL 9.6
Incorrect lifetime handling in HTML select elements in Google Chrome on Android and Mac prior to 72.0.3626.81 allowed a remote attacker to potentially perform … |
|
CVE-2019-0662
CRITICAL · vendor
GDI+ Remote Code Execution Vulnerability |
|
CVE-2019-0626
CRITICAL · vendor
Windows DHCP Server Remote Code Execution Vulnerability |
|
CVE-2019-0618
CRITICAL · vendor
GDI+ Remote Code Execution Vulnerability |
|
CVE-2018-18505
CRITICAL 10.0
An earlier fix for an Inter-process Communication (IPC) vulnerability, CVE-2011-3079, added authentication to communication between IPC endpoints and server pa… |
|
CVE-2018-18501
CRITICAL 9.8
Mozilla developers and community members reported memory safety bugs present in Firefox 64 and Firefox ESR 60.4. Some of these bugs showed evidence of memory c… |
|
CVE-2018-18500
CRITICAL 9.8
A use-after-free vulnerability can occur while parsing an HTML5 stream in concert with custom HTML elements. This results in the stream parser object being fre… |
|
CVE-2018-6127
CRITICAL 9.6
Early free of object in use in IndexDB in Google Chrome prior to 67.0.3396.62 allowed a remote attacker who had compromised the renderer process to potentially… |
|
CVE-2018-16068
CRITICAL 9.6
Missing validation in Mojo in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. |
|
CVE-2017-15402
CRITICAL 9.6
Using an ID that can be controlled by a compromised renderer which allows any frame to overwrite the page_state of any other frame in the same process in Navig… |
|
CVE-2019-0551
CRITICAL · vendor
Windows Hyper-V Remote Code Execution Vulnerability |
|
CVE-2019-0550
CRITICAL · vendor
Windows Hyper-V Remote Code Execution Vulnerability |
|
CVE-2019-0547
CRITICAL · vendor
Windows DHCP Client Remote Code Execution Vulnerability |
|
CVE-2018-8634
CRITICAL · vendor
Microsoft Text-To-Speech Remote Code Execution Vulnerability |
|
CVE-2018-8626
CRITICAL · vendor
Windows DNS Server Heap Overflow Vulnerability |
|
CVE-2018-19857
CRITICAL 9.1
The CAF demuxer in modules/demux/caf.c in VideoLAN VLC media player 3.0.4 may read memory from an uninitialized pointer when processing magic cookies in CAF fi… |
|
CVE-2018-6152
CRITICAL 9.6
The implementation of the Page.downloadBehavior backend unconditionally marked downloaded files as safe, regardless of file type in Google Chrome prior to 66.0… |
|
CVE-2018-17472
CRITICAL 9.6
Incorrect handling of googlechrome:// URL scheme on iOS in Intents in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to escape the <iframe> sand… |
|
CVE-2018-17462
CRITICAL 9.6
Incorrect refcounting in AppCache in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to perform a sandbox escape via a crafted HTML page. |
|
CVE-2018-8553
CRITICAL · vendor
Microsoft Graphics Components Remote Code Execution Vulnerability |
|
CVE-2018-8544
CRITICAL · vendor
Windows VBScript Engine Remote Code Execution Vulnerability |
|
CVE-2018-8476
CRITICAL · vendor
Windows Deployment Services TFTP Server Remote Code Execution Vulnerability |
|
CVE-2018-5188
CRITICAL 9.8
Memory safety bugs present in Firefox 60, Firefox ESR 60, and Firefox ESR 52.8. Some of these bugs showed evidence of memory corruption and we presume that wit… |
|
CVE-2018-5187
CRITICAL 9.8
Memory safety bugs present in Firefox 60 and Firefox ESR 60. Some of these bugs showed evidence of memory corruption and we presume that with enough effort tha… |
|
CVE-2018-5156
CRITICAL 9.8
A vulnerability can occur when capturing a media stream when the media source type is changed as the capture is occurring. This can result in stream data being… |
|
CVE-2018-12378
CRITICAL 9.8
A use-after-free vulnerability can occur when an IndexedDB index is deleted while still in use by JavaScript code that is providing payload values to be stored… |
|
CVE-2018-12377
CRITICAL 9.8
A use-after-free vulnerability can occur when refresh driver timers are refreshed in some circumstances during shutdown when the timer is deleted while still i… |
|
CVE-2018-12376
CRITICAL 9.8
Memory safety bugs present in Firefox 61 and Firefox ESR 60.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort t… |
|
CVE-2018-8494
CRITICAL · vendor
MS XML Remote Code Execution Vulnerability |
|
CVE-2018-8490
CRITICAL · vendor
Windows Hyper-V Remote Code Execution Vulnerability |
|
CVE-2018-8489
CRITICAL · vendor
Windows Hyper-V Remote Code Execution Vulnerability |
|
CVE-2018-1000802
CRITICAL 9.8
Python Software Foundation Python (CPython) version 2.7 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') … |
Manage your fleet with Appaloosa
Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.