Vulnerabilities
Tracked app vulnerabilities
19,931 CVEs affect a tracked app or OS (all severities, Windows). 303 of them are in the CISA KEV catalog, meaning exploitation is confirmed.
- Matching CVEs
- 19,931
- Actively exploited
- 303
- Publication window
- 1997-01-01 → 2026-10-30
Chronological sort: newest to oldest. Use the KEV / severity filters above to prioritize.
| CVE |
|---|
|
CVE-2019-1155
HIGH · vendor
Jet Database Engine Remote Code Execution Vulnerability |
|
CVE-2019-1153
HIGH · vendor
Microsoft Graphics Component Information Disclosure Vulnerability |
|
CVE-2019-1152
CRITICAL · vendor
Microsoft Graphics Remote Code Execution Vulnerability |
|
CVE-2019-1151
CRITICAL · vendor
Microsoft Graphics Remote Code Execution Vulnerability |
|
CVE-2019-1150
CRITICAL · vendor
Microsoft Graphics Remote Code Execution Vulnerability |
|
CVE-2019-1149
CRITICAL · vendor
Microsoft Graphics Remote Code Execution Vulnerability |
|
CVE-2019-1148
HIGH · vendor
Microsoft Graphics Component Information Disclosure Vulnerability |
|
CVE-2019-1147
HIGH · vendor
Jet Database Engine Remote Code Execution Vulnerability |
|
CVE-2019-1146
HIGH · vendor
Jet Database Engine Remote Code Execution Vulnerability |
|
CVE-2019-1145
CRITICAL · vendor
Microsoft Graphics Remote Code Execution Vulnerability |
|
CVE-2019-1144
CRITICAL · vendor
Microsoft Graphics Remote Code Execution Vulnerability |
|
CVE-2019-1143
HIGH · vendor
Windows Graphics Component Information Disclosure Vulnerability |
|
CVE-2019-1125
HIGH · vendor
Windows Kernel Information Disclosure Vulnerability |
|
CVE-2019-1078
HIGH · vendor
Microsoft Graphics Component Information Disclosure Vulnerability |
|
CVE-2019-1057
HIGH · vendor
MS XML Remote Code Execution Vulnerability |
|
CVE-2019-0965
CRITICAL · vendor
Windows Hyper-V Remote Code Execution Vulnerability |
|
CVE-2019-0736
CRITICAL · vendor
Windows DHCP Client Remote Code Execution Vulnerability |
|
CVE-2019-0723
HIGH · vendor
Windows Hyper-V Denial of Service Vulnerability |
|
CVE-2019-0720
CRITICAL · vendor
Hyper-V Remote Code Execution Vulnerability |
|
CVE-2019-0718
HIGH · vendor
Windows Hyper-V Denial of Service Vulnerability |
|
CVE-2019-0717
HIGH · vendor
Windows Hyper-V Denial of Service Vulnerability |
|
CVE-2019-0716
HIGH · vendor
Windows Denial of Service Vulnerability |
|
CVE-2019-0715
HIGH · vendor
Windows Hyper-V Denial of Service Vulnerability |
|
CVE-2019-0714
HIGH · vendor
Windows Hyper-V Denial of Service Vulnerability |
|
CVE-2019-5460
MEDIUM 5.5
Double Free in VLC versions <= 3.0.6 leads to a crash. |
|
CVE-2019-5459
HIGH 7.1
An Integer underflow in VLC Media Player versions < 3.0.7 leads to an out-of-band read. |
|
CVE-2019-9820
CRITICAL 9.8
A use-after-free vulnerability can occur in the chrome event handler when it is freed while still in use. This results in a potentially exploitable crash. This… |
|
CVE-2019-9819
CRITICAL 9.8
A vulnerability where a JavaScript compartment mismatch can occur while working with the fetch API, resulting in a potentially exploitable crash. This vulnerab… |
|
CVE-2019-9818
HIGH 8.3
A race condition is present in the crash generation server used to generate data for the crash reporter. This issue can lead to a use-after-free in the main pr… |
|
CVE-2019-9817
MEDIUM 5.3
Images from a different domain can be read using a canvas object in some circumstances. This could be used to steal image data from a different site in violati… |
|
CVE-2019-9816
MEDIUM 5.9
A possible vulnerability exists where type confusion can occur when manipulating JavaScript objects in object groups, allowing for the bypassing of security ch… |
|
CVE-2019-9815
HIGH 8.1
If hyperthreading is not disabled, a timing attack vulnerability exists, similar to previous Spectre attacks. Apple has shipped macOS 10.14.5 with an option to… |
|
CVE-2019-9811
HIGH 8.3
As part of a winning Pwn2Own entry, a researcher demonstrated a sandbox escape by installing a malicious language pack and then opening a browser feature that … |
|
CVE-2019-9800
CRITICAL 9.8
Mozilla developers and community members reported memory safety bugs present in Firefox 66, Firefox ESR 60.6, and Thunderbird 60.6. Some of these bugs showed e… |
|
CVE-2019-11730
MEDIUM 6.5
A vulnerability exists where if a user opens a locally saved HTML file, this file can use file: URIs to access other files in the same directory or sub-directo… |
|
CVE-2019-11729
HIGH 7.5
Empty or malformed p256-ECDH public keys may trigger a segmentation fault due values being improperly sanitized before being copied into memory and used. This … |
|
CVE-2019-11719
HIGH 7.5
When importing a curve25519 private key in PKCS#8format with leading 0x00 bytes, it is possible to trigger an out-of-bounds read in the Network Security Servic… |
|
CVE-2019-11717
MEDIUM 5.3
A vulnerability exists where the caret ("^") character is improperly escaped constructing some URIs due to it being used as a separator, allowing for possible … |
|
CVE-2019-11715
MEDIUM 6.1
Due to an error while parsing page content, it is possible for properly sanitized user input to be misinterpreted and lead to XSS hazards on web sites in certa… |
|
CVE-2019-11713
CRITICAL 9.8
A use-after-free vulnerability can occur in HTTP/2 when a cached HTTP/2 stream is closed while still in use, resulting in a potentially exploitable crash. This… |
|
CVE-2019-11712
HIGH 8.8
POST requests made by NPAPI plugins, such as Flash, that receive a status 308 redirect response can bypass CORS requirements. This can allow an attacker to per… |
|
CVE-2019-11711
HIGH 8.8
When an inner window is reused, it does not consider the use of document.domain for cross-origin protections. If pages on different subdomains ever cooperative… |
|
CVE-2019-11709
CRITICAL 9.8
Mozilla developers and community members reported memory safety bugs present in Firefox 67 and Firefox ESR 60.7. Some of these bugs showed evidence of memory c… |
|
CVE-2019-11708
CRITICAL 10.0
KEV
Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can result in the non-sandboxed parent process op… |
|
CVE-2019-11707
HIGH 8.8
KEV
A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow for an exploitable crash. We are aware… |
|
CVE-2019-11706
HIGH 7.5
A flaw in Thunderbird's implementation of iCal causes a type confusion in icaltimezone_get_vtimezone_properties when processing certain email messages, resulti… |
|
CVE-2019-11705
CRITICAL 9.8
A flaw in Thunderbird's implementation of iCal causes a stack buffer overflow in icalrecur_add_bydayrules when processing certain email messages, resulting in … |
|
CVE-2019-11704
CRITICAL 9.8
A flaw in Thunderbird's implementation of iCal causes a heap buffer overflow in icalmemory_strdup_and_dequote when processing certain email messages, resulting… |
|
CVE-2019-11703
CRITICAL 9.8
A flaw in Thunderbird's implementation of iCal causes a heap buffer overflow in parser_get_next_char when processing certain email messages, resulting in a pot… |
|
CVE-2019-11698
MEDIUM 5.3
If a crafted hyperlink is dragged and dropped to the bookmark bar or sidebar and the resulting bookmark is subsequently dragged and dropped into the web conten… |
Manage your fleet with Appaloosa
Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.