Vulnerabilities
Tracked app vulnerabilities
19,930 CVEs affect a tracked app or OS (all severities, Windows). 303 of them are in the CISA KEV catalog, meaning exploitation is confirmed.
- Matching CVEs
- 19,930
- Actively exploited
- 303
- Publication window
- 1997-01-01 → 2026-10-30
Chronological sort: newest to oldest. Use the KEV / severity filters above to prioritize.
| CVE |
|---|
|
CVE-2019-0893
HIGH · vendor
Jet Database Engine Remote Code Execution Vulnerability |
|
CVE-2019-0892
HIGH · vendor
Win32k Elevation of Privilege Vulnerability |
|
CVE-2019-0891
HIGH · vendor
Jet Database Engine Remote Code Execution Vulnerability |
|
CVE-2019-0890
HIGH · vendor
Jet Database Engine Remote Code Execution Vulnerability |
|
CVE-2019-0889
HIGH · vendor
Jet Database Engine Remote Code Execution Vulnerability |
|
CVE-2019-0886
HIGH · vendor
Windows Hyper-V Information Disclosure Vulnerability |
|
CVE-2019-0885
HIGH · vendor
Windows OLE Remote Code Execution Vulnerability |
|
CVE-2019-0882
HIGH · vendor
Windows GDI Information Disclosure Vulnerability |
|
CVE-2019-0881
HIGH · vendor
Windows Kernel Elevation of Privilege Vulnerability |
|
CVE-2019-0863
Windows Error Reporting Elevation of Privilege Vulnerability |
|
CVE-2019-0758
HIGH · vendor
Windows GDI Information Disclosure Vulnerability |
|
CVE-2019-0734
HIGH · vendor
Windows Elevation of Privilege Vulnerability |
|
CVE-2019-0733
HIGH · vendor
Windows Defender Application Control Security Feature Bypass Vulnerability |
|
CVE-2019-0727
HIGH · vendor
Diagnostic Hub Standard Collector, Visual Studio Standard Collector Elevation of Privilege Vulnerability |
|
CVE-2019-0725
CRITICAL · vendor
Windows DHCP Server Remote Code Execution Vulnerability |
|
CVE-2019-0707
HIGH · vendor
Windows NDIS Elevation of Privilege Vulnerability |
|
CVE-2018-18524
MEDIUM 6.1
Evernote 6.15 on Windows has an incorrectly repaired stored XSS vulnerability. An attacker can use this XSS issue to inject Node.js code under Present mode. Af… |
|
CVE-2019-9813
HIGH 8.8
Incorrect handling of __proto__ mutations may lead to type confusion in IonMonkey JIT code and can be leveraged for arbitrary memory read and write. This vulne… |
|
CVE-2019-9810
HIGH 8.8
Incorrect alias information in IonMonkey JIT compiler for Array.prototype.slice method may lead to missing bounds check and a buffer overflow. This vulnerabili… |
|
CVE-2019-9801
MEDIUM 5.3
Firefox will accept any registered Program ID as an external protocol handler and offer to launch this local application when given a matching URL on Windows o… |
|
CVE-2019-9796
CRITICAL 9.8
A use-after-free vulnerability can occur when the SMIL animation controller incorrectly registers with the refresh driver twice when only a single registration… |
|
CVE-2019-9795
CRITICAL 9.8
A vulnerability where type-confusion in the IonMonkey just-in-time (JIT) compiler could potentially be used by malicious JavaScript to trigger a potentially ex… |
|
CVE-2019-9794
CRITICAL 9.8
A vulnerability was discovered where specific command line arguments are not properly discarded during Firefox invocation as a shell handler for URLs. This cou… |
|
CVE-2019-9793
MEDIUM 5.9
A mechanism was discovered that removes some bounds checking for string, array, or typed array accesses if Spectre mitigations have been disabled. This vulnera… |
|
CVE-2019-9792
CRITICAL 9.8
The IonMonkey just-in-time (JIT) compiler can leak an internal JS_OPTIMIZED_OUT magic value to the running script during a bailout. This magic value can then b… |
|
CVE-2019-9791
CRITICAL 9.8
The type inference system allows the compilation of functions that can cause type confusions between arbitrary objects when compiled through the IonMonkey just… |
|
CVE-2019-9790
CRITICAL 9.8
A use-after-free vulnerability can occur when a raw pointer to a DOM element on a page is obtained using JavaScript and the element is then removed while still… |
|
CVE-2019-9788
CRITICAL 9.8
Mozilla developers and community members reported memory safety bugs present in Firefox 65, Firefox ESR 60.5, and Thunderbird 60.5. Some of these bugs showed e… |
|
CVE-2018-18513
HIGH 7.5
A crash can occur when processing a crafted S/MIME message or an XPI package containing a crafted signature. This can be used as a denial-of-service (DOS) atta… |
|
CVE-2018-18512
CRITICAL 9.8
A use-after-free vulnerability can occur while playing a sound notification in Thunderbird. The memory storing the sound data is immediately freed, although th… |
|
CVE-2018-18509
MEDIUM 5.3
A flaw during verification of certain S/MIME signatures causes emails to be shown in Thunderbird as having a valid digital signature, even if the shown message… |
|
CVE-2019-0861
HIGH 7.5
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Eng… |
|
CVE-2019-0860
HIGH 7.5
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Eng… |
|
CVE-2019-0833
MEDIUM 6.5
An information disclosure vulnerability exists when Microsoft Edge improperly handles objects in memory, aka 'Microsoft Edge Information Disclosure Vulnerabili… |
|
CVE-2019-0829
HIGH 7.5
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Eng… |
|
CVE-2019-0828
HIGH 7.8
A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Excel Rem… |
|
CVE-2019-0812
HIGH 7.5
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Eng… |
|
CVE-2019-0810
HIGH 7.5
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Eng… |
|
CVE-2019-0806
HIGH 7.5
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Eng… |
|
CVE-2019-0764
MEDIUM 6.5
A tampering vulnerability exists when Microsoft browsers do not properly validate input under specific conditions, aka 'Microsoft Browsers Tampering Vulnerabil… |
|
CVE-2019-0739
HIGH 7.5
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka 'Scripting Engine Memory Cor… |
|
CVE-2019-0879
HIGH · vendor
Jet Database Engine Remote Code Execution Vulnerability |
|
CVE-2019-0877
HIGH · vendor
Jet Database Engine Remote Code Execution Vulnerability |
|
CVE-2019-0859
Win32k Elevation of Privilege Vulnerability |
|
CVE-2019-0856
HIGH · vendor
Windows Remote Code Execution Vulnerability |
|
CVE-2019-0853
CRITICAL · vendor
GDI+ Remote Code Execution Vulnerability |
|
CVE-2019-0851
HIGH · vendor
Jet Database Engine Remote Code Execution Vulnerability |
|
CVE-2019-0849
HIGH · vendor
Windows GDI Information Disclosure Vulnerability |
|
CVE-2019-0848
HIGH · vendor
Win32k Information Disclosure Vulnerability |
|
CVE-2019-0847
HIGH · vendor
Jet Database Engine Remote Code Execution Vulnerability |
Manage your fleet with Appaloosa
Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.