Vulnerabilities
Tracked app vulnerabilities
19,930 CVEs affect a tracked app or OS (all severities, Windows). 303 of them are in the CISA KEV catalog, meaning exploitation is confirmed.
- Matching CVEs
- 19,930
- Actively exploited
- 303
- Publication window
- 1997-01-01 → 2026-10-30
Chronological sort: newest to oldest. Use the KEV / severity filters above to prioritize.
| CVE |
|---|
|
CVE-2019-0656
HIGH · vendor
Windows Kernel Elevation of Privilege Vulnerability |
|
CVE-2019-0637
HIGH · vendor
Windows Defender Firewall Security Feature Bypass Vulnerability |
|
CVE-2019-0636
HIGH · vendor
Windows Information Disclosure Vulnerability |
|
CVE-2019-0635
HIGH · vendor
Windows Hyper-V Information Disclosure Vulnerability |
|
CVE-2019-0633
HIGH · vendor
Windows SMB Remote Code Execution Vulnerability |
|
CVE-2019-0632
HIGH · vendor
Windows Security Feature Bypass Vulnerability |
|
CVE-2019-0631
HIGH · vendor
Windows Security Feature Bypass Vulnerability |
|
CVE-2019-0630
HIGH · vendor
Windows SMB Remote Code Execution Vulnerability |
|
CVE-2019-0628
HIGH · vendor
Win32k Information Disclosure Vulnerability |
|
CVE-2019-0627
HIGH · vendor
Windows Security Feature Bypass Vulnerability |
|
CVE-2019-0626
CRITICAL · vendor
Windows DHCP Server Remote Code Execution Vulnerability |
|
CVE-2019-0625
HIGH · vendor
Jet Database Engine Remote Code Execution Vulnerability |
|
CVE-2019-0623
HIGH · vendor
Win32k Elevation of Privilege Vulnerability |
|
CVE-2019-0621
HIGH · vendor
Windows Kernel Information Disclosure Vulnerability |
|
CVE-2019-0619
HIGH · vendor
Windows GDI Information Disclosure Vulnerability |
|
CVE-2019-0618
CRITICAL · vendor
GDI+ Remote Code Execution Vulnerability |
|
CVE-2019-0616
HIGH · vendor
Windows GDI Information Disclosure Vulnerability |
|
CVE-2019-0615
HIGH · vendor
Windows GDI Information Disclosure Vulnerability |
|
CVE-2019-0602
HIGH · vendor
Windows GDI Information Disclosure Vulnerability |
|
CVE-2019-0601
HIGH · vendor
HID Information Disclosure Vulnerability |
|
CVE-2019-0600
HIGH · vendor
HID Information Disclosure Vulnerability |
|
CVE-2019-0599
HIGH · vendor
Jet Database Engine Remote Code Execution Vulnerability |
|
CVE-2019-0598
HIGH · vendor
Jet Database Engine Remote Code Execution Vulnerability |
|
CVE-2019-0597
HIGH · vendor
Jet Database Engine Remote Code Execution Vulnerability |
|
CVE-2019-0596
HIGH · vendor
Jet Database Engine Remote Code Execution Vulnerability |
|
CVE-2019-0595
HIGH · vendor
Jet Database Engine Remote Code Execution Vulnerability |
|
CVE-2018-18505
CRITICAL 10.0
An earlier fix for an Inter-process Communication (IPC) vulnerability, CVE-2011-3079, added authentication to communication between IPC endpoints and server pa… |
|
CVE-2018-18501
CRITICAL 9.8
Mozilla developers and community members reported memory safety bugs present in Firefox 64 and Firefox ESR 60.4. Some of these bugs showed evidence of memory c… |
|
CVE-2018-18500
CRITICAL 9.8
A use-after-free vulnerability can occur while parsing an HTML5 stream in concert with custom HTML elements. This results in the stream parser object being fre… |
|
CVE-2018-20252
HIGH 7.8
In WinRAR versions prior to and including 5.60, there is an out-of-bounds write vulnerability during parsing of crafted ACE and RAR archive formats. Successful… |
|
CVE-2018-20251
MEDIUM 5.5
In WinRAR versions prior to and including 5.61, there is path traversal vulnerability when crafting the filename field of the ACE format. The UNACE module (UNA… |
|
CVE-2018-20250
In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field of the ACE format (in UNACEV2.dll). When… |
|
CVE-2019-7317
MEDIUM 5.3
png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called under png_safe_execute. |
|
CVE-2018-6179
MEDIUM 6.5
Insufficient enforcement of file access permission in the activeTab case in Extensions in Google Chrome prior to 68.0.3440.75 allowed an attacker who convinced… |
|
CVE-2018-6178
MEDIUM 4.3
Eliding from the wrong side in an infobar in DevTools in Google Chrome prior to 68.0.3440.75 allowed an attacker who convinced a user to install a malicious ex… |
|
CVE-2018-6175
MEDIUM 6.5
Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to perform domain spoofing via ID… |
|
CVE-2018-6174
HIGH 8.8
Integer overflows in Swiftshader in Google Chrome prior to 68.0.3440.75 potentially allowed a remote attacker to execute arbitrary code via a crafted HTML page. |
|
CVE-2018-6173
MEDIUM 6.5
Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to perform domain spoofing via ID… |
|
CVE-2018-6172
MEDIUM 6.5
Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to perform domain spoofing via ID… |
|
CVE-2018-6170
HIGH 8.8
A bad cast in PDFium in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. |
|
CVE-2018-6169
MEDIUM 6.5
Lack of timeout on extension install prompt in Extensions in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to trigger installation of an unwant… |
|
CVE-2018-6167
MEDIUM 6.5
Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to perform domain spoofing via ID… |
|
CVE-2018-6166
MEDIUM 6.5
Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to perform domain spoofing via ID… |
|
CVE-2018-6165
MEDIUM 6.5
Incorrect handling of reloads in Navigation in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via… |
|
CVE-2018-6164
MEDIUM 6.5
Insufficient origin checks for CSS content in Blink in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to leak cross-origin data via a crafted HT… |
|
CVE-2018-6163
MEDIUM 6.5
Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to perform domain spoofing via ID… |
|
CVE-2018-6162
HIGH 8.8
Improper deserialization in WebGL in Google Chrome on Mac prior to 68.0.3440.75 allowed a remote attacker to potentially exploit heap corruption via a crafted … |
|
CVE-2018-6160
MEDIUM 6.5
JavaScript alert handling in Prompts in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a craf… |
|
CVE-2018-6158
HIGH 7.5
A race condition in Oilpan in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
|
CVE-2018-6153
HIGH 8.8
A precision error in Skia in Google Chrome prior to 68.0.3440.75 allowed a remote attacker who had compromised the renderer process to perform an out of bounds… |
Manage your fleet with Appaloosa
Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.