Vulnerabilities
Tracked app vulnerabilities
1,726 CVEs affect a tracked app or OS (Critical, Windows). 37 of them are in the CISA KEV catalog, meaning exploitation is confirmed.
- Matching CVEs
- 1,726
- Actively exploited
- 37
- Publication window
- 2007-08-28 → 2026-11-11
Chronological sort: newest to oldest. Use the KEV / severity filters above to prioritize.
| CVE |
|---|
|
CVE-2017-0021
CRITICAL · vendor
Hyper-V vSMB Remote Code Execution Vulnerability |
|
CVE-2017-0014
CRITICAL · vendor
Windows Graphics Component Remote Code Execution Vulnerability |
|
CVE-2016-7274
CRITICAL · vendor
Windows Uniscribe Remote Code Execution Vulnerability |
|
CVE-2016-7273
CRITICAL · vendor
Windows Graphics Component Remote Code Execution Vulnerability |
|
CVE-2016-7272
CRITICAL · vendor
Windows Graphics Component Remote Code Execution Vulnerability |
|
CVE-2016-9535
CRITICAL 9.8
tif_predict.h and tif_predict.c in libtiff 4.0.6 have assertions that can lead to assertion failures in debug mode, or buffer overflows in release mode, when d… |
|
CVE-2016-7256
Microsoft Graphics Remote Code Execution Vulnerability |
|
CVE-2016-7248
CRITICAL · vendor
Microsoft Video Control Remote Code Execution Vulnerability |
|
CVE-2016-7212
CRITICAL · vendor
Windows Remote Code Execution Vulnerability |
|
CVE-2016-7205
CRITICAL · vendor
Windows Animation Manager Memory Corruption Vulnerability |
|
CVE-2016-3396
CRITICAL · vendor
GDI+ Remote Code Execution Vulnerability |
|
CVE-2016-3393
GDI+ Remote Code Execution Vulnerability |
|
CVE-2016-0142
CRITICAL · vendor
Microsoft Video Control Remote Code Execution Vulnerability |
|
CVE-2016-3375
CRITICAL · vendor
Scripting Engine Memory Corruption Vulnerability |
|
CVE-2016-3356
CRITICAL · vendor
GDI+ Remote Code Execution Vulnerability |
|
CVE-2016-5636
CRITICAL 9.8
Integer overflow in the get_data function in zipimport.c in CPython (aka Python) before 2.7.12, 3.x before 3.4.5, and 3.5.x before 3.5.2 allows remote attacker… |
|
CVE-2016-3301
CRITICAL · vendor
Microsoft Graphics Remote Code Execution Vulnerability |
|
CVE-2016-5146
CRITICAL 9.8
Multiple unspecified vulnerabilities in Google Chrome before 52.0.2743.116 allow attackers to cause a denial of service or possibly have other impact via unkno… |
|
CVE-2016-5144
CRITICAL 9.8
The Developer Tools (aka DevTools) subsystem in Blink, as used in Google Chrome before 52.0.2743.116, mishandles the script-path hostname, remoteBase parameter… |
|
CVE-2016-5143
CRITICAL 9.8
The Developer Tools (aka DevTools) subsystem in Blink, as used in Google Chrome before 52.0.2743.116, mishandles the script-path hostname, remoteBase parameter… |
|
CVE-2016-5142
CRITICAL 9.8
The Web Cryptography API (aka WebCrypto) implementation in Blink, as used in Google Chrome before 52.0.2743.116, does not properly copy data buffers, which all… |
|
CVE-2016-5140
CRITICAL 9.8
Heap-based buffer overflow in the opj_j2k_read_SQcd_SQcc function in j2k.c in OpenJPEG, as used in PDFium in Google Chrome before 52.0.2743.116, allows remote … |
|
CVE-2016-1706
CRITICAL 9.6
The PPAPI implementation in Google Chrome before 52.0.2743.82 does not validate the origin of IPC messages to the plugin broker process that should have come f… |
|
CVE-2016-3238
CRITICAL · vendor
Windows Print Spooler Remote Code Execution Vulnerability |
|
CVE-2016-3236
CRITICAL 9.8
The Web Proxy Auto Discovery (WPAD) protocol implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Win… |
|
CVE-2016-0718
CRITICAL 9.8
Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a malformed input document, which triggers… |
|
CVE-2016-1666
CRITICAL 9.8
Multiple unspecified vulnerabilities in Google Chrome before 50.0.2661.94 allow attackers to cause a denial of service or possibly have other impact via unknow… |
|
CVE-2016-1662
CRITICAL 9.8
extensions/renderer/gc_callback.cc in Google Chrome before 50.0.2661.94 does not prevent fallback execution once the Garbage Collection callback has started, w… |
|
CVE-2016-1659
CRITICAL 9.8
Multiple unspecified vulnerabilities in Google Chrome before 50.0.2661.75 allow attackers to cause a denial of service or possibly have other impact via unknow… |
|
CVE-2016-2315
CRITICAL 9.8
revision.c in git before 2.7.4 uses an incorrect integer data type, which allows remote attackers to execute arbitrary code via a (1) long filename or (2) many… |
|
CVE-2016-2843
CRITICAL 9.8
Multiple unspecified vulnerabilities in Google V8 before 4.9.385.26, as used in Google Chrome before 49.0.2623.75, allow attackers to cause a denial of service… |
|
CVE-2016-1642
CRITICAL 9.8
Multiple unspecified vulnerabilities in Google Chrome before 49.0.2623.75 allow attackers to cause a denial of service or possibly have other impact via unknow… |
|
CVE-2016-1639
CRITICAL 9.8
Use-after-free vulnerability in browser/extensions/api/webrtc_audio_private/webrtc_audio_private_api.cc in the WebRTC Audio Private API implementation in Googl… |
|
CVE-2016-1636
CRITICAL 9.8
The PendingScript::notifyFinished function in WebKit/Source/core/dom/PendingScript.cpp in Google Chrome before 49.0.2623.75 relies on memory-cache information … |
|
CVE-2016-1635
CRITICAL 9.8
extensions/renderer/render_frame_observer_natives.cc in Google Chrome before 49.0.2623.75 does not properly consider object lifetimes and re-entrancy issues du… |
|
CVE-2016-1633
CRITICAL 9.8
Use-after-free vulnerability in Blink, as used in Google Chrome before 49.0.2623.75, allows remote attackers to cause a denial of service or possibly have unsp… |
|
CVE-2016-1629
CRITICAL 9.8
Google Chrome before 48.0.2564.116 allows remote attackers to bypass the Blink Same Origin Policy and a sandbox protection mechanism via unspecified vectors. |
|
CVE-2016-2051
CRITICAL 9.8
Multiple unspecified vulnerabilities in Google V8 before 4.8.271.17, as used in Google Chrome before 48.0.2564.82, allow attackers to cause a denial of service… |
|
CVE-2016-0003
CRITICAL 9.6
Microsoft Edge allows remote attackers to execute arbitrary code via unspecified vectors, aka "Microsoft Edge Memory Corruption Vulnerability." |
|
CVE-2015-6792
CRITICAL 9.8
The MIDI subsystem in Google Chrome before 47.0.2526.106 does not properly handle the sending of data, which allows remote attackers to execute arbitrary code … |
|
CVE-2015-6764
CRITICAL 9.8
The BasicJsonStringifier::SerializeJSArray function in json-stringifier.h in the JSON stringifier in Google V8, as used in Google Chrome before 47.0.2526.73, i… |
|
CVE-2015-1276
CRITICAL 9.8
Use-after-free vulnerability in content/browser/indexed_db/indexed_db_backing_store.cc in the IndexedDB implementation in Google Chrome before 44.0.2403.89 all… |
|
CVE-2015-0313
CRITICAL 9.8
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Lin… |
|
CVE-2015-0311
CRITICAL 9.8
Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Windows and OS X and through 11.2.202.438 on … |
|
CVE-2014-1532
CRITICAL 9.8
Use-after-free vulnerability in the nsHostResolver::ConditionallyRefreshRecord function in libxul.so in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24… |
|
CVE-2014-1524
CRITICAL 9.8
The nsXBLProtoImpl::InstallImplementation function in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before … |
|
CVE-2014-1514
CRITICAL 9.8
vmtypedarrayobject.cpp in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 does not validate the l… |
|
CVE-2014-1511
CRITICAL 9.8
Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remote attackers to bypass the popup blocke… |
|
CVE-2014-1510
CRITICAL 9.8
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attac… |
|
CVE-2014-1508
CRITICAL 9.1
The libxul.so!gfxContext::Polygon function in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 all… |
Manage your fleet with Appaloosa
Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.