Vulnerabilities

Tracked app vulnerabilities

19,930 CVEs affect a tracked app or OS (all severities, Windows). 303 of them are in the CISA KEV catalog, meaning exploitation is confirmed.

Matching CVEs: 19,930
Actively exploited: 303
Publication window: 1997-01-01 → 2026-10-30

All CVEs 19,930 CISA KEV 303 Public exploit 566 All severities Critical High Medium Low Hide N/A

All platforms iOS Android macOS Windows

Chronological sort: newest to oldest. Use the KEV / severity filters above to prioritize.

19,930 entries Windows Clear all

CVE	Severity	KEV	Apps	Published
CVE-2017-0021 CRITICAL · vendor Windows 2017-03-14 Hyper-V vSMB Remote Code Execution Vulnerability	CRITICAL · vendor	—	Windows	2017-03-14
CVE-2017-0016 HIGH · vendor Windows 2017-03-14 Windows Denial of Service Vulnerability	HIGH · vendor	—	Windows	2017-03-14
CVE-2017-0014 CRITICAL · vendor Windows 2017-03-14 Windows Graphics Component Remote Code Execution Vulnerability	CRITICAL · vendor	—	Windows	2017-03-14
CVE-2017-0007 HIGH · vendor Windows 2017-03-14 Device Guard Security Feature Bypass Vulnerability	HIGH · vendor	—	Windows	2017-03-14
CVE-2017-0005 HIGH · vendor KEV Windows 2017-03-14 Windows GDI Elevation of Privilege Vulnerability	HIGH · vendor	KEV	Windows	2017-03-14
CVE-2017-0001 HIGH · vendor KEV Windows 2017-03-14 Windows GDI Elevation of Privilege Vulnerability	HIGH · vendor	KEV	Windows	2017-03-14
CVE-2017-0037 HIGH 8.1 KEV Microsoft Edge 2017-02-26 Microsoft Internet Explorer 10 and 11 and Microsoft Edge have a type confusion issue in the Layout::MultiColumnBoxBuilder::HandleColumnBreakOnColumnSpanningEle…	HIGH 8.1	KEV	Microsoft Edge	2017-02-26
CVE-2017-2356 HIGH 8.8 2017-02-20 An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. Safari before 10.0.3 is affected. iCloud before 6.1.1 is affected. iTunes bef…	HIGH 8.8	—		2017-02-20
CVE-2017-2355 HIGH 8.8 2017-02-20 An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. Safari before 10.0.3 is affected. iCloud before 6.1.1 is affected. iTunes bef…	HIGH 8.8	—		2017-02-20
CVE-2017-2354 HIGH 8.8 2017-02-20 An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. Safari before 10.0.3 is affected. iCloud before 6.1.1 is affected. iTunes bef…	HIGH 8.8	—		2017-02-20
CVE-2017-5026 MEDIUM 4.3 2017-02-17 Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, failed to prevent alerts from being displayed by swapped out frames, which allowed a remote att…	MEDIUM 4.3	—		2017-02-17
CVE-2017-5025 MEDIUM 5.5 2017-02-17 FFmpeg in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, failed to perform proper bounds checking, which allowed a remote attacker to potentia…	MEDIUM 5.5	—		2017-02-17
CVE-2017-5024 MEDIUM 5.5 2017-02-17 FFmpeg in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, failed to perform proper bounds checking, which allowed a remote attacker to potentia…	MEDIUM 5.5	—		2017-02-17
CVE-2017-5017 MEDIUM 4.3 2017-02-17 Interactions with the OS in Google Chrome prior to 56.0.2924.76 for Mac insufficiently cleared video memory, which allowed a remote attacker to possibly extrac…	MEDIUM 4.3	—		2017-02-17
CVE-2017-5013 MEDIUM 6.5 2017-02-17 Google Chrome prior to 56.0.2924.76 for Linux incorrectly handled new tab page navigations in non-selected tabs, which allowed a remote attacker to spoof the c…	MEDIUM 6.5	—		2017-02-17
CVE-2017-5011 MEDIUM 6.5 2017-02-17 Google Chrome prior to 56.0.2924.76 for Windows insufficiently sanitized DevTools URLs, which allowed a remote attacker who convinced a user to install a malic…	MEDIUM 6.5	—		2017-02-17
CVE-2016-5226 MEDIUM 6.1 2017-01-19 Blink in Google Chrome prior to 55.0.2883.75 for Linux, Windows and Mac executed javascript: URLs entered in the URL bar in the context of the current tab, whi…	MEDIUM 6.1	—		2017-01-19
CVE-2016-5214 MEDIUM 4.3 2017-01-19 Google Chrome prior to 55.0.2883.75 for Windows mishandled downloaded files, which allowed a remote attacker to prevent the downloaded file from receiving the …	MEDIUM 4.3	—		2017-01-19
CVE-2016-5205 MEDIUM 6.1 2017-01-19 Blink in Google Chrome prior to 55.0.2883.75 for Linux, Windows and Mac, incorrectly handles deferred page loads, which allowed a remote attacker to inject arb…	MEDIUM 6.1	—		2017-01-19
CVE-2016-5201 MEDIUM 6.5 2017-01-19 A leak of privateClass in the extensions API in Google Chrome prior to 54.0.2840.100 for Linux, and 54.0.2840.99 for Windows, and 54.0.2840.98 for Mac allowed …	MEDIUM 6.5	—		2017-01-19
CVE-2017-0003 HIGH 7.8 2017-01-10 Microsoft Word 2016 and SharePoint Enterprise Server 2016 allow remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office Memory…	HIGH 7.8	—		2017-01-10
CVE-2017-0002 HIGH 8.8 Microsoft Edge 2017-01-10 Microsoft Edge allows remote attackers to bypass the Same Origin Policy via vectors involving the about:blank URL and data: URLs, aka "Microsoft Edge Elevation…	HIGH 8.8	—	Microsoft Edge	2017-01-10
CVE-2016-7297 HIGH 7.5 Microsoft Edge 2016-12-20 The scripting engines in Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web sit…	HIGH 7.5	—	Microsoft Edge	2016-12-20
CVE-2016-7296 HIGH 7.5 Microsoft Edge 2016-12-20 The scripting engines in Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web sit…	HIGH 7.5	—	Microsoft Edge	2016-12-20
CVE-2016-7291 HIGH 7.1 2016-12-20 Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Office Compatibility Pack SP3, Word for Mac 2011, Word Automation Services on SharePoint Server 2010 S…	HIGH 7.1	—		2016-12-20
CVE-2016-7290 HIGH 7.1 2016-12-20 Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Office Compatibility Pack SP3, Word for Mac 2011, Word Automation Services on SharePoint Server 2010 S…	HIGH 7.1	—		2016-12-20
CVE-2016-7288 HIGH 7.5 Microsoft Edge 2016-12-20 The scripting engines in Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web sit…	HIGH 7.5	—	Microsoft Edge	2016-12-20
CVE-2016-7287 HIGH 7.5 Microsoft Edge 2016-12-20 The scripting engines in Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memor…	HIGH 7.5	—	Microsoft Edge	2016-12-20
CVE-2016-7286 HIGH 7.5 Microsoft Edge 2016-12-20 The scripting engines in Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web sit…	HIGH 7.5	—	Microsoft Edge	2016-12-20
CVE-2016-7282 MEDIUM 6.1 Microsoft Edge 2016-12-20 Cross-site scripting (XSS) vulnerability in Microsoft Internet Explorer 9 through 11 and Microsoft Edge allows remote attackers to inject arbitrary web script …	MEDIUM 6.1	—	Microsoft Edge	2016-12-20
CVE-2016-7281 MEDIUM 5.3 Microsoft Edge 2016-12-20 The Web Workers implementation in Microsoft Internet Explorer 10 and 11 and Microsoft Edge allows remote attackers to bypass the Same Origin Policy via unspeci…	MEDIUM 5.3	—	Microsoft Edge	2016-12-20
CVE-2016-7280 MEDIUM 6.1 Microsoft Edge 2016-12-20 Cross-site scripting (XSS) vulnerability in Microsoft Edge allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Microso…	MEDIUM 6.1	—	Microsoft Edge	2016-12-20
CVE-2016-7279 HIGH 7.5 Microsoft Edge 2016-12-20 Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) v…	HIGH 7.5	—	Microsoft Edge	2016-12-20
CVE-2016-7276 HIGH 7.1 2016-12-20 Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office for Mac 2011, and Office 2016 for Mac allow remote attackers to obtain sensitive informatio…	HIGH 7.1	—		2016-12-20
CVE-2016-7268 HIGH 7.1 2016-12-20 Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Office Compatibility Pack SP3, Word Viewer, Word for Mac 2011, Word Automation Services on SharePoint …	HIGH 7.1	—		2016-12-20
CVE-2016-7267 MEDIUM 5.5 2016-12-20 Microsoft Excel 2010 SP2, 2013 SP1, 2013 RT SP1, and 2016 misparses file formats, which makes it easier for remote attackers to execute arbitrary code via a cr…	MEDIUM 5.5	—		2016-12-20
CVE-2016-7266 HIGH 7.8 2016-12-20 Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Office Compatibility Pack SP3, Excel Viewer, and Excel 2016 for Mac mi…	HIGH 7.8	—		2016-12-20
CVE-2016-7265 HIGH 7.1 2016-12-20 Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Office Compatibility Pack SP3, Excel Viewer, Excel Services on SharePo…	HIGH 7.1	—		2016-12-20
CVE-2016-7264 HIGH 7.1 2016-12-20 Microsoft Excel 2007 SP3, Office Compatibility Pack SP3, Excel Viewer, Excel for Mac 2011, and Excel 2016 for Mac allow remote attackers to obtain sensitive in…	HIGH 7.1	—		2016-12-20
CVE-2016-7262 HIGH 7.8 KEV 2016-12-20 Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Office Compatibility Pack SP3, and Excel Viewer allow user-assisted re…	HIGH 7.8	KEV		2016-12-20
CVE-2016-7206 MEDIUM 6.1 Microsoft Edge 2016-12-20 Cross-site scripting (XSS) vulnerability in Microsoft Edge allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Microso…	MEDIUM 6.1	—	Microsoft Edge	2016-12-20
CVE-2016-7181 HIGH 7.5 Microsoft Edge 2016-12-20 Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Edge M…	HIGH 7.5	—	Microsoft Edge	2016-12-20
CVE-2016-5192 MEDIUM 6.5 2016-12-18 Blink in Google Chrome prior to 54.0.2840.59 for Windows missed a CORS check on redirect in TextTrackLoader, which allowed a remote attacker to bypass cross-or…	MEDIUM 6.5	—		2016-12-18
CVE-2016-5188 MEDIUM 4.3 2016-12-18 Multiple issues in Blink in Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux allow a remote attacker to spoof various parts of browser UI via cr…	MEDIUM 4.3	—		2016-12-18
CVE-2016-2334 HIGH 7.8 7-Zip 2016-12-13 Heap-based buffer overflow in the NArchive::NHfs::CHandler::ExtractZlibFile method in 7zip before 16.00 and p7zip allows remote attackers to execute arbitrary …	HIGH 7.8	—	7-Zip	2016-12-13
CVE-2016-7295 HIGH · vendor Windows 2016-12-13 Windows Common Log File System Driver Elevation of Privilege Vulnerability	HIGH · vendor	—	Windows	2016-12-13
CVE-2016-7292 HIGH · vendor Windows 2016-12-13 Windows Installer Elevation of Privilege Vulnerability	HIGH · vendor	—	Windows	2016-12-13
CVE-2016-7274 CRITICAL · vendor Windows 2016-12-13 Windows Uniscribe Remote Code Execution Vulnerability	CRITICAL · vendor	—	Windows	2016-12-13
CVE-2016-7273 CRITICAL · vendor Windows 2016-12-13 Windows Graphics Component Remote Code Execution Vulnerability	CRITICAL · vendor	—	Windows	2016-12-13
CVE-2016-7272 CRITICAL · vendor Windows 2016-12-13 Windows Graphics Component Remote Code Execution Vulnerability	CRITICAL · vendor	—	Windows	2016-12-13

Manage your fleet with Appaloosa

Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.

Discover Appaloosa MDM