Vulnerabilities
Tracked app vulnerabilities
19,930 CVEs affect a tracked app or OS (all severities, Windows). 303 of them are in the CISA KEV catalog, meaning exploitation is confirmed.
- Matching CVEs
- 19,930
- Actively exploited
- 303
- Publication window
- 1997-01-01 → 2026-10-30
Chronological sort: newest to oldest. Use the KEV / severity filters above to prioritize.
| CVE |
|---|
|
CVE-2016-5174
MEDIUM 6.5
browser/ui/cocoa/browser_window_controller_private.mm in Google Chrome before 53.0.2785.113 does not process fullscreen toggle requests during a fullscreen tra… |
|
CVE-2016-5173
HIGH 7.1
The extensions subsystem in Google Chrome before 53.0.2785.113 does not properly restrict access to Object.prototype, which allows remote attackers to load uni… |
|
CVE-2016-5172
MEDIUM 6.5
The parser in Google V8, as used in Google Chrome before 53.0.2785.113, mishandles scopes, which allows remote attackers to obtain sensitive information from a… |
|
CVE-2016-5171
HIGH 8.8
WebKit/Source/bindings/templates/interface.cpp in Blink, as used in Google Chrome before 53.0.2785.113, does not prevent certain constructor calls, which allow… |
|
CVE-2016-5170
HIGH 8.8
WebKit/Source/bindings/modules/v8/V8BindingForModules.cpp in Blink, as used in Google Chrome before 53.0.2785.113, does not properly consider getter side effec… |
|
CVE-2016-3381
HIGH 7.8
Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Office Compatibility Pack SP3, and Excel Viewer allow remote attackers… |
|
CVE-2016-3377
HIGH 7.5
The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted… |
|
CVE-2016-3374
MEDIUM 6.5
The PDF library in Microsoft Edge, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold, 1511, and 1607 allows remote attackers to… |
|
CVE-2016-3370
MEDIUM 6.5
The PDF library in Microsoft Edge, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold, 1511, and 1607 allows remote attackers to… |
|
CVE-2016-3366
MEDIUM 6.5
Microsoft Outlook 2007 SP3, Outlook 2010 SP2, Outlook 2013 SP1, Outlook 2013 RT SP1, Outlook 2016, and Outlook 2016 for Mac do not properly implement RFC 2046,… |
|
CVE-2016-3365
HIGH 7.8
Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Office Compatibility Pack SP3, Excel Viewer, Excel Services on SharePo… |
|
CVE-2016-3363
HIGH 7.8
Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Office Compatibility Pack SP3, and Excel Viewer allow remote attackers… |
|
CVE-2016-3362
HIGH 7.8
Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Office Compatibility Pack SP3, Excel Viewer, Excel Services on SharePo… |
|
CVE-2016-3361
HIGH 7.8
Microsoft Excel 2010 SP2 allows remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office Memory Corruption Vulnerability." |
|
CVE-2016-3360
HIGH 7.8
Microsoft PowerPoint 2007 SP3, PowerPoint 2010 SP2, PowerPoint 2013 SP1, PowerPoint 2013 RT SP1, PowerPoint 2016 for Mac, Office Compatibility Pack SP3, PowerP… |
|
CVE-2016-3359
HIGH 7.8
Microsoft Excel 2007 SP3, Excel 2010 SP2, Office Compatibility Pack SP3, and Excel Viewer allow remote attackers to execute arbitrary code via a crafted docume… |
|
CVE-2016-3358
HIGH 7.8
Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Excel 2016 for Mac, Office Compatibility Pack SP3, Excel Viewer, Excel… |
|
CVE-2016-3357
HIGH 7.8
Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2013 RT SP1, Office 2016, Word for Mac 2011, Word 2016 for Mac, Word Viewer, Word Automatio… |
|
CVE-2016-3351
Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to obtain sensitive information via a crafted web site, aka "Microsoft Brows… |
|
CVE-2016-3350
HIGH 7.5
The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted… |
|
CVE-2016-3330
HIGH 7.5
Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Edge M… |
|
CVE-2016-3325
LOW 3.1
Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to obtain sensitive information via a crafted web site, aka "Microsoft Browser Informa… |
|
CVE-2016-3297
HIGH 8.8
Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) v… |
|
CVE-2016-3295
HIGH 7.5
Microsoft Internet Explorer 10 and 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via … |
|
CVE-2016-3294
HIGH 7.5
Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Edge M… |
|
CVE-2016-3291
LOW 2.4
Microsoft Internet Explorer 11 and Microsoft Edge mishandle cross-origin requests, which allows remote attackers to obtain sensitive information via a crafted … |
|
CVE-2016-3247
HIGH 7.5
Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craft… |
|
CVE-2016-0141
MEDIUM 6.5
The Visual Basic macros in Microsoft Office 2007 SP3, 2010 SP2, 2013 SP1, and 2016 export a certificate-store private key during a document-save operation, whi… |
|
CVE-2016-3375
CRITICAL · vendor
Scripting Engine Memory Corruption Vulnerability |
|
CVE-2016-3373
HIGH · vendor
Windows Kernel Local Elevation of Privilege Vulnerability |
|
CVE-2016-3371
HIGH · vendor
Windows Elevation of Privilege Vulnerability |
|
CVE-2016-3369
HIGH · vendor
Windows IPSec Denial of Service Vulnerability |
|
CVE-2016-3368
HIGH · vendor
Windows Remote Code Execution Vulnerability |
|
CVE-2016-3356
CRITICAL · vendor
GDI+ Remote Code Execution Vulnerability |
|
CVE-2016-3355
HIGH · vendor
Windows GDI Elevation of Privilege Vulnerability |
|
CVE-2016-3354
HIGH · vendor
GDI+ Information Disclosure Vulnerability |
|
CVE-2016-3352
HIGH · vendor
Windows Information Disclosure Vulnerability |
|
CVE-2016-3349
HIGH · vendor
Win32k Elevation of Privilege Vulnerability |
|
CVE-2016-3348
HIGH · vendor
Win32k Elevation of Privilege Vulnerability |
|
CVE-2016-3346
HIGH · vendor
Windows Permissions Enforcement Elevation of Privilege Vulnerability |
|
CVE-2016-3345
HIGH · vendor
Windows SMB Authenticated Remote Code Execution Vulnerability |
|
CVE-2016-3344
HIGH · vendor
Windows Secure Kernel Mode Information Disclosure Vulnerability |
|
CVE-2016-3306
HIGH · vendor
Windows Session Object Elevation of Privilege Vulnerability |
|
CVE-2016-3305
HIGH · vendor
Windows Session Object Elevation of Privilege Vulnerability |
|
CVE-2016-3302
HIGH · vendor
Windows Lock Screen Elevation of Privilege Vulnerability |
|
CVE-2016-7395
HIGH 8.8
SkPath.cpp in Skia, as used in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, does not properly validate the return va… |
|
CVE-2016-5167
HIGH 8.8
Multiple unspecified vulnerabilities in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux allow attackers to cause a denia… |
|
CVE-2016-5166
LOW 3.1
The download implementation in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux does not properly restrict saving a file:… |
|
CVE-2016-5165
MEDIUM 6.1
Cross-site scripting (XSS) vulnerability in the Developer Tools (aka DevTools) subsystem in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53… |
|
CVE-2016-5164
MEDIUM 6.1
Cross-site scripting (XSS) vulnerability in WebKit/Source/platform/v8_inspector/V8Debugger.cpp in Blink, as used in Google Chrome before 53.0.2785.89 on Window… |
Manage your fleet with Appaloosa
Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.