Vulnerabilities
Tracked app vulnerabilities
19,930 CVEs affect a tracked app or OS (all severities, Windows). 303 of them are in the CISA KEV catalog, meaning exploitation is confirmed.
- Matching CVEs
- 19,930
- Actively exploited
- 303
- Publication window
- 1997-01-01 → 2026-10-30
Chronological sort: newest to oldest. Use the KEV / severity filters above to prioritize.
| CVE |
|---|
|
CVE-2016-5162
MEDIUM 6.5
The AllowCrossRendererResourceLoad function in extensions/browser/url_request_util.cc in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.… |
|
CVE-2016-5161
HIGH 8.8
The EditingStyle::mergeStyle function in WebKit/Source/core/editing/EditingStyle.cpp in Blink, as used in Google Chrome before 53.0.2785.89 on Windows and OS X… |
|
CVE-2016-5160
MEDIUM 6.5
The AllowCrossRendererResourceLoad function in extensions/browser/url_request_util.cc in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.… |
|
CVE-2016-5159
HIGH 8.8
Multiple integer overflows in OpenJPEG, as used in PDFium in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, allow remo… |
|
CVE-2016-5158
HIGH 8.8
Multiple integer overflows in the opj_tcd_init_tile function in tcd.c in OpenJPEG, as used in PDFium in Google Chrome before 53.0.2785.89 on Windows and OS X a… |
|
CVE-2016-5157
HIGH 8.8
Heap-based buffer overflow in the opj_dwt_interleave_v function in dwt.c in OpenJPEG, as used in PDFium in Google Chrome before 53.0.2785.89 on Windows and OS … |
|
CVE-2016-5156
HIGH 8.8
extensions/renderer/event_bindings.cc in the event bindings in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux attempts … |
|
CVE-2016-5155
MEDIUM 6.5
Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux does not properly validate access to the initial document, which allows … |
|
CVE-2016-5154
HIGH 8.8
Multiple heap-based buffer overflows in PDFium, as used in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, allow remote… |
|
CVE-2016-5153
HIGH 8.8
The Web Animations implementation in Blink, as used in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, improperly relie… |
|
CVE-2016-5152
HIGH 8.8
Integer overflow in the opj_tcd_get_decoded_tile_size function in tcd.c in OpenJPEG, as used in PDFium in Google Chrome before 53.0.2785.89 on Windows and OS X… |
|
CVE-2016-5151
HIGH 8.8
PDFium in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux mishandles timers, which allows remote attackers to cause a de… |
|
CVE-2016-5150
HIGH 8.8
WebKit/Source/bindings/modules/v8/V8BindingForModules.cpp in Blink, as used in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on… |
|
CVE-2016-5149
HIGH 8.8
The extensions subsystem in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux relies on an IFRAME source URL to identify a… |
|
CVE-2016-5148
MEDIUM 6.1
Cross-site scripting (XSS) vulnerability in Blink, as used in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, allows re… |
|
CVE-2016-5147
MEDIUM 6.1
Blink, as used in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, mishandles deferred page loads, which allows remote a… |
|
CVE-2016-7153
MEDIUM 5.3
+1
The HTTP/2 protocol does not consider the role of the TCP congestion window in providing information about content length, which makes it easier for remote att… |
|
CVE-2016-7152
MEDIUM 5.3
+1
The HTTPS protocol does not consider the role of the TCP congestion window in providing information about content length, which makes it easier for remote atta… |
|
CVE-2016-5699
MEDIUM 6.1
CRLF injection vulnerability in the HTTPConnection.putheader function in urllib2 and urllib in CPython (aka Python) before 2.7.10 and 3.x before 3.4.4 allows r… |
|
CVE-2016-5636
CRITICAL 9.8
Integer overflow in the get_data function in zipimport.c in CPython (aka Python) before 2.7.12, 3.x before 3.4.5, and 3.5.x before 3.5.2 allows remote attacker… |
|
CVE-2016-0772
MEDIUM 6.5
The smtplib library in CPython (aka Python) before 2.7.12, 3.x before 3.4.5, and 3.5.x before 3.5.2 does not return an error when StartTLS fails, which might a… |
|
CVE-2016-2183
HIGH 7.5
The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately four bill… |
|
CVE-2016-3329
MEDIUM 5.3
Microsoft Internet Explorer 9 through 11 and Edge allow remote attackers to determine the existence of files via a crafted webpage, aka "Internet Explorer Info… |
|
CVE-2016-3327
MEDIUM 5.3
Microsoft Internet Explorer 9 through 11 and Edge allow remote attackers to obtain sensitive information via a crafted web page, aka "Microsoft Browser Informa… |
|
CVE-2016-3326
MEDIUM 5.3
Microsoft Internet Explorer 9 through 11 and Edge allow remote attackers to obtain sensitive information via a crafted web page, aka "Microsoft Browser Informa… |
|
CVE-2016-3322
HIGH 7.5
Microsoft Internet Explorer 11 and Edge allow remote attackers to execute arbitrary code via a crafted web page, aka "Microsoft Browser Memory Corruption Vulne… |
|
CVE-2016-3319
HIGH 7.0
The PDF library in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows 10 Gold and 1511, and Microsoft Edge allows remote attackers to execute arbi… |
|
CVE-2016-3317
HIGH 7.8
Microsoft Office 2010 SP2, Word 2007 SP3, Word 2010 SP2, Word for Mac 2011, Word 2016 for Mac, and Word Viewer allow remote attackers to execute arbitrary code… |
|
CVE-2016-3316
HIGH 7.8
Microsoft Word 2013 SP1, 2013 RT SP1, 2016, and 2016 for Mac allow remote attackers to execute arbitrary code via a crafted file, aka "Microsoft Office Memory … |
|
CVE-2016-3313
HIGH 7.8
Microsoft Office 2007 SP3, 2010 SP2, 2013 SP1, 2013 RT SP1, and 2016, Word 2016 for Mac, and Word Viewer allow remote attackers to execute arbitrary code via a… |
|
CVE-2016-3299
MEDIUM 5.3
Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Go… |
|
CVE-2016-3296
HIGH 7.5
The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code via a crafted web site, aka "Scripting Engine Memory Corruptio… |
|
CVE-2016-3293
HIGH 7.5
Microsoft Internet Explorer 9 through 11 and Edge allow remote attackers to execute arbitrary code via a crafted web page, aka "Microsoft Browser Memory Corrup… |
|
CVE-2016-3289
HIGH 7.5
Microsoft Internet Explorer 11 and Edge allow remote attackers to execute arbitrary code via a crafted web page, aka "Microsoft Browser Memory Corruption Vulne… |
|
CVE-2016-3320
HIGH · vendor
Secure Boot Security Feature Bypass Vulnerability |
|
CVE-2016-3312
HIGH · vendor
Universal Outlook Information Disclosure Vulnerability |
|
CVE-2016-3311
HIGH · vendor
Windows Kernel Elevation of Privilege Vulnerability |
|
CVE-2016-3310
HIGH · vendor
Windows Kernel Elevation of Privilege Vulnerability |
|
CVE-2016-3309
Windows Kernel Elevation of Privilege Vulnerability |
|
CVE-2016-3308
HIGH · vendor
Windows Kernel Elevation of Privilege Vulnerability |
|
CVE-2016-3301
CRITICAL · vendor
Microsoft Graphics Remote Code Execution Vulnerability |
|
CVE-2016-3237
HIGH · vendor
Kerberos Security Feature Bypass Vulnerability |
|
CVE-2016-5146
CRITICAL 9.8
Multiple unspecified vulnerabilities in Google Chrome before 52.0.2743.116 allow attackers to cause a denial of service or possibly have other impact via unkno… |
|
CVE-2016-5145
HIGH 8.8
Blink, as used in Google Chrome before 52.0.2743.116, does not ensure that a taint property is preserved after a structure-clone operation on an ImageBitmap ob… |
|
CVE-2016-5144
CRITICAL 9.8
The Developer Tools (aka DevTools) subsystem in Blink, as used in Google Chrome before 52.0.2743.116, mishandles the script-path hostname, remoteBase parameter… |
|
CVE-2016-5143
CRITICAL 9.8
The Developer Tools (aka DevTools) subsystem in Blink, as used in Google Chrome before 52.0.2743.116, mishandles the script-path hostname, remoteBase parameter… |
|
CVE-2016-5142
CRITICAL 9.8
The Web Cryptography API (aka WebCrypto) implementation in Blink, as used in Google Chrome before 52.0.2743.116, does not properly copy data buffers, which all… |
|
CVE-2016-5141
HIGH 7.5
Blink, as used in Google Chrome before 52.0.2743.116, allows remote attackers to spoof the address bar via vectors involving a provisional URL for an initially… |
|
CVE-2016-5140
CRITICAL 9.8
Heap-based buffer overflow in the opj_j2k_read_SQcd_SQcc function in j2k.c in OpenJPEG, as used in PDFium in Google Chrome before 52.0.2743.116, allows remote … |
|
CVE-2016-5139
HIGH 7.6
Multiple integer overflows in the opj_tcd_init_tile function in tcd.c in OpenJPEG, as used in PDFium in Google Chrome before 52.0.2743.116, allow remote attack… |
Manage your fleet with Appaloosa
Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.