Vulnerabilities
Tracked app vulnerabilities
19,930 CVEs affect a tracked app or OS (all severities, Windows). 303 of them are in the CISA KEV catalog, meaning exploitation is confirmed.
- Matching CVEs
- 19,930
- Actively exploited
- 303
- Publication window
- 1997-01-01 → 2026-10-30
Chronological sort: newest to oldest. Use the KEV / severity filters above to prioritize.
| CVE |
|---|
|
CVE-2016-5138
HIGH 8.8
Integer overflow in the kbasep_vinstr_attach_client function in midgard/mali_kbase_vinstr.c in Google Chrome before 52.0.2743.85 allows remote attackers to cau… |
|
CVE-2016-5137
MEDIUM 4.3
The CSPSource::schemeMatches function in WebKit/Source/core/frame/csp/CSPSource.cpp in the Content Security Policy (CSP) implementation in Blink, as used in Go… |
|
CVE-2016-5136
HIGH 8.8
Use-after-free vulnerability in extensions/renderer/user_script_injector.cc in the Extensions subsystem in Google Chrome before 52.0.2743.82 allows remote atta… |
|
CVE-2016-5135
MEDIUM 6.5
WebKit/Source/core/html/parser/HTMLPreloadScanner.cpp in Blink, as used in Google Chrome before 52.0.2743.82, does not consider referrer-policy information ins… |
|
CVE-2016-5134
HIGH 8.8
net/proxy/proxy_service.cc in the Proxy Auto-Config (PAC) feature in Google Chrome before 52.0.2743.82 does not ensure that URL information is restricted to a … |
|
CVE-2016-5133
MEDIUM 5.3
Google Chrome before 52.0.2743.82 mishandles origin information during proxy authentication, which allows man-in-the-middle attackers to spoof a proxy-authenti… |
|
CVE-2016-5132
HIGH 8.8
The Service Workers subsystem in Google Chrome before 52.0.2743.82 does not properly implement the Secure Contexts specification during decisions about whether… |
|
CVE-2016-5131
HIGH 8.8
Use-after-free vulnerability in libxml2 through 2.9.4, as used in Google Chrome before 52.0.2743.82, allows remote attackers to cause a denial of service or po… |
|
CVE-2016-5130
MEDIUM 6.5
content/renderer/history_controller.cc in Google Chrome before 52.0.2743.82 does not properly restrict multiple uses of a JavaScript forward method, which allo… |
|
CVE-2016-5129
HIGH 8.8
Google V8 before 5.2.361.32, as used in Google Chrome before 52.0.2743.82, does not properly process left-trimmed objects, which allows remote attackers to cau… |
|
CVE-2016-5128
HIGH 8.8
objects.cc in Google V8 before 5.2.361.27, as used in Google Chrome before 52.0.2743.82, does not prevent API interceptors from modifying a store target withou… |
|
CVE-2016-5127
HIGH 7.5
Use-after-free vulnerability in WebKit/Source/core/editing/VisibleUnits.cpp in Blink, as used in Google Chrome before 52.0.2743.82, allows remote attackers to … |
|
CVE-2016-1711
HIGH 8.8
WebKit/Source/core/loader/FrameLoader.cpp in Blink, as used in Google Chrome before 52.0.2743.82, does not disable frame navigation during a detach operation o… |
|
CVE-2016-1710
HIGH 8.8
The ChromeClientImpl::createWindow method in WebKit/Source/web/ChromeClientImpl.cpp in Blink, as used in Google Chrome before 52.0.2743.82, does not prevent wi… |
|
CVE-2016-1709
HIGH 8.8
Heap-based buffer overflow in the ByteArray::Get method in data/byte_array.cc in Google sfntly before 2016-06-10, as used in Google Chrome before 52.0.2743.82,… |
|
CVE-2016-1708
HIGH 8.8
The Chrome Web Store inline-installation implementation in the Extensions subsystem in Google Chrome before 52.0.2743.82 does not properly consider object life… |
|
CVE-2016-1707
MEDIUM 6.5
ios/web/web_state/ui/crw_web_controller.mm in Google Chrome before 52.0.2743.82 on iOS does not ensure that an invalid URL is replaced with the about:blank URL… |
|
CVE-2016-1706
CRITICAL 9.6
The PPAPI implementation in Google Chrome before 52.0.2743.82 does not validate the origin of IPC messages to the plugin broker process that should have come f… |
|
CVE-2016-1705
HIGH 8.8
Multiple unspecified vulnerabilities in Google Chrome before 52.0.2743.82 allow attackers to cause a denial of service or possibly have other impact via unknow… |
|
CVE-2016-3284
HIGH 7.8
Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Excel for Mac 2011, Excel 2016 for Mac, Office Compatibility Pack SP3,… |
|
CVE-2016-3282
HIGH 7.8
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Word for Mac 2011, Word 2016 for Mac, Office Compatibility… |
|
CVE-2016-3281
HIGH 7.8
Microsoft Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Word for Mac 2011, Word 2016 for Mac, Word Automation Services on SharePo… |
|
CVE-2016-3280
HIGH 7.8
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word for Mac 2011, Word 2016 for Mac, Office Compatibility Pack SP3, … |
|
CVE-2016-3279
MEDIUM 5.5
+1
Microsoft Office 2010 SP2, Excel 2010 SP2, PowerPoint 2010 SP2, Word 2010 SP2, Excel 2013 SP1, PowerPoint 2013 SP1, Word 2013 SP1, Excel 2013 RT SP1, PowerPoin… |
|
CVE-2016-3278
HIGH 7.8
Microsoft Outlook 2010 SP2, 2013 SP1, 2013 RT SP1, and 2016 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Off… |
|
CVE-2016-3277
MEDIUM 5.3
Microsoft Internet Explorer 10 and 11 and Microsoft Edge allow remote attackers to obtain sensitive information via a crafted web site, aka "Microsoft Browser … |
|
CVE-2016-3274
LOW 3.1
Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to conduct content-spoofing attacks via a crafted URL, aka "Microsoft Browse… |
|
CVE-2016-3273
MEDIUM 5.3
The XSS Filter in Microsoft Internet Explorer 9 through 11 and Microsoft Edge does not properly restrict JavaScript code, which allows remote attackers to obta… |
|
CVE-2016-3271
MEDIUM 6.5
The VBScript engine in Microsoft Edge allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Scripting Engine… |
|
CVE-2016-3269
HIGH 8.8
The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted… |
|
CVE-2016-3265
HIGH 8.8
The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted… |
|
CVE-2016-3264
HIGH 7.5
Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) v… |
|
CVE-2016-3260
HIGH 8.8
The Microsoft (1) JScript 9, (2) VBScript, and (3) Chakra JavaScript engines, as used in Microsoft Internet Explorer 11, Microsoft Edge, and other products, al… |
|
CVE-2016-3259
HIGH 8.8
The Microsoft (1) JScript 9, (2) VBScript, and (3) Chakra JavaScript engines, as used in Microsoft Internet Explorer 9 through 11, Microsoft Edge, and other pr… |
|
CVE-2016-3248
HIGH 8.8
The Microsoft (1) JScript 9, (2) VBScript, and (3) Chakra JavaScript engines, as used in Microsoft Internet Explorer 9 through 11, Microsoft Edge, and other pr… |
|
CVE-2016-3246
HIGH 7.5
Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Edge M… |
|
CVE-2016-3244
MEDIUM 4.3
Microsoft Edge allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Microsoft Edge Security Feature Bypass." |
|
CVE-2016-3287
HIGH · vendor
Secure Boot Security Feature Bypass Vulnerability |
|
CVE-2016-3286
HIGH · vendor
Windows Kernel Elevation of Privilege Vulnerability |
|
CVE-2016-3272
HIGH · vendor
Windows Kernel Information Disclosure Vulnerability |
|
CVE-2016-3258
HIGH · vendor
Windows File System Security Feature Bypass Vulnerability |
|
CVE-2016-3256
HIGH · vendor
Windows Secure Kernel Mode Information Disclosure Vulnerability |
|
CVE-2016-3254
HIGH · vendor
Windows Kernel Elevation of Privilege Vulnerability |
|
CVE-2016-3252
HIGH · vendor
Windows Kernel Elevation of Privilege Vulnerability |
|
CVE-2016-3251
HIGH · vendor
Windows GDI Information Disclosure Vulnerability |
|
CVE-2016-3250
HIGH · vendor
Windows Kernel Elevation of Privilege Vulnerability |
|
CVE-2016-3249
HIGH · vendor
Windows Graphics Component Elevation of Privilege Vulnerability |
|
CVE-2016-3239
HIGH · vendor
Windows Print Spooler Elevation of Privilege Vulnerability |
|
CVE-2016-3238
CRITICAL · vendor
Windows Print Spooler Remote Code Execution Vulnerability |
|
CVE-2016-1704
HIGH 8.8
Multiple unspecified vulnerabilities in Google Chrome before 51.0.2704.103 allow attackers to cause a denial of service or possibly have other impact via unkno… |
Manage your fleet with Appaloosa
Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.