Vulnerabilities
Tracked app vulnerabilities
28,627 CVEs affect a tracked app or OS (all severities, all platforms). 374 of them are in the CISA KEV catalog, meaning exploitation is confirmed.
- Matching CVEs
- 28,627
- Actively exploited
- 374
- Publication window
- 1997-01-01 → 2026-10-30
Chronological sort: newest to oldest. Use the KEV / severity filters above to prioritize.
| CVE |
|---|
|
CVE-2021-29956
MEDIUM 4.3
OpenPGP secret keys that were imported using Thunderbird version 78.8.1 up to version 78.10.1 were stored unencrypted on the user's local disk. The master pass… |
|
CVE-2021-29951
MEDIUM 6.5
The Mozilla Maintenance Service granted SERVICE_START access to BUILTIN|Users which, in a domain network, grants normal remote users access to start or stop th… |
|
CVE-2021-29950
HIGH 7.5
Thunderbird unprotects a secret OpenPGP key prior to using it for a decryption, signing or key import task. If the task runs into a failure, the secret key may… |
|
CVE-2021-29949
HIGH 7.8
When loading the shared library that provides the OTR protocol implementation, Thunderbird will initially attempt to open it using a filename that isn't distri… |
|
CVE-2021-29948
LOW 2.5
Signatures are written to disk before and read during verification, which might be subject to a race condition when a malicious local process or user is replac… |
|
CVE-2021-29946
HIGH 8.8
Ports that were written as an integer overflow above the bounds of a 16-bit integer could have bypassed port blocking restrictions when used in the Alt-Svc hea… |
|
CVE-2021-29945
MEDIUM 6.5
The WebAssembly JIT could miscalculate the size of a return type, which could lead to a null read and result in a crash. *Note: This issue only affected x86-32… |
|
CVE-2021-24002
HIGH 8.8
When a user clicked on an FTP URL containing encoded newline characters (%0A and %0D), the newlines would have been interpreted as such and allowed arbitrary c… |
|
CVE-2021-23999
HIGH 8.8
If a Blob URL was loaded through some unusual user interaction, it could have been loaded by the System Principal and granted additional privileges that should… |
|
CVE-2021-23998
MEDIUM 6.5
Through complicated navigations with new windows, an HTTP page could have inherited a secure lock icon from an HTTPS page. This vulnerability affects Firefox E… |
|
CVE-2021-23995
HIGH 8.8
When Responsive Design Mode was enabled, it used references to objects that were previously freed. We presume that with enough effort this could have been expl… |
|
CVE-2021-23994
HIGH 8.8
A WebGL framebuffer was not initialized early enough, resulting in memory corruption and an out of bound write. This vulnerability affects Firefox ESR < 78.10,… |
|
CVE-2021-23993
MEDIUM 6.5
An attacker may perform a DoS attack to prevent a user from sending encrypted email to a correspondent. If an attacker creates a crafted OpenPGP key with a sub… |
|
CVE-2021-23992
MEDIUM 4.3
Thunderbird did not check if the user ID associated with an OpenPGP key has a valid self signature. An attacker may create a crafted version of an OpenPGP key,… |
|
CVE-2021-23991
MEDIUM 6.8
If a Thunderbird user has previously imported Alice's OpenPGP key, and Alice has extended the validity period of her key, but Alice's updated key has not yet b… |
|
CVE-2021-30553
HIGH 8.8
Use after free in Network service in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML p… |
|
CVE-2021-30552
HIGH 8.8
Use after free in Extensions in Google Chrome prior to 91.0.4472.101 allowed an attacker who convinced a user to install a malicious extension to potentially e… |
|
CVE-2021-30551
HIGH 8.8
KEV
Type confusion in V8 in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
|
CVE-2021-30550
HIGH 8.8
Use after free in Accessibility in Google Chrome prior to 91.0.4472.101 allowed an attacker who convinced a user to install a malicious extension to potentiall… |
|
CVE-2021-30549
HIGH 8.8
Use after free in Spell check in Google Chrome prior to 91.0.4472.101 allowed an attacker who convinced a user to install a malicious extension to potentially … |
|
CVE-2021-30548
HIGH 8.8
Use after free in Loader in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
|
CVE-2021-30547
HIGH 8.8
Out of bounds write in ANGLE in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to potentially perform out of bounds memory access via a crafted… |
|
CVE-2021-30546
HIGH 8.8
Use after free in Autofill in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
|
CVE-2021-30545
HIGH 8.8
Use after free in Extensions in Google Chrome prior to 91.0.4472.101 allowed a remote attacker who had compromised the renderer process to potentially exploit … |
|
CVE-2021-30544
HIGH 8.8
Use after free in BFCache in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
|
CVE-2021-24035
CRITICAL 9.1
A lack of filename validation when unzipping archives prior to WhatsApp for Android v2.21.8.13 and WhatsApp Business for Android v2.21.8.13 could have allowed … |
|
CVE-2021-31949
HIGH 7.3
Microsoft Outlook Remote Code Execution Vulnerability |
|
CVE-2021-31941
HIGH 7.8
Microsoft Office Graphics Remote Code Execution Vulnerability |
|
CVE-2021-31939
HIGH 7.8
Microsoft Excel Remote Code Execution Vulnerability |
|
CVE-2021-1675
Windows Print Spooler Remote Code Execution Vulnerability |
|
CVE-2021-33742
Windows MSHTML Platform Remote Code Execution Vulnerability |
|
CVE-2021-33739
Microsoft DWM Core Library Elevation of Privilege Vulnerability |
|
CVE-2021-31977
HIGH · vendor
Windows Hyper-V Denial of Service Vulnerability |
|
CVE-2021-31976
HIGH · vendor
Server for NFS Information Disclosure Vulnerability |
|
CVE-2021-31975
HIGH · vendor
Server for NFS Information Disclosure Vulnerability |
|
CVE-2021-31974
HIGH · vendor
Server for NFS Denial of Service Vulnerability |
|
CVE-2021-31973
HIGH · vendor
Windows GPSVC Elevation of Privilege Vulnerability |
|
CVE-2021-31972
HIGH · vendor
Event Tracing for Windows Information Disclosure Vulnerability |
|
CVE-2021-31971
HIGH · vendor
Windows HTML Platforms Security Feature Bypass Vulnerability |
|
CVE-2021-31970
HIGH · vendor
Windows TCP/IP Driver Security Feature Bypass Vulnerability |
|
CVE-2021-31969
HIGH · vendor
Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability |
|
CVE-2021-31968
HIGH · vendor
Windows Remote Desktop Services Denial of Service Vulnerability |
|
CVE-2021-31962
HIGH · vendor
Kerberos AppContainer Security Feature Bypass Vulnerability |
|
CVE-2021-31960
HIGH · vendor
Windows Bind Filter Driver Information Disclosure Vulnerability |
|
CVE-2021-31959
CRITICAL · vendor
Scripting Engine Memory Corruption Vulnerability |
|
CVE-2021-31958
HIGH · vendor
Windows NTLM Elevation of Privilege Vulnerability |
|
CVE-2021-31956
Windows NTFS Elevation of Privilege Vulnerability |
|
CVE-2021-31955
Windows Kernel Information Disclosure Vulnerability |
|
CVE-2021-31954
HIGH · vendor
Windows Common Log File System Driver Elevation of Privilege Vulnerability |
|
CVE-2021-31953
HIGH · vendor
Windows Filter Manager Elevation of Privilege Vulnerability |
Manage your fleet with Appaloosa
Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.