Vulnerabilities
Tracked app vulnerabilities
29,068 CVEs affect a tracked app or OS (all severities, all platforms). 375 of them are in the CISA KEV catalog, meaning exploitation is confirmed.
- Matching CVEs
- 29,068
- Actively exploited
- 375
- Publication window
- 1997-01-01 → 2026-11-04
Chronological sort: newest to oldest. Use the KEV / severity filters above to prioritize.
| CVE |
|---|
|
CVE-2019-1166
HIGH · vendor
Windows NTLM Tampering Vulnerability |
|
CVE-2019-1060
CRITICAL · vendor
MS XML Remote Code Execution Vulnerability |
|
CVE-2019-17192
CRITICAL 9.8
The WebRTC component in the Signal Private Messenger application through 4.47.7 for Android processes videoconferencing RTP packets before a callee chooses to … |
|
CVE-2019-17191
HIGH 7.5
The Signal Private Messenger application before 4.47.7 for Android allows a caller to force a call to be answered, without callee user interaction, via a conne… |
|
CVE-2019-11932
HIGH 8.8
A double free vulnerability in the DDGifSlurp function in decoding.c in the android-gif-drawable library before version 1.2.18, as used in WhatsApp for Android… |
|
CVE-2019-2339
CRITICAL · vendor
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2019-2336
CRITICAL · vendor
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2019-2335
HIGH · vendor
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2019-2329
CRITICAL · vendor
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2019-2318
HIGH · vendor
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2019-2315
CRITICAL · vendor
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2019-2303
HIGH · vendor
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2019-2295
HIGH · vendor
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2019-2289
CRITICAL · vendor
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2019-2271
CRITICAL · vendor
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2019-2268
HIGH · vendor
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2019-2251
CRITICAL · vendor
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2019-2215
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2019-2187
HIGH · vendor
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2019-2186
MEDIUM · vendor
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2019-2185
MEDIUM · vendor
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2019-2184
CRITICAL · vendor
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2019-2173
HIGH · vendor
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2019-2114
HIGH · vendor
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2019-2110
HIGH · vendor
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2019-10535
HIGH · vendor
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2019-10490
HIGH · vendor
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2018-19824
HIGH · vendor
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2018-13916
CRITICAL · vendor
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2018-11902
HIGH · vendor
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2019-17051
HIGH 7.8
Evernote before 7.13 GA on macOS allows code execution because the com.apple.quarantine attribute is not used for attachment files, as demonstrated by a one-cl… |
|
CVE-2019-16935
MEDIUM 6.1
The documentation XML-RPC server in Python through 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has XSS via the server_title field. This occurs in Lib/Do… |
|
CVE-2019-11927
HIGH 7.8
An integer overflow in WhatsApp media parsing libraries allows a remote attacker to perform an out-of-bounds write on the heap via specially-crafted EXIF tags … |
|
CVE-2019-11755
HIGH 7.5
A crafted S/MIME message consisting of an inner encryption layer and an outer SignedData layer was shown as having a valid digital signature, although the sign… |
|
CVE-2019-11752
HIGH 8.8
It is possible to delete an IndexedDB key value and subsequently try to extract it during conversion. This results in a use-after-free and a potentially exploi… |
|
CVE-2019-11746
HIGH 8.8
A use-after-free vulnerability can occur while manipulating video elements if the body is freed while still in use. This results in a potentially exploitable c… |
|
CVE-2019-11744
MEDIUM 6.1
Some HTML elements, such as <title> and <textarea>, can contain literal angle brackets without treating them as markup. It is possible to pass a li… |
|
CVE-2019-11743
LOW 3.7
Navigation events were not fully adhering to the W3C's "Navigation-Timing Level 2" draft specification in some instances for the unload event, which restricts … |
|
CVE-2019-11742
MEDIUM 6.5
A same-origin policy violation occurs allowing the theft of cross-origin images through a combination of SVG filters and a <canvas> element due to an err… |
|
CVE-2019-11740
HIGH 8.8
Mozilla developers and community members reported memory safety bugs present in Firefox 68, Firefox ESR 68, and Firefox 60.8. Some of these bugs showed evidenc… |
|
CVE-2019-11739
MEDIUM 6.5
Encrypted S/MIME parts in a crafted multipart/alternative message can leak plaintext when included in a a HTML reply/forward. This vulnerability affects Thunde… |
|
CVE-2019-8075
HIGH 7.5
Adobe Flash Player version 32.0.0.192 and earlier versions have a Same Origin Policy Bypass vulnerability. Successful exploitation could lead to Information Di… |
|
CVE-2019-16248
MEDIUM 5.5
The "delete for" feature in Telegram before 5.11 on Android does not delete shared media files from the Telegram Images directory. In other words, there is a p… |
|
CVE-2019-1300
HIGH 7.5
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Eng… |
|
CVE-2019-1299
MEDIUM 6.5
An information disclosure vulnerability exists when Microsoft Edge based on Edge HTML improperly handles objects in memory, aka 'Microsoft Edge based on Edge H… |
|
CVE-2019-1298
HIGH 7.5
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Eng… |
|
CVE-2019-1297
HIGH 8.8
KEV
A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Excel Rem… |
|
CVE-2019-1263
MEDIUM 5.5
An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory, aka 'Microsoft Excel Information Disclosur… |
|
CVE-2019-1237
HIGH 7.5
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Eng… |
|
CVE-2019-1220
MEDIUM 4.3
A security feature bypass vulnerability exists when Microsoft Browsers fail to validate the correct Security Zone of requests for specific URLs, aka 'Microsoft… |
Manage your fleet with Appaloosa
Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.