Vulnerabilities
Tracked app vulnerabilities
29,110 CVEs affect a tracked app or OS (all severities, all platforms). 375 of them are in the CISA KEV catalog, meaning exploitation is confirmed.
- Matching CVEs
- 29,110
- Actively exploited
- 375
- Publication window
- 1997-01-01 → 2026-11-04
Chronological sort: newest to oldest. Use the KEV / severity filters above to prioritize.
| CVE |
|---|
|
CVE-2019-5460
MEDIUM 5.5
Double Free in VLC versions <= 3.0.6 leads to a crash. |
|
CVE-2019-5459
HIGH 7.1
An Integer underflow in VLC Media Player versions < 3.0.7 leads to an out-of-band read. |
|
CVE-2019-1105
MEDIUM 5.4
A spoofing vulnerability exists in the way Microsoft Outlook for Android software parses specifically crafted email messages. An authenticated attacker could e… |
|
CVE-2019-14379
CRITICAL 9.8
SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manage… |
|
CVE-2019-9820
CRITICAL 9.8
A use-after-free vulnerability can occur in the chrome event handler when it is freed while still in use. This results in a potentially exploitable crash. This… |
|
CVE-2019-9819
CRITICAL 9.8
A vulnerability where a JavaScript compartment mismatch can occur while working with the fetch API, resulting in a potentially exploitable crash. This vulnerab… |
|
CVE-2019-9818
HIGH 8.3
A race condition is present in the crash generation server used to generate data for the crash reporter. This issue can lead to a use-after-free in the main pr… |
|
CVE-2019-9817
MEDIUM 5.3
Images from a different domain can be read using a canvas object in some circumstances. This could be used to steal image data from a different site in violati… |
|
CVE-2019-9816
MEDIUM 5.9
A possible vulnerability exists where type confusion can occur when manipulating JavaScript objects in object groups, allowing for the bypassing of security ch… |
|
CVE-2019-9815
HIGH 8.1
If hyperthreading is not disabled, a timing attack vulnerability exists, similar to previous Spectre attacks. Apple has shipped macOS 10.14.5 with an option to… |
|
CVE-2019-9811
HIGH 8.3
As part of a winning Pwn2Own entry, a researcher demonstrated a sandbox escape by installing a malicious language pack and then opening a browser feature that … |
|
CVE-2019-9800
CRITICAL 9.8
Mozilla developers and community members reported memory safety bugs present in Firefox 66, Firefox ESR 60.6, and Thunderbird 60.6. Some of these bugs showed e… |
|
CVE-2019-11730
MEDIUM 6.5
A vulnerability exists where if a user opens a locally saved HTML file, this file can use file: URIs to access other files in the same directory or sub-directo… |
|
CVE-2019-11729
HIGH 7.5
Empty or malformed p256-ECDH public keys may trigger a segmentation fault due values being improperly sanitized before being copied into memory and used. This … |
|
CVE-2019-11719
HIGH 7.5
When importing a curve25519 private key in PKCS#8format with leading 0x00 bytes, it is possible to trigger an out-of-bounds read in the Network Security Servic… |
|
CVE-2019-11717
MEDIUM 5.3
A vulnerability exists where the caret ("^") character is improperly escaped constructing some URIs due to it being used as a separator, allowing for possible … |
|
CVE-2019-11715
MEDIUM 6.1
Due to an error while parsing page content, it is possible for properly sanitized user input to be misinterpreted and lead to XSS hazards on web sites in certa… |
|
CVE-2019-11713
CRITICAL 9.8
A use-after-free vulnerability can occur in HTTP/2 when a cached HTTP/2 stream is closed while still in use, resulting in a potentially exploitable crash. This… |
|
CVE-2019-11712
HIGH 8.8
POST requests made by NPAPI plugins, such as Flash, that receive a status 308 redirect response can bypass CORS requirements. This can allow an attacker to per… |
|
CVE-2019-11711
HIGH 8.8
When an inner window is reused, it does not consider the use of document.domain for cross-origin protections. If pages on different subdomains ever cooperative… |
|
CVE-2019-11709
CRITICAL 9.8
Mozilla developers and community members reported memory safety bugs present in Firefox 67 and Firefox ESR 60.7. Some of these bugs showed evidence of memory c… |
|
CVE-2019-11708
CRITICAL 10.0
KEV
Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can result in the non-sandboxed parent process op… |
|
CVE-2019-11707
HIGH 8.8
KEV
A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow for an exploitable crash. We are aware… |
|
CVE-2019-11706
HIGH 7.5
A flaw in Thunderbird's implementation of iCal causes a type confusion in icaltimezone_get_vtimezone_properties when processing certain email messages, resulti… |
|
CVE-2019-11705
CRITICAL 9.8
A flaw in Thunderbird's implementation of iCal causes a stack buffer overflow in icalrecur_add_bydayrules when processing certain email messages, resulting in … |
|
CVE-2019-11704
CRITICAL 9.8
A flaw in Thunderbird's implementation of iCal causes a heap buffer overflow in icalmemory_strdup_and_dequote when processing certain email messages, resulting… |
|
CVE-2019-11703
CRITICAL 9.8
A flaw in Thunderbird's implementation of iCal causes a heap buffer overflow in parser_get_next_char when processing certain email messages, resulting in a pot… |
|
CVE-2019-11698
MEDIUM 5.3
If a crafted hyperlink is dragged and dropped to the bookmark bar or sidebar and the resulting bookmark is subsequently dragged and dropped into the web conten… |
|
CVE-2019-11694
HIGH 7.5
A vulnerability exists in the Windows sandbox where an uninitialized value in memory can be leaked to a renderer from a broker when making a call to access an … |
|
CVE-2019-11693
CRITICAL 9.8
The bufferdata function in WebGL is vulnerable to a buffer overflow with specific graphics drivers on Linux. This could result in malicious content freezing a … |
|
CVE-2019-11692
CRITICAL 9.8
A use-after-free vulnerability can occur when listeners are removed from the event listener manager while still in use, resulting in a potentially exploitable … |
|
CVE-2019-11691
CRITICAL 9.8
A use-after-free vulnerability can occur when working with XMLHttpRequest (XHR) in an event loop, causing the XHR main thread to be called after it has been fr… |
|
CVE-2019-13962
CRITICAL 9.8
lavc_CopyPicture in modules/codec/avcodec/video.c in VideoLAN VLC media player through 3.0.7 has a heap-based buffer over-read because it does not properly val… |
|
CVE-2019-1130
An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows Elevation of Privileg… |
|
CVE-2019-1111
HIGH 8.8
A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Excel Rem… |
|
CVE-2019-1110
HIGH 8.8
A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Excel Rem… |
|
CVE-2019-1107
HIGH 7.5
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Eng… |
|
CVE-2019-1106
HIGH 7.5
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Eng… |
|
CVE-2019-1104
HIGH 7.5
A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory, aka 'Microsoft Browser Memory Corruption Vulnerabilit… |
|
CVE-2019-1103
HIGH 7.5
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Eng… |
|
CVE-2019-1092
HIGH 7.5
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Eng… |
|
CVE-2019-1084
MEDIUM 6.5
+1
An information disclosure vulnerability exists when Exchange allows creation of entities with Display Names having non-printable characters. An authenticated a… |
|
CVE-2019-1062
HIGH 7.5
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Eng… |
|
CVE-2019-1001
HIGH 7.5
A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka 'Scripting Engine Memory Corr… |
|
CVE-2019-13602
HIGH 7.8
An Integer Underflow in MP4_EIA608_Convert() in modules/demux/mp4/mp4.c in VideoLAN VLC media player through 3.0.7.1 allows remote attackers to cause a denial … |
|
CVE-2018-20852
MEDIUM 4.3
http.cookiejar.DefaultPolicy.domain_return_ok in Lib/http/cookiejar.py in Python before 3.7.3 does not correctly validate the domain: it can be tricked into se… |
|
CVE-2019-13567
HIGH 8.8
The Zoom Client before 4.4.53932.0709 on macOS allows remote code execution, a different vulnerability than CVE-2019-13450. If the ZoomOpener daemon (aka the h… |
|
CVE-2019-1129
Windows Elevation of Privilege Vulnerability |
|
CVE-2019-1128
HIGH · vendor
DirectWrite Remote Code Execution Vulnerability |
|
CVE-2019-1127
HIGH · vendor
DirectWrite Remote Code Execution Vulnerability |
Manage your fleet with Appaloosa
Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.