Vulnerabilities
Tracked app vulnerabilities
4,496 CVEs affect a tracked app or OS (High, macOS). 74 of them are in the CISA KEV catalog, meaning exploitation is confirmed.
- Matching CVEs
- 4,496
- Actively exploited
- 74
- Publication window
- 2004-07-27 → 2026-11-11
Chronological sort: newest to oldest. Use the KEV / severity filters above to prioritize.
| CVE |
|---|
|
CVE-2026-2313
HIGH 8.8
Use after free in CSS in Google Chrome prior to 145.0.7632.45 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromi… |
|
CVE-2026-1837
A specially-crafted file can cause libjxl's decoder to write pixel data to uninitialized unallocated memory. Soon after that data from another uninitialized un… |
|
CVE-2026-21511
HIGH 7.5
Deserialization of untrusted data in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network. |
|
CVE-2026-21260
HIGH 7.5
Exposure of sensitive information to an unauthorized actor in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network. |
|
CVE-2026-21259
HIGH 7.8
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to elevate privileges locally. |
|
CVE-2026-1862
HIGH 8.8
Type Confusion in V8 in Google Chrome prior to 144.0.7559.132 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromi… |
|
CVE-2026-1861
HIGH 8.8
Heap buffer overflow in libvpx in Google Chrome prior to 144.0.7559.132 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML pag… |
|
CVE-2026-21509
HIGH 7.8
KEV
Reliance on untrusted inputs in a security decision in Microsoft Office allows an unauthorized attacker to bypass a security feature locally. |
|
CVE-2026-0908
HIGH 8.8
Use after free in ANGLE in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chro… |
|
CVE-2026-0902
HIGH 8.8
Inappropriate implementation in V8 in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML… |
|
CVE-2026-0900
HIGH 8.8
Inappropriate implementation in V8 in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to potentially exploit object corruption via a crafted HTM… |
|
CVE-2026-0899
HIGH 8.8
Out of bounds memory access in V8 in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to potentially exploit object corruption via a crafted HTML… |
|
CVE-2024-44238
The issue was addressed with improved bounds checks. This issue is fixed in iOS 18.1 and iPadOS 18.1, macOS Sequoia 15.1. An app may be able to corrupt coproce… |
|
CVE-2026-20957
HIGH 7.8
Integer underflow (wrap or wraparound) in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
|
CVE-2026-20950
HIGH 7.8
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
|
CVE-2026-20948
HIGH 7.8
Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code locally. |
|
CVE-2026-20946
HIGH 7.8
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
|
CVE-2026-0628
HIGH 8.8
Insufficient policy enforcement in WebView tag in Google Chrome prior to 143.0.7499.192 allowed an attacker who convinced a user to install a malicious extensi… |
|
CVE-2025-46291
HIGH 7.8
A logic issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.7.4, macOS Tahoe 26.2. An app may bypass Gatekeeper checks. |
|
CVE-2025-46281
HIGH 8.8
A logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.2. An app may be able to bre… |
|
CVE-2025-43529
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.… |
|
CVE-2025-14766
HIGH 8.8
Out of bounds read and write in V8 in Google Chrome prior to 143.0.7499.147 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML… |
|
CVE-2025-14765
HIGH 8.8
Use after free in WebGPU in Google Chrome prior to 143.0.7499.147 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Ch… |
|
CVE-2025-46285
An integer overflow was addressed by adopting 64-bit timestamps. This issue is fixed in iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Sequoia 1… |
|
CVE-2025-43542
This issue was addressed with improved state management. This issue is fixed in iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Sequoia 15.7.3, m… |
|
CVE-2025-43539
The issue was addressed with improved bounds checks. This issue is fixed in iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Sequoia 15.7.3, macOS… |
|
CVE-2025-43527
HIGH 7.8
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.3, macOS Tahoe 26.2. An app may be able to gain root … |
|
CVE-2025-43512
A logic issue was addressed with improved checks. This issue is fixed in iOS 18.7.3 and iPadOS 18.7.3, macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, macOS Tahoe 2… |
|
CVE-2025-43510
A memory corruption issue was addressed with improved lock state checking. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS… |
|
CVE-2025-43506
HIGH 7.5
A logic error was addressed with improved error handling. This issue is fixed in macOS Tahoe 26.1. iCloud Private Relay may not activate when more than one use… |
|
CVE-2025-43494
A mail header parsing issue was addressed with improved checks. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Sequoia 15… |
|
CVE-2025-43467
HIGH 7.8
This issue was addressed with improved checks. This issue is fixed in macOS Tahoe 26.1. An app may be able to gain root privileges. |
|
CVE-2025-43402
HIGH 7.8
The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.1. An app may be able t… |
|
CVE-2025-43320
HIGH 7.8
The issue was addressed by adding additional logic. This issue is fixed in macOS Sequoia 15.7.3, macOS Tahoe 26. An app may be able to bypass launch constraint… |
|
CVE-2025-14174
Out of bounds memory access in ANGLE in Google Chrome on Mac prior to 143.0.7499.110 allowed a remote attacker to perform out of bounds memory access via a cra… |
|
CVE-2025-64899
HIGH 7.8
Acrobat Reader versions 24.001.30264, 20.005.30793, 25.001.20982, 24.001.30273, 20.005.30803 and earlier are affected by an out-of-bounds read vulnerability wh… |
|
CVE-2025-64785
HIGH 7.8
Acrobat Reader versions 24.001.30264, 20.005.30793, 25.001.20982, 24.001.30273, 20.005.30803 and earlier are affected by an Untrusted Search Path vulnerability… |
|
CVE-2025-62564
HIGH 7.8
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
|
CVE-2025-62563
HIGH 7.8
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
|
CVE-2025-62562
HIGH 7.8
Use after free in Microsoft Office Outlook allows an unauthorized attacker to execute code locally. |
|
CVE-2025-62561
HIGH 7.8
Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
|
CVE-2025-62560
HIGH 7.8
Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
|
CVE-2025-62559
HIGH 7.8
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally. |
|
CVE-2025-62558
HIGH 7.8
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally. |
|
CVE-2025-62557
HIGH 8.4
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. |
|
CVE-2025-62556
HIGH 7.8
Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
|
CVE-2025-62555
HIGH 7.0
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally. |
|
CVE-2025-62554
HIGH 8.4
Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally. |
|
CVE-2025-62553
HIGH 7.8
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
|
CVE-2025-62552
HIGH 7.8
Relative path traversal in Microsoft Office Access allows an unauthorized attacker to execute code locally. |
Manage your fleet with Appaloosa
Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.