Vulnerabilities
Tracked app vulnerabilities
6,355 CVEs affect a tracked app or OS (Medium, all platforms). 33 of them are in the CISA KEV catalog, meaning exploitation is confirmed.
- Matching CVEs
- 6,355
- Actively exploited
- 33
- Publication window
- 2009-07-30 → 2026-11-10
Chronological sort: newest to oldest. Use the KEV / severity filters above to prioritize.
| CVE |
|---|
|
CVE-2026-58870
MEDIUM 4.0
In onPersistentGroupsChanged of WifiP2pServiceImpl.java, there is a possible permission bypass due to a missing permission check. This could lead to local info… |
|
CVE-2026-58838
MEDIUM 4.0
In multiple functions of Helpers.java, there is a possible information disclosure due to improper input validation. This could lead to local information disclo… |
|
CVE-2026-58821
MEDIUM 6.2
In multiple functions of SearchRequestDatabaseUtil.java, there is a possible way to access protected data due to SQL injection. This could lead to local denial… |
|
CVE-2026-58817
MEDIUM 6.2
In parseKnownActivityEmbeddingCerts of ParsingUtils.java, there is a possible permanent denial of service due to improper input validation. This could lead to … |
|
CVE-2026-55292
MEDIUM 5.3
In rw_ci_data_cback of rw_ci.cc, there is a possible memory safety issue due to integer underflow. This could lead to remote information disclosure with no add… |
|
CVE-2026-55272
MEDIUM 6.2
In loadDescription of DeviceAdminAdd.java, there is a possible denial of service due to improper input validation. This could lead to local denial of service w… |
|
CVE-2026-55264
MEDIUM 4.0
In checkWhetherCallingAppHasAccess of DownloadProvider.java, there is a possible information leak due to a confused deputy. This could lead to local informatio… |
|
CVE-2026-49935
MEDIUM 4.0
In getXmlFileNameForUser of LocaleManagerService.java, there is a possible permission bypass due to a confusable path traversal. This could lead to local infor… |
|
CVE-2026-49924
MEDIUM 6.2
In ShortcutInfo of ShortcutInfo.java, there is a possible way to crash the launcher via unauthorized shortcuts due to resource exhaustion. This could lead to l… |
|
CVE-2026-49912
MEDIUM 4.0
In multiple functions of MediaCarouselController.kt, there is a possible way for media to show up after disablement due to a logic error in the code. This coul… |
|
CVE-2026-28645
MEDIUM 6.8
In onStrongAuthRequiredChanged of UsbService.java, there is a possible unauthenticated enabling of USB data due to a logic error in the code. This could lead t… |
|
CVE-2026-28643
MEDIUM 6.2
In multiple locations, there is a possible denial of service due to a missing permission check. This could lead to local denial of service with no additional e… |
|
CVE-2026-28632
MEDIUM 4.0
In multiple locations, there is a possible way to share files across profiles due to a logic error in the code. This could lead to local information disclosure… |
|
CVE-2026-28621
MEDIUM 4.0
In getRingtone of RingtoneFactory.java, there is a possible unprivileged access risk due to a missing permission check. This could lead to local information di… |
|
CVE-2026-65587
MEDIUM 5.5
A web page that contains unusual WebGPU content loaded into the GPU GLES render process can trigger an OOB write in the GPU user-space driver, leading to memor… |
|
CVE-2026-76027
MEDIUM 4.3
Information loss in CacheStorage in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromi… |
|
CVE-2026-76024
MEDIUM 6.5
Use after free in MediaStream in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML… |
|
CVE-2026-119272
MEDIUM 4.3
Incorrect authorization in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker leveraging social engineering to obtain sensitive infor… |
|
CVE-2026-85330
MEDIUM 4.3
Incorrect authorization in Microsoft Edge for Android allows an unauthorized attacker to bypass a security feature over a network. |
|
CVE-2026-118322
MEDIUM 4.3
Uninitialized resource in ANGLE in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (… |
|
CVE-2026-118319
MEDIUM 4.3
Integer overflow in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a craft… |
|
CVE-2026-118318
MEDIUM 4.3
Buffer overflow in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (… |
|
CVE-2026-118178
MEDIUM 5.7
A remote RSS feed could use the itunes:new-feed-url or newLocation element to permanently change its stored subscription URL to a file: URL. Thunderbird then r… |
|
CVE-2026-118174
MEDIUM 6.5
When a message containing an OpenPGP key attachment was displayed, Thunderbird automatically loaded the attachment's content to offer importing the key. A send… |
|
CVE-2026-117992
MEDIUM 6.5
Information disclosure in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunde… |
|
CVE-2026-117960
MEDIUM 4.7
Spoofing issue in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. |
|
CVE-2026-117948
MEDIUM 6.3
Use-after-free in the SVG component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. |
|
CVE-2026-117947
MEDIUM 6.3
Use-after-free in the XML component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. |
|
CVE-2026-117944
MEDIUM 6.3
Use-after-free in the Layout component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 15… |
|
CVE-2026-117939
MEDIUM 6.3
Use-after-free in the XML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. |
|
CVE-2026-117938
MEDIUM 6.3
Use-after-free in the Layout component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 15… |
|
CVE-2026-117935
MEDIUM 6.3
Use-after-free in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, an… |
|
CVE-2026-117934
MEDIUM 6.3
Use-after-free in the Layout component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 15… |
|
CVE-2026-117933
MEDIUM 5.4
Frame poisoning in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird … |
|
CVE-2026-117927
MEDIUM 6.3
Use-after-free in the SVG component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. |
|
CVE-2026-117924
MEDIUM 6.3
Use-after-free in the XSLT component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.… |
|
CVE-2026-117923
MEDIUM 6.3
Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbi… |
|
CVE-2026-117916
MEDIUM 6.3
Use-after-free in the XSLT component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. |
|
CVE-2026-117914
MEDIUM 6.3
Use-after-free in the SVG component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. |
|
CVE-2026-117913
MEDIUM 6.3
Use-after-free in the SVG component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. |
|
CVE-2026-117911
MEDIUM 6.3
Use-after-free in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and… |
|
CVE-2026-117909
MEDIUM 6.3
Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. |
|
CVE-2026-117908
MEDIUM 6.3
Use-after-free in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Th… |
|
CVE-2026-117907
MEDIUM 6.3
Use-after-free in the Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbir… |
|
CVE-2026-117906
MEDIUM 6.3
Use-after-free in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 15… |
|
CVE-2026-117905
MEDIUM 6.3
Use-after-free in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and… |
|
CVE-2026-117903
MEDIUM 6.3
Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbi… |
|
CVE-2026-117902
MEDIUM 6.3
Use-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. |
|
CVE-2026-117898
MEDIUM 6.3
Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. |
|
CVE-2026-117896
MEDIUM 6.3
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thun… |
Manage your fleet with Appaloosa
Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.