Vulnerabilities

Tracked app vulnerabilities

3,490 CVEs affect a tracked app or OS (Medium, Windows). 21 of them are in the CISA KEV catalog, meaning exploitation is confirmed.

Matching CVEs: 3,490
Actively exploited: 21
Publication window: 2009-07-30 → 2026-09-29

All CVEs 3,490 CISA KEV 21 Public exploit 24 All severities Critical High Medium Low Hide N/A

All platforms iOS Android macOS Windows

Chronological sort: newest to oldest. Use the KEV / severity filters above to prioritize.

3,490 entries Medium Windows Clear all

CVE	Severity	KEV	Apps	Published
CVE-2021-21186 MEDIUM 4.3 2021-03-09 Insufficient policy enforcement in QR scanning in Google Chrome on iOS prior to 89.0.4389.72 allowed an attacker who convinced the user to scan a QR code to by…	MEDIUM 4.3	—		2021-03-09
CVE-2021-21185 MEDIUM 4.3 2021-03-09 Insufficient policy enforcement in extensions in Google Chrome prior to 89.0.4389.72 allowed an attacker who convinced a user to install a malicious extension …	MEDIUM 4.3	—		2021-03-09
CVE-2021-21184 MEDIUM 4.3 2021-03-09 Inappropriate implementation in performance APIs in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to leak cross-origin data via a crafted HTML …	MEDIUM 4.3	—		2021-03-09
CVE-2021-21183 MEDIUM 4.3 2021-03-09 Inappropriate implementation in performance APIs in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to leak cross-origin data via a crafted HTML …	MEDIUM 4.3	—		2021-03-09
CVE-2021-21182 MEDIUM 6.5 2021-03-09 Insufficient policy enforcement in navigations in Google Chrome prior to 89.0.4389.72 allowed a remote attacker who had compromised the renderer process to byp…	MEDIUM 6.5	—		2021-03-09
CVE-2021-21181 MEDIUM 6.5 2021-03-09 Side-channel information leakage in autofill in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to obtain potentially sensitive information from …	MEDIUM 6.5	—		2021-03-09
CVE-2021-21178 MEDIUM 6.5 2021-03-09 Inappropriate implementation in Compositing in Google Chrome on Linux and Windows prior to 89.0.4389.72 allowed a remote attacker to spoof the contents of the …	MEDIUM 6.5	—		2021-03-09
CVE-2021-21177 MEDIUM 6.5 2021-03-09 Insufficient policy enforcement in Autofill in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to obtain potentially sensitive information from p…	MEDIUM 6.5	—		2021-03-09
CVE-2021-21176 MEDIUM 6.5 2021-03-09 Inappropriate implementation in full screen mode in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to spoof the contents of the Omnibox (URL bar…	MEDIUM 6.5	—		2021-03-09
CVE-2021-21175 MEDIUM 6.5 2021-03-09 Inappropriate implementation in Site isolation in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to leak cross-origin data via a crafted HTML pa…	MEDIUM 6.5	—		2021-03-09
CVE-2021-21173 MEDIUM 6.5 2021-03-09 Side-channel information leakage in Network Internals in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to leak cross-origin data via a crafted …	MEDIUM 6.5	—		2021-03-09
CVE-2021-21171 MEDIUM 6.5 2021-03-09 Incorrect security UI in TabStrip and Navigation in Google Chrome on Android prior to 89.0.4389.72 allowed a remote attacker to spoof the contents of the Omnib…	MEDIUM 6.5	—		2021-03-09
CVE-2021-21170 MEDIUM 6.5 2021-03-09 Incorrect security UI in Loader in Google Chrome prior to 89.0.4389.72 allowed a remote attacker who had compromised the renderer process to spoof the contents…	MEDIUM 6.5	—		2021-03-09
CVE-2021-21168 MEDIUM 6.5 2021-03-09 Insufficient policy enforcement in appcache in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to obtain potentially sensitive information from p…	MEDIUM 6.5	—		2021-03-09
CVE-2021-21164 MEDIUM 6.5 2021-03-09 Insufficient data validation in Chrome on iOS in Google Chrome on iOS prior to 89.0.4389.72 allowed a remote attacker to leak cross-origin data via a crafted H…	MEDIUM 6.5	—		2021-03-09
CVE-2021-21163 MEDIUM 6.5 2021-03-09 Insufficient data validation in Reader Mode in Google Chrome on iOS prior to 89.0.4389.72 allowed a remote attacker to leak cross-origin data via a crafted HTM…	MEDIUM 6.5	—		2021-03-09
CVE-2021-23953 MEDIUM 4.3 2021-02-26 If a user clicked into a specifically crafted PDF, the PDF reader could be confused into leaking cross-origin information, when said information is served as c…	MEDIUM 4.3	—		2021-02-26
CVE-2021-23973 MEDIUM 6.5 2021-02-26 When trying to load a cross-origin resource in an audio/video context a decoding error may have resulted, and the content of that error may have revealed infor…	MEDIUM 6.5	—		2021-02-26
CVE-2021-23969 MEDIUM 4.3 2021-02-26 As specified in the W3C Content Security Policy draft, when creating a violation report, "User agents need to ensure that the source file is the URL requested …	MEDIUM 4.3	—		2021-02-26
CVE-2021-23968 MEDIUM 4.3 2021-02-26 If Content Security Policy blocked frame navigation, the full destination of a redirect served in the frame was reported in the violation report; as opposed to…	MEDIUM 4.3	—		2021-02-26
CVE-2021-23336 MEDIUM · vendor 2021-02-15 The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to W…	MEDIUM · vendor	—		2021-02-15
CVE-2021-21147 MEDIUM 4.3 2021-02-09 Inappropriate implementation in Skia in Google Chrome prior to 88.0.4324.146 allowed a local attacker to spoof the contents of the Omnibox (URL bar) via a craf…	MEDIUM 4.3	—		2021-02-09
CVE-2021-21141 MEDIUM 6.5 2021-02-09 Insufficient policy enforcement in File System API in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to bypass file extension policy via a craft…	MEDIUM 6.5	—		2021-02-09
CVE-2021-21140 MEDIUM 6.8 2021-02-09 Uninitialized use in USB in Google Chrome prior to 88.0.4324.96 allowed a local attacker to potentially perform out of bounds memory access via via a USB devic…	MEDIUM 6.8	—		2021-02-09
CVE-2021-21139 MEDIUM 6.5 2021-02-09 Inappropriate implementation in iframe sandbox in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to bypass navigation restrictions via a crafted…	MEDIUM 6.5	—		2021-02-09
CVE-2021-21137 MEDIUM 6.5 2021-02-09 Inappropriate implementation in DevTools in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to obtain potentially sensitive information from disk…	MEDIUM 6.5	—		2021-02-09
CVE-2021-21136 MEDIUM 6.5 2021-02-09 Insufficient policy enforcement in WebView in Google Chrome on Android prior to 88.0.4324.96 allowed a remote attacker to leak cross-origin data via a crafted …	MEDIUM 6.5	—		2021-02-09
CVE-2021-21135 MEDIUM 6.5 2021-02-09 Inappropriate implementation in Performance API in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to leak cross-origin data via a crafted HTML p…	MEDIUM 6.5	—		2021-02-09
CVE-2021-21134 MEDIUM 6.5 2021-02-09 Incorrect security UI in Page Info in Google Chrome on iOS prior to 88.0.4324.96 allowed a remote attacker to spoof security UI via a crafted HTML page.	MEDIUM 6.5	—		2021-02-09
CVE-2021-21133 MEDIUM 6.5 2021-02-09 Insufficient policy enforcement in Downloads in Google Chrome prior to 88.0.4324.96 allowed an attacker who convinced a user to download files to bypass naviga…	MEDIUM 6.5	—		2021-02-09
CVE-2021-21131 MEDIUM 6.5 2021-02-09 Insufficient policy enforcement in File System API in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to bypass filesystem restrictions via a cra…	MEDIUM 6.5	—		2021-02-09
CVE-2021-21130 MEDIUM 6.5 2021-02-09 Insufficient policy enforcement in File System API in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to bypass filesystem restrictions via a cra…	MEDIUM 6.5	—		2021-02-09
CVE-2021-21129 MEDIUM 6.5 2021-02-09 Insufficient policy enforcement in File System API in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to bypass filesystem restrictions via a cra…	MEDIUM 6.5	—		2021-02-09
CVE-2021-21126 MEDIUM 6.5 2021-02-09 Insufficient policy enforcement in extensions in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to bypass site isolation via a crafted Chrome Ex…	MEDIUM 6.5	—		2021-02-09
CVE-2021-21123 MEDIUM 6.5 2021-02-09 Insufficient data validation in File System API in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to bypass filesystem restrictions via a crafte…	MEDIUM 6.5	—		2021-02-09
CVE-2021-24080 MEDIUM · vendor Windows 2021-02-09 Windows Trust Verification API Denial of Service Vulnerability	MEDIUM · vendor	—	Windows	2021-02-09
CVE-2020-16046 MEDIUM 6.1 2021-01-14 Script injection in iOSWeb in Google Chrome on iOS prior to 84.0.4147.105 allowed a remote attacker to execute arbitrary code via a crafted HTML page.	MEDIUM 6.1	—		2021-01-14
CVE-2021-1705 MEDIUM 4.2 Microsoft Edge 2021-01-12 Microsoft Edge (HTML-based) Memory Corruption Vulnerability	MEDIUM 4.2	—	Microsoft Edge	2021-01-12
CVE-2020-16042 MEDIUM 6.5 2021-01-08 Uninitialized Use in V8 in Google Chrome prior to 87.0.4280.88 allowed a remote attacker to obtain potentially sensitive information from process memory via a …	MEDIUM 6.5	—		2021-01-08
CVE-2020-16040 MEDIUM 6.5 2021-01-08 Insufficient data validation in V8 in Google Chrome prior to 87.0.4280.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML p…	MEDIUM 6.5	—		2021-01-08
CVE-2020-16036 MEDIUM 6.5 2021-01-08 Inappropriate implementation in cookies in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to bypass cookie restrictions via a crafted HTML page.	MEDIUM 6.5	—		2021-01-08
CVE-2020-16034 MEDIUM 4.3 2021-01-08 Inappropriate implementation in WebRTC in Google Chrome prior to 87.0.4280.66 allowed a local attacker to bypass policy restrictions via a crafted HTML page.	MEDIUM 4.3	—		2021-01-08
CVE-2020-16033 MEDIUM 4.3 2021-01-08 Inappropriate implementation in WebUSB in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to spoof security UI via a crafted HTML page.	MEDIUM 4.3	—		2021-01-08
CVE-2020-16032 MEDIUM 4.3 2021-01-08 Insufficient data validation in sharing in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a c…	MEDIUM 4.3	—		2021-01-08
CVE-2020-16031 MEDIUM 4.3 2021-01-08 Insufficient data validation in UI in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafte…	MEDIUM 4.3	—		2021-01-08
CVE-2020-16030 MEDIUM 6.1 2021-01-08 Insufficient data validation in Blink in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted…	MEDIUM 6.1	—		2021-01-08
CVE-2020-16027 MEDIUM 6.5 2021-01-08 Insufficient policy enforcement in developer tools in Google Chrome prior to 87.0.4280.66 allowed an attacker who convinced a user to install a malicious exten…	MEDIUM 6.5	—		2021-01-08
CVE-2020-16012 MEDIUM 4.3 2021-01-08 Side-channel information leakage in graphics in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to leak cross-origin data via a crafted HTML page.	MEDIUM 4.3	—		2021-01-08
CVE-2020-35111 MEDIUM 4.3 2021-01-07 When an extension with the proxy permission registered to receive <all_urls>, the proxy.onRequest callback was not triggered for view-source URLs. While web co…	MEDIUM 4.3	—		2021-01-07
CVE-2020-26978 MEDIUM 6.1 2021-01-07 Using techniques that built on the slipstream research, a malicious webpage could have exposed both an internal network's hosts as well as services running on …	MEDIUM 6.1	—		2021-01-07

Manage your fleet with Appaloosa

Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.

Discover Appaloosa MDM