Vulnerabilities
Tracked app vulnerabilities
6,362 CVEs affect a tracked app or OS (Medium, all platforms). 33 of them are in the CISA KEV catalog, meaning exploitation is confirmed.
- Matching CVEs
- 6,362
- Actively exploited
- 33
- Publication window
- 2009-07-30 → 2026-11-10
Chronological sort: newest to oldest. Use the KEV / severity filters above to prioritize.
| CVE |
|---|
|
CVE-2026-10004
MEDIUM 6.5
Insufficient validation of untrusted input in Passwords in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to perform UI spoofing via a crafted… |
|
CVE-2026-9078
MEDIUM 5.4
Firefox for iOS displayed specially crafted right-to-left (RTL) and internationalized domain names (IDNs) incorrectly in link preview UI surfaces. A crafted RT… |
|
CVE-2026-9124
MEDIUM 5.3
Insufficient validation of untrusted input in Input in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker who had compromised the renderer proc… |
|
CVE-2026-9122
MEDIUM 6.5
Out of bounds read in GPU in Google Chrome on Mac prior to 148.0.7778.179 allowed a remote attacker to obtain potentially sensitive information from process me… |
|
CVE-2026-9116
MEDIUM 4.3
Insufficient policy enforcement in ServiceWorker in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker to leak cross-origin data via a crafted … |
|
CVE-2026-9115
MEDIUM 4.3
Insufficient policy enforcement in Service Worker in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker to bypass same origin policy via a craf… |
|
CVE-2026-9113
MEDIUM 4.3
Out of bounds read in GPU in Google Chrome on Mac prior to 148.0.7778.179 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML … |
|
CVE-2026-9110
MEDIUM 4.2
Inappropriate implementation in UI in Google Chrome on Windows prior to 148.0.7778.179 allowed a remote attacker who had compromised the renderer process to pe… |
|
CVE-2026-45585
MEDIUM 6.8
Microsoft is aware of a security feature bypass vulnerability in Windows publicly referred to as "YellowKey". The proof of concept for this vulnerabi… |
|
CVE-2026-8706
MEDIUM 6.5
Firefox for iOS hosted Reader mode on an unauthenticated local web server, allowing another application on the same device to request arbitrary URLs and receiv… |
|
CVE-2026-8971
MEDIUM 6.5
Same-origin policy bypass in the Networking: JAR component. This vulnerability was fixed in Firefox 151 and Thunderbird 151. |
|
CVE-2026-8961
MEDIUM 6.5
Spoofing issue in the Form Autofill component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11. |
|
CVE-2026-8586
MEDIUM 5.5
Inappropriate implementation in Chromoting in Google Chrome prior to 148.0.7778.168 allowed a local attacker to bypass discretionary access control via a malic… |
|
CVE-2026-8584
MEDIUM 4.2
Inappropriate implementation in Views in Google Chrome on iOS prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to per… |
|
CVE-2026-8583
MEDIUM 5.3
Insufficient policy enforcement in WebXR in Google Chrome on Android prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process… |
|
CVE-2026-8582
MEDIUM 5.3
Object lifecycle issue in Dawn in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to obtain potentially sensitive information from process memo… |
|
CVE-2026-8576
MEDIUM 4.3
Inappropriate implementation in CORS in Google Chrome on Linux and ChromeOS prior to 148.0.7778.168 allowed a remote attacker to leak cross-origin data via a c… |
|
CVE-2026-8570
MEDIUM 6.5
Type Confusion in V8 in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to obtain potentially sensitive information from process memory via a c… |
|
CVE-2026-8567
MEDIUM 4.3
Integer overflow in ANGLE in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker to perform an out of bounds memory write via a crafted … |
|
CVE-2026-8566
MEDIUM 4.3
Insufficient policy enforcement in Payments in Google Chrome on Android prior to 148.0.7778.168 allowed a remote attacker to bypass discretionary access contro… |
|
CVE-2026-8565
MEDIUM 4.7
Inappropriate implementation in Downloads in Google Chrome on Mac prior to 148.0.7778.168 allowed an attacker who convinced a user to install a malicious exten… |
|
CVE-2026-8564
MEDIUM 4.2
Incorrect security UI in Downloads in Google Chrome on Android and Mac prior to 148.0.7778.168 allowed a remote attacker to perform UI spoofing via a crafted H… |
|
CVE-2026-8563
MEDIUM 4.3
Insufficient policy enforcement in IFrame Sandbox in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker to bypass navigation restrictio… |
|
CVE-2026-8562
MEDIUM 4.3
Side-channel information leakage in Navigation in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to leak cross-origin data via a crafted HTML … |
|
CVE-2026-8561
MEDIUM 5.4
Incorrect security UI in Fullscreen in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromiu… |
|
CVE-2026-8560
MEDIUM 4.3
Heap buffer overflow in SwiftShader in Google Chrome on Mac and iOS prior to 148.0.7778.168 allowed a remote attacker to perform an out of bounds memory read v… |
|
CVE-2026-8559
MEDIUM 4.3
Integer overflow in Internationalization in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker to perform an out of bounds memory write… |
|
CVE-2026-8552
MEDIUM 4.3
Heap buffer overflow in GPU in Google Chrome on Android prior to 148.0.7778.168 allowed a remote attacker to perform an out of bounds memory write via a crafte… |
|
CVE-2026-8550
MEDIUM 6.5
Use after free in Google Lens in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to obtain potentially… |
|
CVE-2026-8546
MEDIUM 5.3
Out of bounds read in GPU in Google Chrome on Mac and Windows prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to obt… |
|
CVE-2026-8543
MEDIUM 5.3
Out of bounds read in FileSystem in Google Chrome on Mac prior to 148.0.7778.168 allowed a remote attacker who convinced a user to engage in specific UI gestur… |
|
CVE-2026-8541
MEDIUM 5.3
Out of bounds read in UI in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to obtain potentially sens… |
|
CVE-2026-8539
MEDIUM 5.4
Script injection in SanitizerAPI in Google Chrome on Android prior to 148.0.7778.168 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a… |
|
CVE-2026-8538
MEDIUM 5.3
Insufficient validation of untrusted input in GPU in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process t… |
|
CVE-2026-8537
MEDIUM 4.3
Insufficient policy enforcement in ViewTransitions in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to leak cross-origin data via a crafted H… |
|
CVE-2026-8535
MEDIUM 5.3
Out of bounds read in Media in Google Chrome on Linux and ChromeOS prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process t… |
|
CVE-2026-8528
MEDIUM 4.3
Insufficient validation of untrusted input in SiteIsolation in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer… |
|
CVE-2026-8516
MEDIUM 5.3
Insufficient validation of untrusted input in DataTransfer in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who convinced a user to engage in… |
|
CVE-2026-41097
MEDIUM 6.7
Reliance on a component that is not updateable in Windows Secure Boot allows an authorized attacker to bypass a security feature locally. |
|
CVE-2026-40421
MEDIUM 4.3
Files or directories accessible to external parties in Microsoft Office Word allows an unauthorized attacker to disclose information locally. |
|
CVE-2026-40380
MEDIUM 6.2
Heap-based buffer overflow in Volume Manager Extension Driver allows an authorized attacker to execute code with a physical attack. |
|
CVE-2026-35440
MEDIUM 5.5
Files or directories accessible to external parties in Microsoft Office Word allows an unauthorized attacker to disclose information locally. |
|
CVE-2026-35429
MEDIUM 4.3
User interface (ui) misrepresentation of critical information in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a net… |
|
CVE-2026-35423
MEDIUM 5.4
Out-of-bounds read in Telnet Client allows an unauthorized attacker to disclose information over a network. |
|
CVE-2026-35422
MEDIUM 6.5
Authentication bypass using an alternate path or channel in Windows TCP/IP allows an authorized attacker to bypass a security feature over a network. |
|
CVE-2026-35419
MEDIUM 5.5
Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to disclose information locally. |
|
CVE-2026-34350
MEDIUM 6.5
Null pointer dereference in Windows Storport Miniport Driver allows an unauthorized attacker to deny service over a network. |
|
CVE-2026-34339
MEDIUM 5.5
Null pointer dereference in Windows LDAP - Lightweight Directory Access Protocol allows an authorized attacker to deny service locally. |
|
CVE-2026-32209
MEDIUM 4.4
Improper access control in Windows Filtering Platform (WFP) allows an authorized attacker to bypass a security feature locally. |
|
CVE-2026-32170
MEDIUM 6.7
Double free in Windows Rich Text Edit allows an authorized attacker to elevate privileges locally. |
Manage your fleet with Appaloosa
Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.