Vulnerabilities

Tracked app vulnerabilities

3,840 CVEs affect a tracked app or OS (Medium, macOS). 9 of them are in the CISA KEV catalog, meaning exploitation is confirmed.

Matching CVEs: 3,840
Actively exploited: 9
Publication window: 2009-08-11 → 2026-11-10

All CVEs 3,840 CISA KEV 9 Public exploit 11 All severities Critical High Medium Low Hide N/A

All platforms iOS Android macOS Windows

Chronological sort: newest to oldest. Use the KEV / severity filters above to prioritize.

3,840 entries Medium macOS Clear all

CVE	Severity	KEV	Apps	Published
CVE-2021-21217 MEDIUM 5.5 2021-04-26 Uninitialized data in PDFium in Google Chrome prior to 90.0.4430.72 allowed a remote attacker to obtain potentially sensitive information from process memory v…	MEDIUM 5.5	—		2021-04-26
CVE-2021-21216 MEDIUM 6.5 2021-04-26 Inappropriate implementation in Autofill in Google Chrome prior to 90.0.4430.72 allowed a remote attacker to spoof security UI via a crafted HTML page.	MEDIUM 6.5	—		2021-04-26
CVE-2021-21215 MEDIUM 6.5 2021-04-26 Inappropriate implementation in Autofill in Google Chrome prior to 90.0.4430.72 allowed a remote attacker to spoof security UI via a crafted HTML page.	MEDIUM 6.5	—		2021-04-26
CVE-2021-21212 MEDIUM 6.5 2021-04-26 Incorrect security UI in Network Config UI in Google Chrome on ChromeOS prior to 90.0.4430.72 allowed a remote attacker to potentially compromise WiFi connecti…	MEDIUM 6.5	—		2021-04-26
CVE-2021-21210 MEDIUM 6.5 2021-04-26 Inappropriate implementation in Network in Google Chrome prior to 90.0.4430.72 allowed a remote attacker to potentially access local UDP ports via a crafted HT…	MEDIUM 6.5	—		2021-04-26
CVE-2021-21209 MEDIUM 6.5 2021-04-26 Inappropriate implementation in storage in Google Chrome prior to 90.0.4430.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page.	MEDIUM 6.5	—		2021-04-26
CVE-2021-21208 MEDIUM 6.5 2021-04-26 Insufficient data validation in QR scanner in Google Chrome on iOS prior to 90.0.4430.72 allowed an attacker displaying a QR code to perform domain spoofing vi…	MEDIUM 6.5	—		2021-04-26
CVE-2021-28456 MEDIUM 5.5 2021-04-13 Microsoft Excel Information Disclosure Vulnerability	MEDIUM 5.5	—		2021-04-13
CVE-2021-1800 MEDIUM 5.5 Xcode 2021-04-02 A path handling issue was addressed with improved validation. This issue is fixed in Xcode 12.4. A malicious application may be able to access arbitrary files …	MEDIUM 5.5	—	Xcode	2021-04-02
CVE-2020-7463 MEDIUM 5.5 2021-03-26 In FreeBSD 12.1-STABLE before r364644, 11.4-STABLE before r364651, 12.1-RELEASE before p9, 11.4-RELEASE before p3, and 11.3-RELEASE before p13, improper handli…	MEDIUM 5.5	—		2021-03-26
CVE-2021-28133 MEDIUM 4.3 Zoom 2021-03-18 Zoom through 5.5.4 sometimes allows attackers to read private information on a participant's screen, even though the participant never attempted to share the p…	MEDIUM 4.3	—	Zoom	2021-03-18
CVE-2021-21189 MEDIUM 4.3 2021-03-09 Insufficient policy enforcement in payments in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to bypass navigation restrictions via a crafted HT…	MEDIUM 4.3	—		2021-03-09
CVE-2021-21187 MEDIUM 4.3 2021-03-09 Insufficient data validation in URL formatting in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to perform domain spoofing via IDN homographs v…	MEDIUM 4.3	—		2021-03-09
CVE-2021-21186 MEDIUM 4.3 2021-03-09 Insufficient policy enforcement in QR scanning in Google Chrome on iOS prior to 89.0.4389.72 allowed an attacker who convinced the user to scan a QR code to by…	MEDIUM 4.3	—		2021-03-09
CVE-2021-21185 MEDIUM 4.3 2021-03-09 Insufficient policy enforcement in extensions in Google Chrome prior to 89.0.4389.72 allowed an attacker who convinced a user to install a malicious extension …	MEDIUM 4.3	—		2021-03-09
CVE-2021-21184 MEDIUM 4.3 2021-03-09 Inappropriate implementation in performance APIs in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to leak cross-origin data via a crafted HTML …	MEDIUM 4.3	—		2021-03-09
CVE-2021-21183 MEDIUM 4.3 2021-03-09 Inappropriate implementation in performance APIs in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to leak cross-origin data via a crafted HTML …	MEDIUM 4.3	—		2021-03-09
CVE-2021-21182 MEDIUM 6.5 2021-03-09 Insufficient policy enforcement in navigations in Google Chrome prior to 89.0.4389.72 allowed a remote attacker who had compromised the renderer process to byp…	MEDIUM 6.5	—		2021-03-09
CVE-2021-21181 MEDIUM 6.5 2021-03-09 Side-channel information leakage in autofill in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to obtain potentially sensitive information from …	MEDIUM 6.5	—		2021-03-09
CVE-2021-21178 MEDIUM 6.5 2021-03-09 Inappropriate implementation in Compositing in Google Chrome on Linux and Windows prior to 89.0.4389.72 allowed a remote attacker to spoof the contents of the …	MEDIUM 6.5	—		2021-03-09
CVE-2021-21177 MEDIUM 6.5 2021-03-09 Insufficient policy enforcement in Autofill in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to obtain potentially sensitive information from p…	MEDIUM 6.5	—		2021-03-09
CVE-2021-21176 MEDIUM 6.5 2021-03-09 Inappropriate implementation in full screen mode in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to spoof the contents of the Omnibox (URL bar…	MEDIUM 6.5	—		2021-03-09
CVE-2021-21175 MEDIUM 6.5 2021-03-09 Inappropriate implementation in Site isolation in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to leak cross-origin data via a crafted HTML pa…	MEDIUM 6.5	—		2021-03-09
CVE-2021-21173 MEDIUM 6.5 2021-03-09 Side-channel information leakage in Network Internals in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to leak cross-origin data via a crafted …	MEDIUM 6.5	—		2021-03-09
CVE-2021-21171 MEDIUM 6.5 2021-03-09 Incorrect security UI in TabStrip and Navigation in Google Chrome on Android prior to 89.0.4389.72 allowed a remote attacker to spoof the contents of the Omnib…	MEDIUM 6.5	—		2021-03-09
CVE-2021-21170 MEDIUM 6.5 2021-03-09 Incorrect security UI in Loader in Google Chrome prior to 89.0.4389.72 allowed a remote attacker who had compromised the renderer process to spoof the contents…	MEDIUM 6.5	—		2021-03-09
CVE-2021-21168 MEDIUM 6.5 2021-03-09 Insufficient policy enforcement in appcache in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to obtain potentially sensitive information from p…	MEDIUM 6.5	—		2021-03-09
CVE-2021-21164 MEDIUM 6.5 2021-03-09 Insufficient data validation in Chrome on iOS in Google Chrome on iOS prior to 89.0.4389.72 allowed a remote attacker to leak cross-origin data via a crafted H…	MEDIUM 6.5	—		2021-03-09
CVE-2021-21163 MEDIUM 6.5 2021-03-09 Insufficient data validation in Reader Mode in Google Chrome on iOS prior to 89.0.4389.72 allowed a remote attacker to leak cross-origin data via a crafted HTM…	MEDIUM 6.5	—		2021-03-09
CVE-2021-21147 MEDIUM 4.3 2021-02-09 Inappropriate implementation in Skia in Google Chrome prior to 88.0.4324.146 allowed a local attacker to spoof the contents of the Omnibox (URL bar) via a craf…	MEDIUM 4.3	—		2021-02-09
CVE-2021-21141 MEDIUM 6.5 2021-02-09 Insufficient policy enforcement in File System API in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to bypass file extension policy via a craft…	MEDIUM 6.5	—		2021-02-09
CVE-2021-21140 MEDIUM 6.8 2021-02-09 Uninitialized use in USB in Google Chrome prior to 88.0.4324.96 allowed a local attacker to potentially perform out of bounds memory access via via a USB devic…	MEDIUM 6.8	—		2021-02-09
CVE-2021-21139 MEDIUM 6.5 2021-02-09 Inappropriate implementation in iframe sandbox in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to bypass navigation restrictions via a crafted…	MEDIUM 6.5	—		2021-02-09
CVE-2021-21137 MEDIUM 6.5 2021-02-09 Inappropriate implementation in DevTools in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to obtain potentially sensitive information from disk…	MEDIUM 6.5	—		2021-02-09
CVE-2021-21136 MEDIUM 6.5 2021-02-09 Insufficient policy enforcement in WebView in Google Chrome on Android prior to 88.0.4324.96 allowed a remote attacker to leak cross-origin data via a crafted …	MEDIUM 6.5	—		2021-02-09
CVE-2021-21135 MEDIUM 6.5 2021-02-09 Inappropriate implementation in Performance API in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to leak cross-origin data via a crafted HTML p…	MEDIUM 6.5	—		2021-02-09
CVE-2021-21134 MEDIUM 6.5 2021-02-09 Incorrect security UI in Page Info in Google Chrome on iOS prior to 88.0.4324.96 allowed a remote attacker to spoof security UI via a crafted HTML page.	MEDIUM 6.5	—		2021-02-09
CVE-2021-21133 MEDIUM 6.5 2021-02-09 Insufficient policy enforcement in Downloads in Google Chrome prior to 88.0.4324.96 allowed an attacker who convinced a user to download files to bypass naviga…	MEDIUM 6.5	—		2021-02-09
CVE-2021-21131 MEDIUM 6.5 2021-02-09 Insufficient policy enforcement in File System API in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to bypass filesystem restrictions via a cra…	MEDIUM 6.5	—		2021-02-09
CVE-2021-21130 MEDIUM 6.5 2021-02-09 Insufficient policy enforcement in File System API in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to bypass filesystem restrictions via a cra…	MEDIUM 6.5	—		2021-02-09
CVE-2021-21129 MEDIUM 6.5 2021-02-09 Insufficient policy enforcement in File System API in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to bypass filesystem restrictions via a cra…	MEDIUM 6.5	—		2021-02-09
CVE-2021-21126 MEDIUM 6.5 2021-02-09 Insufficient policy enforcement in extensions in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to bypass site isolation via a crafted Chrome Ex…	MEDIUM 6.5	—		2021-02-09
CVE-2021-21123 MEDIUM 6.5 2021-02-09 Insufficient data validation in File System API in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to bypass filesystem restrictions via a crafte…	MEDIUM 6.5	—		2021-02-09
CVE-2020-16046 MEDIUM 6.1 2021-01-14 Script injection in iOSWeb in Google Chrome on iOS prior to 84.0.4147.105 allowed a remote attacker to execute arbitrary code via a crafted HTML page.	MEDIUM 6.1	—		2021-01-14
CVE-2020-16042 MEDIUM 6.5 2021-01-08 Uninitialized Use in V8 in Google Chrome prior to 87.0.4280.88 allowed a remote attacker to obtain potentially sensitive information from process memory via a …	MEDIUM 6.5	—		2021-01-08
CVE-2020-16040 MEDIUM 6.5 2021-01-08 Insufficient data validation in V8 in Google Chrome prior to 87.0.4280.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML p…	MEDIUM 6.5	—		2021-01-08
CVE-2020-16036 MEDIUM 6.5 2021-01-08 Inappropriate implementation in cookies in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to bypass cookie restrictions via a crafted HTML page.	MEDIUM 6.5	—		2021-01-08
CVE-2020-16034 MEDIUM 4.3 2021-01-08 Inappropriate implementation in WebRTC in Google Chrome prior to 87.0.4280.66 allowed a local attacker to bypass policy restrictions via a crafted HTML page.	MEDIUM 4.3	—		2021-01-08
CVE-2020-16033 MEDIUM 4.3 2021-01-08 Inappropriate implementation in WebUSB in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to spoof security UI via a crafted HTML page.	MEDIUM 4.3	—		2021-01-08
CVE-2020-16032 MEDIUM 4.3 2021-01-08 Insufficient data validation in sharing in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a c…	MEDIUM 4.3	—		2021-01-08

Manage your fleet with Appaloosa

Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.

Discover Appaloosa MDM