Vulnerabilities

Tracked app vulnerabilities

3,505 CVEs affect a tracked app or OS (Medium, Windows). 21 of them are in the CISA KEV catalog, meaning exploitation is confirmed.

Matching CVEs: 3,505
Actively exploited: 21
Publication window: 2009-07-30 → 2026-09-29

All CVEs 3,505 CISA KEV 21 Public exploit 24 All severities Critical High Medium Low Hide N/A

All platforms iOS Android macOS Windows

Chronological sort: newest to oldest. Use the KEV / severity filters above to prioritize.

3,505 entries Medium Windows Clear all

CVE	Severity	KEV	Apps	Published
CVE-2017-8642 MEDIUM 6.1 Microsoft Edge 2017-08-08 Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to elevate privileges due to the way that Microsoft Edge validates JavaScript under specific con…	MEDIUM 6.1	—	Microsoft Edge	2017-08-08
CVE-2017-8637 MEDIUM 5.3 Microsoft Edge 2017-08-08 Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to bypass Arbitrary Code Guard (ACG) due to how Microsoft Edge accesses memory in code compiled …	MEDIUM 5.3	—	Microsoft Edge	2017-08-08
CVE-2017-8572 MEDIUM 5.5 2017-08-01 Microsoft Outlook 2007 SP3, Outlook 2010 SP2, Outlook 2013 SP1, Outlook 2013 RT SP1, and Outlook 2016 as packaged in Microsoft Office allows an information dis…	MEDIUM 5.5	—		2017-08-01
CVE-2017-0196 MEDIUM 6.5 Microsoft Edge 2017-07-17 An information disclosure vulnerability in Microsoft scripting engine allows remote attackers to obtain sensitive information from process memory via a crafted…	MEDIUM 6.5	—	Microsoft Edge	2017-07-17
CVE-2017-8611 MEDIUM 6.5 Microsoft Edge 2017-07-11 Microsoft Edge on Microsoft Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows remote attackers to spoof web content via a crafted web site,…	MEDIUM 6.5	—	Microsoft Edge	2017-07-11
CVE-2017-8602 MEDIUM 6.5 Microsoft Edge 2017-07-11 Microsoft browsers on Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 R2, Windows 10 Gold, 1511, 1607,…	MEDIUM 6.5	—	Microsoft Edge	2017-07-11
CVE-2017-8599 MEDIUM 6.5 Microsoft Edge 2017-07-11 Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an attacker to trick a user into loading a page with maliciou…	MEDIUM 6.5	—	Microsoft Edge	2017-07-11
CVE-2017-8592 MEDIUM 6.5 Microsoft Edge Windows 2017-07-11 Microsoft browsers on when Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1, Windows RT 8.1, and Windows Server 2012 and R2, Windows 10 Gold, 1…	MEDIUM 6.5	—	Microsoft Edge Windows	2017-07-11
CVE-2017-0170 MEDIUM · vendor Windows 2017-07-11 Windows Performance Monitor Information Disclosure Vulnerability	MEDIUM · vendor	—	Windows	2017-07-11
CVE-2017-8555 MEDIUM 4.3 Microsoft Edge 2017-06-15 Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to trick a user into loading a page with malicious content when the Edge Content Security Policy…	MEDIUM 4.3	—	Microsoft Edge	2017-06-15
CVE-2017-8530 MEDIUM 5.4 Microsoft Edge 2017-06-15 Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an attacker to trick a user into loading a page with maliciou…	MEDIUM 5.4	—	Microsoft Edge	2017-06-15
CVE-2017-8529 MEDIUM 6.5 Microsoft Edge 2017-06-15 Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, and Windows Server 2012 and R2 allow an attacker to d…	MEDIUM 6.5	—	Microsoft Edge	2017-06-15
CVE-2017-8523 MEDIUM 4.3 Microsoft Edge 2017-06-15 Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an attacker to trick a user into loading a page with maliciou…	MEDIUM 4.3	—	Microsoft Edge	2017-06-15
CVE-2017-8508 MEDIUM 5.5 2017-06-15 A security feature bypass vulnerability exists in Microsoft Office software when it improperly handles the parsing of file formats, aka "Microsoft Office Secur…	MEDIUM 5.5	—		2017-06-15
CVE-2017-8504 MEDIUM 4.3 Microsoft Edge 2017-06-15 Microsoft Edge in Windows 10 1607 and 1703, and Windows Server 2016 allows an attacker to read the URL of a cross-origin request when the Microsoft Edge Fetch …	MEDIUM 4.3	—	Microsoft Edge	2017-06-15
CVE-2017-8498 MEDIUM 4.3 Microsoft Edge 2017-06-15 Microsoft Edge in Windows 10 1607 and 1703, and Windows Server 2016 allows an attacker to read data not intended to be disclosed when Edge allows JavaScript XM…	MEDIUM 4.3	—	Microsoft Edge	2017-06-15
CVE-2015-1207 MEDIUM 6.5 2017-06-06 Double-free vulnerability in libavformat/mov.c in FFMPEG in Google Chrome 41.0.2251.0 allows remote attackers to cause a denial of service (memory corruption a…	MEDIUM 6.5	—		2017-06-06
CVE-2017-0241 MEDIUM 5.3 Microsoft Edge 2017-05-12 An elevation of privilege vulnerability exists when Microsoft Edge renders a domain-less page in the URL, which could allow Microsoft Edge to perform actions i…	MEDIUM 5.3	—	Microsoft Edge	2017-05-12
CVE-2017-0231 MEDIUM 4.3 Microsoft Edge 2017-05-12 A spoofing vulnerability exists when Microsoft browsers render SmartScreen Filter, aka "Microsoft Browser Spoofing Vulnerability."	MEDIUM 4.3	—	Microsoft Edge	2017-05-12
CVE-2017-5041 MEDIUM 4.3 2017-04-24 Google Chrome prior to 57.0.2987.100 incorrectly handled back-forward navigation, which allowed a remote attacker to display incorrect information for a site v…	MEDIUM 4.3	—		2017-04-24
CVE-2017-5038 MEDIUM 6.3 2017-04-24 Chrome Apps in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac had a use after free bug in GuestView, which allowed a remote attacker to perfor…	MEDIUM 6.3	—		2017-04-24
CVE-2013-6662 MEDIUM 6.5 2017-04-13 Google Chrome caches TLS sessions before certificate validation occurs.	MEDIUM 6.5	—		2017-04-13
CVE-2017-0208 MEDIUM 4.3 Microsoft Edge 2017-04-12 An information disclosure vulnerability exists in Microsoft Edge when the Chakra scripting engine does not properly handle objects in memory. An attacker who s…	MEDIUM 4.3	—	Microsoft Edge	2017-04-12
CVE-2017-0204 MEDIUM 5.5 2017-04-12 Microsoft Outlook 2007 SP3, Microsoft Outlook 2010 SP2, Microsoft Outlook 2013 SP1, and Microsoft Outlook 2016 allow remote attackers to bypass the Office Prot…	MEDIUM 5.5	—		2017-04-12
CVE-2017-0203 MEDIUM 4.3 Microsoft Edge 2017-04-12 A vulnerability exists in Microsoft Edge when the Edge Content Security Policy (CSP) fails to properly validate certain specially crafted documents. An attacke…	MEDIUM 4.3	—	Microsoft Edge	2017-04-12
CVE-2017-0194 MEDIUM 5.5 2017-04-12 Microsoft Excel 2007 SP3, Microsoft Excel 2010 SP2, and Office Compatibility Pack SP2 allow remote attackers to obtain sensitive information from process memor…	MEDIUM 5.5	—		2017-04-12
CVE-2017-2480 MEDIUM 6.5 2017-04-02 An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. iCloud before 6.2 on Windows is affected. iTune…	MEDIUM 6.5	—		2017-04-02
CVE-2017-0140 MEDIUM 4.2 Microsoft Edge 2017-03-17 Microsoft Edge allows remote attackers to bypass the Same Origin Policy for HTML elements in other browser windows, aka "Microsoft Edge Security Feature Bypass…	MEDIUM 4.2	—	Microsoft Edge	2017-03-17
CVE-2017-0135 MEDIUM 4.2 Microsoft Edge 2017-03-17 Microsoft Edge allows remote attackers to bypass the Same Origin Policy for HTML elements in other browser windows, aka "Microsoft Edge Security Feature Bypass…	MEDIUM 4.2	—	Microsoft Edge	2017-03-17
CVE-2017-0105 MEDIUM 5.5 2017-03-17 Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word for Mac 2011, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server 2010 S…	MEDIUM 5.5	—		2017-03-17
CVE-2017-0069 MEDIUM 4.3 Microsoft Edge 2017-03-17 Microsoft Edge allows remote attackers to spoof web content via a crafted web site, aka "Microsoft Edge Spoofing Vulnerability." This vulnerability is differen…	MEDIUM 4.3	—	Microsoft Edge	2017-03-17
CVE-2017-0068 MEDIUM 4.3 Microsoft Edge 2017-03-17 Browsers in Microsoft Edge allow remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Microsoft Edge Information D…	MEDIUM 4.3	—	Microsoft Edge	2017-03-17
CVE-2017-0066 MEDIUM 4.2 Microsoft Edge 2017-03-17 Microsoft Edge allows remote attackers to bypass the Same Origin Policy for HTML elements in other browser windows, aka "Microsoft Edge Security Feature Bypass…	MEDIUM 4.2	—	Microsoft Edge	2017-03-17
CVE-2017-0065 MEDIUM 4.3 Microsoft Edge 2017-03-17 Microsoft Edge allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Microsoft Browser Information Disclosur…	MEDIUM 4.3	—	Microsoft Edge	2017-03-17
CVE-2017-0033 MEDIUM 4.3 Microsoft Edge 2017-03-17 Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to spoof web content via a crafted web site, aka "Microsoft Browser Spoofing Vulnerabi…	MEDIUM 4.3	—	Microsoft Edge	2017-03-17
CVE-2017-0029 MEDIUM 5.5 2017-03-17 Microsoft Office 2010 SP2, Word 2010 SP2, Word 2013 RT SP1, and Word 2016 allow remote attackers to cause a denial of service (application hang) via a crafted …	MEDIUM 5.5	—		2017-03-17
CVE-2017-0027 MEDIUM 4.7 2017-03-17 Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 RT SP1, Excel 2016, Office Compatibility Pack SP3, and Excel Services on SharePoint Server 2013 SP1 allow …	MEDIUM 4.7	—		2017-03-17
CVE-2017-0017 MEDIUM 6.1 Microsoft Edge 2017-03-17 The RegEx class in the XSS filter in Microsoft Edge allows remote attackers to conduct cross-site scripting (XSS) attacks and obtain sensitive information via …	MEDIUM 6.1	—	Microsoft Edge	2017-03-17
CVE-2017-0012 MEDIUM 4.3 Microsoft Edge 2017-03-17 Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to spoof web content via a crafted web site, aka "Microsoft Browser Spoofing Vulnerabi…	MEDIUM 4.3	—	Microsoft Edge	2017-03-17
CVE-2017-0011 MEDIUM 4.3 Microsoft Edge 2017-03-17 Microsoft Edge allows remote attackers to obtain sensitive information via a crafted web site, aka "Microsoft Edge Information Disclosure Vulnerability." This …	MEDIUM 4.3	—	Microsoft Edge	2017-03-17
CVE-2017-5026 MEDIUM 4.3 2017-02-17 Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, failed to prevent alerts from being displayed by swapped out frames, which allowed a remote att…	MEDIUM 4.3	—		2017-02-17
CVE-2017-5025 MEDIUM 5.5 2017-02-17 FFmpeg in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, failed to perform proper bounds checking, which allowed a remote attacker to potentia…	MEDIUM 5.5	—		2017-02-17
CVE-2017-5024 MEDIUM 5.5 2017-02-17 FFmpeg in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, failed to perform proper bounds checking, which allowed a remote attacker to potentia…	MEDIUM 5.5	—		2017-02-17
CVE-2017-5017 MEDIUM 4.3 2017-02-17 Interactions with the OS in Google Chrome prior to 56.0.2924.76 for Mac insufficiently cleared video memory, which allowed a remote attacker to possibly extrac…	MEDIUM 4.3	—		2017-02-17
CVE-2017-5013 MEDIUM 6.5 2017-02-17 Google Chrome prior to 56.0.2924.76 for Linux incorrectly handled new tab page navigations in non-selected tabs, which allowed a remote attacker to spoof the c…	MEDIUM 6.5	—		2017-02-17
CVE-2017-5011 MEDIUM 6.5 2017-02-17 Google Chrome prior to 56.0.2924.76 for Windows insufficiently sanitized DevTools URLs, which allowed a remote attacker who convinced a user to install a malic…	MEDIUM 6.5	—		2017-02-17
CVE-2016-5226 MEDIUM 6.1 2017-01-19 Blink in Google Chrome prior to 55.0.2883.75 for Linux, Windows and Mac executed javascript: URLs entered in the URL bar in the context of the current tab, whi…	MEDIUM 6.1	—		2017-01-19
CVE-2016-5214 MEDIUM 4.3 2017-01-19 Google Chrome prior to 55.0.2883.75 for Windows mishandled downloaded files, which allowed a remote attacker to prevent the downloaded file from receiving the …	MEDIUM 4.3	—		2017-01-19
CVE-2016-5205 MEDIUM 6.1 2017-01-19 Blink in Google Chrome prior to 55.0.2883.75 for Linux, Windows and Mac, incorrectly handles deferred page loads, which allowed a remote attacker to inject arb…	MEDIUM 6.1	—		2017-01-19
CVE-2016-5201 MEDIUM 6.5 2017-01-19 A leak of privateClass in the extensions API in Google Chrome prior to 54.0.2840.100 for Linux, and 54.0.2840.99 for Windows, and 54.0.2840.98 for Mac allowed …	MEDIUM 6.5	—		2017-01-19

Manage your fleet with Appaloosa

Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.

Discover Appaloosa MDM