Vulnerabilities

Tracked app vulnerabilities

3,840 CVEs affect a tracked app or OS (Medium, macOS). 9 of them are in the CISA KEV catalog, meaning exploitation is confirmed.

Matching CVEs: 3,840
Actively exploited: 9
Publication window: 2009-08-11 → 2026-11-10

All CVEs 3,840 CISA KEV 9 Public exploit 11 All severities Critical High Medium Low Hide N/A

All platforms iOS Android macOS Windows

Chronological sort: newest to oldest. Use the KEV / severity filters above to prioritize.

3,840 entries Medium macOS Clear all

CVE	Severity	KEV	Apps	Published
CVE-2020-6426 MEDIUM 6.5 2020-03-23 Inappropriate implementation in V8 in Google Chrome prior to 80.0.3987.149 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML …	MEDIUM 6.5	—		2020-03-23
CVE-2020-6425 MEDIUM 5.4 2020-03-23 Insufficient policy enforcement in extensions in Google Chrome prior to 80.0.3987.149 allowed an attacker who convinced a user to install a malicious extension…	MEDIUM 5.4	—		2020-03-23
CVE-2020-0696 MEDIUM 6.5 2020-02-11 A security feature bypass vulnerability exists in Microsoft Outlook software when it improperly handles the parsing of URI formats, aka 'Microsoft Outlook Secu…	MEDIUM 6.5	—		2020-02-11
CVE-2020-6412 MEDIUM 5.4 2020-02-11 Insufficient validation of untrusted input in Omnibox in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to perform domain spoofing via IDN homog…	MEDIUM 5.4	—		2020-02-11
CVE-2020-6411 MEDIUM 5.4 2020-02-11 Insufficient validation of untrusted input in Omnibox in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to perform domain spoofing via IDN homog…	MEDIUM 5.4	—		2020-02-11
CVE-2020-6408 MEDIUM 6.5 2020-02-11 Insufficient policy enforcement in CORS in Google Chrome prior to 80.0.3987.87 allowed a local attacker to obtain potentially sensitive information via a craft…	MEDIUM 6.5	—		2020-02-11
CVE-2020-6405 MEDIUM 6.5 2020-02-11 Out of bounds read in SQLite in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to obtain potentially sensitive information from process memory v…	MEDIUM 6.5	—		2020-02-11
CVE-2020-6403 MEDIUM 4.3 2020-02-11 Incorrect implementation in Omnibox in Google Chrome on iOS prior to 80.0.3987.87 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via …	MEDIUM 4.3	—		2020-02-11
CVE-2020-6401 MEDIUM 6.5 2020-02-11 Insufficient validation of untrusted input in Omnibox in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to perform domain spoofing via IDN homog…	MEDIUM 6.5	—		2020-02-11
CVE-2020-6400 MEDIUM 6.5 2020-02-11 Inappropriate implementation in CORS in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to leak cross-origin data via a crafted HTML page.	MEDIUM 6.5	—		2020-02-11
CVE-2020-6399 MEDIUM 6.5 2020-02-11 Insufficient policy enforcement in AppCache in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to leak cross-origin data via a crafted HTML page.	MEDIUM 6.5	—		2020-02-11
CVE-2020-6397 MEDIUM 6.5 2020-02-11 Inappropriate implementation in sharing in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to spoof security UI via a crafted HTML page.	MEDIUM 6.5	—		2020-02-11
CVE-2020-6396 MEDIUM 4.3 2020-02-11 Inappropriate implementation in Skia in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a craf…	MEDIUM 4.3	—		2020-02-11
CVE-2020-6395 MEDIUM 6.5 2020-02-11 Out of bounds read in JavaScript in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to obtain potentially sensitive information from process memo…	MEDIUM 6.5	—		2020-02-11
CVE-2020-6394 MEDIUM 5.4 2020-02-11 Insufficient policy enforcement in Blink in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to bypass content security policy via a crafted HTML …	MEDIUM 5.4	—		2020-02-11
CVE-2020-6393 MEDIUM 6.5 2020-02-11 Insufficient policy enforcement in Blink in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to leak cross-origin data via a crafted HTML page.	MEDIUM 6.5	—		2020-02-11
CVE-2020-6392 MEDIUM 4.3 2020-02-11 Insufficient policy enforcement in extensions in Google Chrome prior to 80.0.3987.87 allowed an attacker who convinced a user to install a malicious extension …	MEDIUM 4.3	—		2020-02-11
CVE-2020-6391 MEDIUM 4.3 2020-02-11 Insufficient validation of untrusted input in Blink in Google Chrome prior to 80.0.3987.87 allowed a local attacker to bypass content security policy via a cra…	MEDIUM 4.3	—		2020-02-11
CVE-2010-3917 MEDIUM 6.5 2020-02-06 Google Chrome before 3.0 does not properly handle XML documents, which allows remote attackers to obtain sensitive information via a crafted web site.	MEDIUM 6.5	—		2020-02-06
CVE-2019-13722 MEDIUM 6.5 2020-01-14 Inappropriate implementation in WebRTC in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HT…	MEDIUM 6.5	—		2020-01-14
CVE-2019-20372 MEDIUM · vendor Xcode 2020-01-09 NGINX before 1.17.7, with certain error_page configurations, allows HTTP request smuggling, as demonstrated by the ability of an attacker to read unauthorized …	MEDIUM · vendor	—	Xcode	2020-01-09
CVE-2019-5846 MEDIUM 6.5 2020-01-03 Out of bounds access in SwiftShader in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML …	MEDIUM 6.5	—		2020-01-03
CVE-2019-5845 MEDIUM 6.5 2020-01-03 Out of bounds access in SwiftShader in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML …	MEDIUM 6.5	—		2020-01-03
CVE-2019-5844 MEDIUM 6.5 2020-01-03 Out of bounds access in SwiftShader in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML …	MEDIUM 6.5	—		2020-01-03
CVE-2019-13766 MEDIUM 6.5 2020-01-03 Use-after-free in accessibility in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.	MEDIUM 6.5	—		2020-01-03
CVE-2019-13765 MEDIUM 6.5 2020-01-03 Use-after-free in content delivery manager in Google Chrome prior to 78.0.3904.70 allowed a remote attacker to potentially exploit heap corruption via a crafte…	MEDIUM 6.5	—		2020-01-03
CVE-2019-1464 MEDIUM 5.5 2019-12-10 An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory, aka 'Microsoft Excel Information Disclosur…	MEDIUM 5.5	—		2019-12-10
CVE-2019-1461 MEDIUM 6.5 2019-12-10 A denial of service vulnerability exists in Microsoft Word software when the software fails to properly handle objects in memory, aka 'Microsoft Word Denial of…	MEDIUM 6.5	—		2019-12-10
CVE-2019-13763 MEDIUM 4.3 2019-12-10 Insufficient policy enforcement in payments in Google Chrome prior to 79.0.3945.79 allowed a remote attacker who had compromised the renderer process to leak c…	MEDIUM 4.3	—		2019-12-10
CVE-2019-13761 MEDIUM 4.3 2019-12-10 Incorrect security UI in Omnibox in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted d…	MEDIUM 4.3	—		2019-12-10
CVE-2019-13759 MEDIUM 4.3 2019-12-10 Incorrect security UI in interstitials in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via a crafted HTML page.	MEDIUM 4.3	—		2019-12-10
CVE-2019-13758 MEDIUM 4.3 2019-12-10 Insufficient policy enforcement in navigation in Google Chrome on Android prior to 79.0.3945.79 allowed a remote attacker to bypass navigation restrictions via…	MEDIUM 4.3	—		2019-12-10
CVE-2019-13757 MEDIUM 4.3 2019-12-10 Incorrect security UI in Omnibox in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted d…	MEDIUM 4.3	—		2019-12-10
CVE-2019-13756 MEDIUM 4.3 2019-12-10 Incorrect security UI in printing in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via a crafted HTML page.	MEDIUM 4.3	—		2019-12-10
CVE-2019-13755 MEDIUM 4.3 2019-12-10 Insufficient policy enforcement in extensions in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to disable extensions via a crafted HTML page.	MEDIUM 4.3	—		2019-12-10
CVE-2019-13754 MEDIUM 4.3 2019-12-10 Insufficient policy enforcement in extensions in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to bypass navigation restrictions via a crafted …	MEDIUM 4.3	—		2019-12-10
CVE-2019-13753 MEDIUM 6.5 2019-12-10 Out of bounds read in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to obtain potentially sensitive information from process memory v…	MEDIUM 6.5	—		2019-12-10
CVE-2019-13752 MEDIUM 6.5 2019-12-10 Out of bounds read in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to obtain potentially sensitive information from process memory v…	MEDIUM 6.5	—		2019-12-10
CVE-2019-13751 MEDIUM 6.5 2019-12-10 Uninitialized data in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to obtain potentially sensitive information from process memory v…	MEDIUM 6.5	—		2019-12-10
CVE-2019-13750 MEDIUM 6.5 2019-12-10 Insufficient data validation in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to bypass defense-in-depth measures via a crafted HTML …	MEDIUM 6.5	—		2019-12-10
CVE-2019-13749 MEDIUM 6.5 2019-12-10 Incorrect security UI in Omnibox in Google Chrome on iOS prior to 79.0.3945.79 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a c…	MEDIUM 6.5	—		2019-12-10
CVE-2019-13748 MEDIUM 6.5 2019-12-10 Insufficient policy enforcement in developer tools in Google Chrome prior to 79.0.3945.79 allowed a local attacker to obtain potentially sensitive information …	MEDIUM 6.5	—		2019-12-10
CVE-2019-13746 MEDIUM 6.5 2019-12-10 Insufficient policy enforcement in Omnibox in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via …	MEDIUM 6.5	—		2019-12-10
CVE-2019-13745 MEDIUM 6.5 2019-12-10 Insufficient policy enforcement in audio in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to leak cross-origin data via a crafted HTML page.	MEDIUM 6.5	—		2019-12-10
CVE-2019-13744 MEDIUM 6.5 2019-12-10 Insufficient policy enforcement in cookies in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to leak cross-origin data via a crafted HTML page.	MEDIUM 6.5	—		2019-12-10
CVE-2019-13743 MEDIUM 6.5 2019-12-10 Incorrect security UI in external protocol handling in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to spoof security UI via a crafted HTML pa…	MEDIUM 6.5	—		2019-12-10
CVE-2019-13742 MEDIUM 6.5 2019-12-10 Incorrect security UI in Omnibox in Google Chrome on iOS prior to 79.0.3945.79 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a c…	MEDIUM 6.5	—		2019-12-10
CVE-2019-13740 MEDIUM 6.5 2019-12-10 Incorrect security UI in sharing in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via a crafted HTML page.	MEDIUM 6.5	—		2019-12-10
CVE-2019-13739 MEDIUM 6.5 2019-12-10 Insufficient policy enforcement in Omnibox in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via IDN homographs via a…	MEDIUM 6.5	—		2019-12-10
CVE-2019-13738 MEDIUM 6.5 2019-12-10 Insufficient policy enforcement in navigation in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to bypass site isolation via a crafted HTML page.	MEDIUM 6.5	—		2019-12-10

Manage your fleet with Appaloosa

Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.

Discover Appaloosa MDM