Vulnerabilities
Tracked app vulnerabilities
6,362 CVEs affect a tracked app or OS (Medium, all platforms). 33 of them are in the CISA KEV catalog, meaning exploitation is confirmed.
- Matching CVEs
- 6,362
- Actively exploited
- 33
- Publication window
- 2009-07-30 → 2026-11-10
Chronological sort: newest to oldest. Use the KEV / severity filters above to prioritize.
| CVE |
|---|
|
CVE-2024-27872
MEDIUM 5.5
This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Sonoma 14.6. An app may be able to access protected user data. |
|
CVE-2024-27871
A path handling issue was addressed with improved validation. This issue is fixed in iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6. An app may be able to access … |
|
CVE-2024-27863
An information disclosure issue was addressed with improved private data redaction for log entries. This issue is fixed in iOS 17.6 and iPadOS 17.6, macOS Sono… |
|
CVE-2024-27853
MEDIUM 4.4
This issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.4. A maliciously crafted ZIP archive may bypass Gatekeeper checks. |
|
CVE-2024-27823
A race condition was addressed with improved locking. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Monterey 12.7.5, mac… |
|
CVE-2024-27809
MEDIUM 5.5
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sonoma 14.4. An app may be able to access user… |
|
CVE-2024-38103
MEDIUM 5.9
Microsoft Edge (Chromium-based) Information Disclosure Vulnerability |
|
CVE-2024-38156
MEDIUM 6.1
Microsoft Edge (Chromium-based) Spoofing Vulnerability |
|
CVE-2024-5500
MEDIUM 6.5
Inappropriate implementation in Sign-In in Google Chrome prior to 1.3.36.351 allowed a remote attacker to bypass navigation restrictions via a crafted HTML pag… |
|
CVE-2024-3175
MEDIUM 6.3
Insufficient data validation in Extensions in Google Chrome prior to 120.0.6099.62 allowed a remote attacker to perform privilege escalation via a crafted Chro… |
|
CVE-2024-2884
MEDIUM 6.5
Out of bounds read in V8 in Google Chrome prior to 121.0.6167.139 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HT… |
|
CVE-2023-7013
MEDIUM 4.7
Inappropriate implementation in Compositing in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to potentially spoof security UI via a crafted H… |
|
CVE-2023-7011
MEDIUM 6.5
Inappropriate implementation in Picture in Picture in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to spoof the contents of the Omnibox (URL… |
|
CVE-2020-36765
MEDIUM 6.5
Insufficient policy enforcement in Navigation in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to leak cross-origin data via a crafted HTML pag… |
|
CVE-2024-6777
MEDIUM 6.5
Use after free in Navigation in Google Chrome prior to 126.0.6478.182 allowed an attacker who convinced a user to install a malicious extension to potentially … |
|
CVE-2024-38020
MEDIUM 6.5
Microsoft Outlook Spoofing Vulnerability |
|
CVE-2024-6614
MEDIUM · vendor
The frame iterator could get stuck in a loop when encountering certain wasm frames leading to incorrect stack traces. This vulnerability affects Firefox < 128 … |
|
CVE-2024-6613
MEDIUM · vendor
The frame iterator could get stuck in a loop when encountering certain wasm frames leading to incorrect stack traces. This vulnerability affects Firefox < 128 … |
|
CVE-2024-6612
MEDIUM · vendor
CSP violations generated links in the console tab of the developer tools, pointing to the violating resource. This caused a DNS prefetch which leaked that a CS… |
|
CVE-2024-6610
MEDIUM · vendor
Form validation popups could capture escape key presses. Therefore, spamming form validation messages could be used to prevent users from exiting full-screen m… |
|
CVE-2024-6608
MEDIUM · vendor
It was possible to move the cursor using pointerlock from an iframe. This allowed moving the cursor outside of the viewport and the Firefox window. This vulner… |
|
CVE-2024-6603
MEDIUM · vendor
In an out-of-memory scenario an allocation could fail but free would have been called on the pointer afterwards leading to memory corruption. This vulnerabilit… |
|
CVE-2024-6601
MEDIUM · vendor
A race condition could lead to a cross-origin container obtaining permissions of the top-level origin. This vulnerability affects Firefox < 128, Firefox ESR < … |
|
CVE-2024-6600
MEDIUM 6.3
Due to large allocation checks in Angle for GLSL shaders being too lenient an out-of-bounds access could occur when allocating more than 8192 ints in private s… |
|
CVE-2024-39684
MEDIUM · vendor
Github: CVE-2024-39684 TenCent RapidJSON Elevation of Privilege Vulnerability |
|
CVE-2024-38517
MEDIUM · vendor
Github: CVE-2024-38517 TenCent RapidJSON Elevation of Privilege Vulnerability |
|
CVE-2024-39891
MEDIUM 5.3
KEV
In the Twilio Authy API, accessed by Authy Android before 25.1.0 and Authy iOS before 26.1.0, an unauthenticated endpoint provided access to certain phone-numb… |
|
CVE-2024-38093
MEDIUM 4.3
Microsoft Edge (Chromium-based) Spoofing Vulnerability |
|
CVE-2024-38082
MEDIUM 4.7
Microsoft Edge (Chromium-based) Spoofing Vulnerability |
|
CVE-2024-30057
MEDIUM 5.4
Microsoft Edge for iOS Spoofing Vulnerability |
|
CVE-2024-34130
MEDIUM 5.5
Acrobat Mobile Sign Android versions 24.4.2.33155 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature … |
|
CVE-2024-5843
MEDIUM 6.5
Inappropriate implementation in Downloads in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to obfuscate security UI via a malicious file. (Chr… |
|
CVE-2024-5840
MEDIUM 6.5
Policy bypass in CORS in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to bypass discretionary access control via a crafted HTML page. (Chromi… |
|
CVE-2024-5839
MEDIUM 6.5
Inappropriate Implementation in Memory Allocator in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially exploit heap corruption via a… |
|
CVE-2024-30096
MEDIUM 5.5
Windows Cryptographic Services Information Disclosure Vulnerability |
|
CVE-2024-30076
MEDIUM 6.8
Windows Container Manager Service Elevation of Privilege Vulnerability |
|
CVE-2024-30069
MEDIUM 4.7
Windows Remote Access Connection Manager Information Disclosure Vulnerability |
|
CVE-2024-30067
MEDIUM 5.5
Winlogon Elevation of Privilege Vulnerability |
|
CVE-2024-30066
MEDIUM 5.5
Winlogon Elevation of Privilege Vulnerability |
|
CVE-2024-30065
MEDIUM 5.5
Windows Themes Denial of Service Vulnerability |
|
CVE-2024-30063
MEDIUM 6.7
Windows Distributed File System (DFS) Remote Code Execution Vulnerability |
|
CVE-2024-5693
MEDIUM 6.1
Offscreen Canvas did not properly track cross-origin tainting, which could be used to access image data from another site in violation of same-origin policy. T… |
|
CVE-2024-5692
MEDIUM 6.5
On Windows 10, when using the 'Save As' functionality, an attacker could have tricked the browser into saving the file with a disallowed extension such as `.ur… |
|
CVE-2024-5691
MEDIUM 4.7
By tricking the browser with a `X-Frame-Options` header, a sandboxed iframe could have presented a button that, if clicked by a user, would bypass restrictions… |
|
CVE-2024-5690
MEDIUM · vendor
By monitoring the time certain operations take, an attacker could have guessed which external protocol handlers were functional on a user's system. This vulner… |
|
CVE-2024-27885
MEDIUM 6.3
This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Monterey 12.7.5, macOS Sonoma 14.5, macOS Ventura 13.6.7. An app ma… |
|
CVE-2024-27850
This issue was addressed with improvements to the noise injection algorithm. This issue is fixed in Safari 17.5, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, v… |
|
CVE-2024-27844
The issue was addressed with improved checks. This issue is fixed in Safari 17.5, macOS Sonoma 14.5, visionOS 1.2. A website's permission dialog may persist af… |
|
CVE-2024-27840
The issue was addressed with improved memory handling. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Monterey 12.7.5, ma… |
|
CVE-2024-27838
The issue was addressed by adding additional logic. This issue is fixed in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14… |
Manage your fleet with Appaloosa
Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.