Vulnerabilities
Tracked app vulnerabilities
6,362 CVEs affect a tracked app or OS (Medium, all platforms). 33 of them are in the CISA KEV catalog, meaning exploitation is confirmed.
- Matching CVEs
- 6,362
- Actively exploited
- 33
- Publication window
- 2009-07-30 → 2026-11-10
Chronological sort: newest to oldest. Use the KEV / severity filters above to prioritize.
| CVE |
|---|
|
CVE-2023-35377
MEDIUM 6.5
Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability |
|
CVE-2023-35376
MEDIUM 6.5
Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability |
|
CVE-2022-4955
MEDIUM 6.5
Inappropriate implementation in DevTools in Google Chrome prior to 108.0.5359.71 allowed an attacker who convinced a user to install a malicious extension to b… |
|
CVE-2023-3740
MEDIUM 4.3
Insufficient validation of untrusted input in Themes in Google Chrome prior to 115.0.5790.98 allowed a remote attacker to potentially serve malicious content t… |
|
CVE-2023-3739
MEDIUM 6.3
Insufficient validation of untrusted input in Chromad in Google Chrome on ChromeOS prior to 115.0.5790.131 allowed a remote attacker to execute arbitrary code … |
|
CVE-2023-3738
MEDIUM 4.3
Inappropriate implementation in Autofill in Google Chrome prior to 115.0.5790.98 allowed a remote attacker to obfuscate security UI via a crafted HTML page. (C… |
|
CVE-2023-3737
MEDIUM 4.3
Inappropriate implementation in Notifications in Google Chrome prior to 115.0.5790.98 allowed a remote attacker to spoof the contents of media notifications vi… |
|
CVE-2023-3736
MEDIUM 4.3
Inappropriate implementation in Custom Tabs in Google Chrome on Android prior to 115.0.5790.98 allowed a remote attacker to leak cross-origin data via a crafte… |
|
CVE-2023-3735
MEDIUM 4.3
Inappropriate implementation in Web API Permission Prompts in Google Chrome prior to 115.0.5790.98 allowed a remote attacker to obfuscate security UI via a cra… |
|
CVE-2023-3734
MEDIUM 4.3
Inappropriate implementation in Picture In Picture in Google Chrome prior to 115.0.5790.98 allowed a remote attacker to potentially spoof the contents of the O… |
|
CVE-2023-3733
MEDIUM 4.3
Inappropriate implementation in WebApp Installs in Google Chrome prior to 115.0.5790.98 allowed a remote attacker to potentially spoof the contents of the Omni… |
|
CVE-2023-4052
MEDIUM 6.5
The Firefox updater created a directory writable by non-privileged users. When uninstalling Firefox, any files in that directory would be recursively deleted w… |
|
CVE-2023-4049
MEDIUM 5.9
Race conditions in reference counting code were found through code inspection. These could have resulted in potentially exploitable use-after-free vulnerabilit… |
|
CVE-2023-4045
MEDIUM 5.3
Offscreen Canvas did not properly track cross-origin tainting, which could have been used to access image data from another site in violation of same-origin po… |
|
CVE-2023-2314
MEDIUM 6.5
Insufficient data validation in DevTools in Google Chrome prior to 111.0.5563.64 allowed a remote attacker to bypass navigation restrictions via a crafted HTML… |
|
CVE-2023-2311
MEDIUM 6.5
Insufficient policy enforcement in File System API in Google Chrome prior to 112.0.5615.49 allowed a remote attacker to bypass filesystem restrictions via a cr… |
|
CVE-2022-4926
MEDIUM 6.5
Insufficient policy enforcement in Intents in Google Chrome on Android prior to 109.0.5414.119 allowed a remote attacker to bypass same origin policy via a cra… |
|
CVE-2022-4925
MEDIUM 6.5
Insufficient validation of untrusted input in QUIC in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to perform header splitting via malicious n… |
|
CVE-2022-4922
MEDIUM 6.5
Inappropriate implementation in Blink in Google Chrome prior to 99.0.4844.51 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromiu… |
|
CVE-2022-4917
MEDIUM 4.3
Incorrect security UI in Notifications in Google Chrome on Android prior to 103.0.5060.53 allowed a remote attacker to obscure the full screen notification via… |
|
CVE-2022-4915
MEDIUM 6.5
Inappropriate implementation in URL Formatting in Google Chrome prior to 103.0.5060.134 allowed a remote attacker to perform domain spoofing via a crafted HTML… |
|
CVE-2022-4913
MEDIUM 6.5
Inappropriate implementation in Extensions in Google Chrome prior to 105.0.5195.52 allowed a remote attacker who had compromised the renderer process to spoof … |
|
CVE-2022-4911
MEDIUM 6.5
Insufficient data validation in DevTools in Google Chrome prior to 106.0.5249.62 allowed a remote attacker to bypass content security policy via a crafted HTML… |
|
CVE-2022-4910
MEDIUM 5.4
Inappropriate implementation in Autofill in Google Chrome prior to 107.0.5304.62 allowed a remote attacker to bypass navigation restrictions via a crafted HTML… |
|
CVE-2022-4909
MEDIUM 6.3
Inappropriate implementation in XML in Google Chrome prior to 107.0.5304.62 allowed a remote attacker to potentially perform an ASLR bypass via a crafted HTML … |
|
CVE-2022-4908
MEDIUM 4.3
Inappropriate implementation in iFrame Sandbox in Google Chrome prior to 107.0.5304.62 allowed a remote attacker to leak cross-origin data via a crafted HTML p… |
|
CVE-2021-4324
MEDIUM 6.5
Insufficient policy enforcement in Google Update in Google Chrome prior to 90.0.4430.93 allowed a remote attacker to read arbitrary files via a malicious file.… |
|
CVE-2021-4323
MEDIUM 6.5
Insufficient validation of untrusted input in Extensions in Google Chrome prior to 90.0.4430.72 allowed an attacker who convinced a user to install a malicious… |
|
CVE-2021-4321
MEDIUM 4.3
Policy bypass in Blink in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass content security policy via a crafted HTML page. (Chromium se… |
|
CVE-2021-4316
MEDIUM 4.3
Inappropriate implementation in Cast UI in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to spoof browser UI via a crafted HTML page. (Chromium… |
|
CVE-2023-36883
MEDIUM 4.3
Microsoft Edge for iOS Spoofing Vulnerability |
|
CVE-2023-37207
MEDIUM 6.5
A website could have obscured the fullscreen notification by using a URL with a scheme handled by an external program, such as a mailto URL. This could have le… |
|
CVE-2023-3497
MEDIUM 4.6
Out of bounds read in Google Security Processor firmware in Google Chrome on Chrome OS prior to 114.0.5735.90 allowed a local attacker to perform denial of ser… |
|
CVE-2023-26083
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2023-25012
MEDIUM · vendor
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2023-36539
MEDIUM 5.3
Exposure of information intended to be encrypted by some Zoom clients may lead to disclosure of sensitive information. |
|
CVE-2023-34658
MEDIUM 5.3
Telegram v9.6.3 on iOS allows attackers to hide critical information on the User Interface via calling the function SFSafariViewController. |
|
CVE-2023-32395
MEDIUM 5.5
A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.7.7, macOS Monterey 12.6.6, macOS Ventura 13.4. An app may … |
|
CVE-2023-29545
MEDIUM 6.5
Similar to CVE-2023-28163, this time when choosing 'Save Link As', suggested filenames containing environment variable names would have resolved those in the c… |
|
CVE-2023-32208
MEDIUM 5.3
Service workers could reveal script base URL due to dynamic `import()`. This vulnerability affects Firefox < 113. |
|
CVE-2023-29532
MEDIUM 5.5
A local attacker can trick the Mozilla Maintenance Service into applying an unsigned update file by pointing the service at an update file on a malicious SMB s… |
|
CVE-2023-28600
MEDIUM 5.2
Zoom for MacOSclients prior to 5.14.0 contain an improper access control vulnerability. A malicious user may be able to delete/replace Zoom Client files poten… |
|
CVE-2023-28599
MEDIUM 4.3
Zoom clients prior to 5.13.10 contain an HTML injection vulnerability. A malicious user could inject HTML into their display name potentially leading a victi… |
|
CVE-2023-33595
MEDIUM 5.5
CPython v3.12.0 alpha 7 was discovered to contain a heap use-after-free via the function ascii_decode at /Objects/unicodeobject.c. |
|
CVE-2023-32212
MEDIUM 4.3
An attacker could have positioned a `datalist` element to obscure the address bar. This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderb… |
|
CVE-2023-32211
MEDIUM 6.5
A type checking bug would have led to invalid code being compiled. This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102.11. |
|
CVE-2023-32206
MEDIUM 6.5
An out-of-bound read could have led to a crash in the RLBox Expat driver. This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102… |
|
CVE-2023-32205
MEDIUM 4.3
In multiple cases browser prompts could have been obscured by popups controlled by content. These could have led to potential user confusion and spoofing attac… |
|
CVE-2023-28164
MEDIUM 6.5
Dragging a URL from a cross-origin iframe that was removed during the drag could have led to user confusion and website spoofing attacks. This vulnerability af… |
|
CVE-2023-28163
MEDIUM 6.5
When downloading files through the Save As dialog on Windows with suggested filenames containing environment variable names, Windows would have resolved those … |
Manage your fleet with Appaloosa
Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.