Vulnerabilities
Tracked app vulnerabilities
12,531 CVEs affect a tracked app or OS (High, Windows). 246 of them are in the CISA KEV catalog, meaning exploitation is confirmed.
- Matching CVEs
- 12,531
- Actively exploited
- 246
- Publication window
- 2004-07-27 → 2026-11-11
Chronological sort: newest to oldest. Use the KEV / severity filters above to prioritize.
| CVE |
|---|
|
CVE-2026-35436
HIGH 8.8
Use after free in Microsoft Office allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-35424
HIGH 7.5
Missing release of memory after effective lifetime in Windows Internet Key Exchange (IKE) Protocol allows an unauthorized attacker to deny service over a netwo… |
|
CVE-2026-35421
HIGH 7.8
Heap-based buffer overflow in Windows GDI allows an unauthorized attacker to execute code locally. |
|
CVE-2026-35420
HIGH 7.8
Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-35418
HIGH 7.8
Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-35417
HIGH 7.8
Use after free in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-35416
HIGH 7.0
Access of resource using incompatible type ('type confusion') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privile… |
|
CVE-2026-35415
HIGH 7.8
Integer overflow or wraparound in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-34351
HIGH 7.8
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows TCP/IP allows an authorized attacker to elevate privileg… |
|
CVE-2026-34347
HIGH 7.0
Use after free in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-34345
HIGH 7.0
Access of resource using incompatible type ('type confusion') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privile… |
|
CVE-2026-34344
HIGH 7.8
Access of resource using incompatible type ('type confusion') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privile… |
|
CVE-2026-34343
HIGH 7.8
Heap-based buffer overflow in Windows Application Identity (AppID) Subsystem allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-34342
HIGH 7.0
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Print Spooler Components allows an authorized attacker t… |
|
CVE-2026-34341
HIGH 7.0
Double free in Windows Link-Layer Discovery Protocol (LLDP) allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-34340
HIGH 7.0
Use after free in Windows Projected File System allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-34338
HIGH 7.8
Use after free in Windows Telephony Service allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-34337
HIGH 7.8
Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-34336
HIGH 7.8
Integer overflow or wraparound in Windows DWM Core Library allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-34334
HIGH 7.8
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows TCP/IP allows an authorized attacker to elevate privileg… |
|
CVE-2026-34333
HIGH 7.8
Use after free in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-34332
HIGH 8.0
Use after free in Windows Kernel-Mode Drivers allows an authorized attacker to execute code over a network. |
|
CVE-2026-34331
HIGH 7.0
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K - GRFX allows an authorized attacker to elevate p… |
|
CVE-2026-34330
HIGH 7.8
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K - GRFX allows an authorized attacker to elevate p… |
|
CVE-2026-34329
HIGH 8.8
Heap-based buffer overflow in Windows Message Queuing allows an unauthorized attacker to execute code over an adjacent network. |
|
CVE-2026-33841
HIGH 7.8
Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-33840
HIGH 7.8
Use after free in Windows Win32K - ICOMP allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-33839
HIGH 7.0
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K - GRFX allows an authorized attacker to elevate p… |
|
CVE-2026-33838
HIGH 7.8
Double free in Windows Message Queuing allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-33837
HIGH 7.8
Heap-based buffer overflow in Windows TCP/IP allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-33835
HIGH 7.8
Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-33834
HIGH 7.8
Improper access control in Windows Event Logging Service allows an authorized attacker to elevate privileges locally. |
|
CVE-2026-32161
HIGH 7.5
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Native WiFi Miniport Driver allows an unauthorized attac… |
|
CVE-2026-8390
HIGH 7.3
Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 150.0.3. |
|
CVE-2026-8389
HIGH 8.8
JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 150.0.3. |
|
CVE-2026-7210
HIGH 7.5
`xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger has… |
|
CVE-2026-8093
HIGH 8.1
Memory safety bugs present in Thunderbird 150.0.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these… |
|
CVE-2026-8092
HIGH 8.1
Memory safety bugs present in Thunderbird ESR 140.10.1 and Thunderbird 150.0.1. Some of these bugs showed evidence of memory corruption and we presume that wit… |
|
CVE-2026-8090
HIGH 7.3
Use-after-free in the DOM: Networking component. This vulnerability was fixed in Firefox 150.0.2, Firefox ESR 140.10.2, Firefox ESR 115.35.2, Thunderbird 150.0… |
|
CVE-2026-8018
HIGH 8.1
Insufficient policy enforcement in DevTools in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to potentially perform a sandbox escape via malic… |
|
CVE-2026-8016
HIGH 8.8
Use after free in WebRTC in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. … |
|
CVE-2026-8007
HIGH 7.5
Insufficient validation of untrusted input in Cast in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process t… |
|
CVE-2026-8002
HIGH 8.8
Use after free in Audio in Google Chrome on Mac prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML … |
|
CVE-2026-8001
HIGH 8.3
Use After Free in Printing in Google Chrome on Linux, Mac, ChromeOS prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process t… |
|
CVE-2026-8000
HIGH 8.8
Insufficient validation of untrusted input in ChromeDriver in Google Chrome on Windows prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary co… |
|
CVE-2026-7997
HIGH 7.8
Insufficient validation of untrusted input in Updater in Google Chrome on Mac prior to 148.0.7778.96 allowed a local attacker to perform OS-level privilege esc… |
|
CVE-2026-7995
HIGH 8.8
Out of bounds read in AdFilter in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML … |
|
CVE-2026-7994
HIGH 7.8
Inappropriate implementation in Chromoting in Google Chrome on Windows prior to 148.0.7778.96 allowed a local attacker to perform OS-level privilege escalation… |
|
CVE-2026-7992
HIGH 8.8
Insufficient validation of untrusted input in UI in Google Chrome on Linux, ChromeOS prior to 148.0.7778.96 allowed a remote attacker who convinced a user to e… |
|
CVE-2026-7991
HIGH 8.8
Use after free in UI in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to execute arbitrary code insid… |
Manage your fleet with Appaloosa
Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.