Vulnerabilities
Tracked app vulnerabilities
6,362 CVEs affect a tracked app or OS (Medium, all platforms). 33 of them are in the CISA KEV catalog, meaning exploitation is confirmed.
- Matching CVEs
- 6,362
- Actively exploited
- 33
- Publication window
- 2009-07-30 → 2026-11-10
Chronological sort: newest to oldest. Use the KEV / severity filters above to prioritize.
| CVE |
|---|
|
CVE-2023-1234
MEDIUM 4.3
Inappropriate implementation in Intents in Google Chrome on Android prior to 111.0.5563.64 allowed a remote attacker to perform domain spoofing via a crafted H… |
|
CVE-2023-1233
MEDIUM 4.3
Insufficient policy enforcement in Resource Timing in Google Chrome prior to 111.0.5563.64 allowed an attacker who convinced a user to install a malicious exte… |
|
CVE-2023-1232
MEDIUM 4.3
Insufficient policy enforcement in Resource Timing in Google Chrome prior to 111.0.5563.64 allowed a remote attacker to obtain potentially sensitive informatio… |
|
CVE-2023-1231
MEDIUM 4.3
Inappropriate implementation in Autofill in Google Chrome on Android prior to 111.0.5563.64 allowed a remote attacker to potentially spoof the contents of the … |
|
CVE-2023-1230
MEDIUM 4.3
Inappropriate implementation in WebApp Installs in Google Chrome on Android prior to 111.0.5563.64 allowed an attacker who convinced a user to install a malici… |
|
CVE-2023-1229
MEDIUM 4.3
Inappropriate implementation in Permission prompts in Google Chrome prior to 111.0.5563.64 allowed a remote attacker to bypass navigation restrictions via a cr… |
|
CVE-2023-1228
MEDIUM 4.3
Insufficient policy enforcement in Intents in Google Chrome on Android prior to 111.0.5563.64 allowed a remote attacker to bypass navigation restrictions via a… |
|
CVE-2023-1226
MEDIUM 6.5
Insufficient policy enforcement in Web Payments API in Google Chrome prior to 111.0.5563.64 allowed a remote attacker to bypass content security policy via a c… |
|
CVE-2023-1225
MEDIUM 4.3
Insufficient policy enforcement in Navigation in Google Chrome on iOS prior to 111.0.5563.64 allowed a remote attacker to bypass same origin policy via a craft… |
|
CVE-2023-1224
MEDIUM 4.3
Insufficient policy enforcement in Web Payments API in Google Chrome prior to 111.0.5563.64 allowed a remote attacker to bypass navigation restrictions via a c… |
|
CVE-2023-1223
MEDIUM 4.3
Insufficient policy enforcement in Autofill in Google Chrome on Android prior to 111.0.5563.64 allowed a remote attacker to leak cross-origin data via a crafte… |
|
CVE-2023-1221
MEDIUM 4.3
Insufficient policy enforcement in Extensions API in Google Chrome prior to 111.0.5563.64 allowed an attacker who convinced a user to install a malicious exten… |
|
CVE-2023-1217
MEDIUM 6.5
Stack buffer overflow in Crash reporting in Google Chrome on Windows prior to 111.0.5563.64 allowed a remote attacker who had compromised the renderer process … |
|
CVE-2023-21721
MEDIUM 6.5
Microsoft OneNote Elevation of Privilege Vulnerability |
|
CVE-2023-21714
MEDIUM 5.5
Microsoft Office Information Disclosure Vulnerability |
|
CVE-2023-21699
MEDIUM 5.3
Windows Internet Storage Name Service (iSNS) Server Information Disclosure Vulnerability |
|
CVE-2023-21697
MEDIUM 6.2
Windows Internet Storage Name Service (iSNS) Server Information Disclosure Vulnerability |
|
CVE-2023-21694
MEDIUM 6.8
Windows Fax Service Remote Code Execution Vulnerability |
|
CVE-2023-21693
MEDIUM 5.7
Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability |
|
CVE-2023-21687
MEDIUM 5.5
HTTP.sys Information Disclosure Vulnerability |
|
CVE-2023-0704
MEDIUM 6.5
Insufficient policy enforcement in DevTools in Google Chrome prior to 110.0.5481.77 allowed a remote attacker to bypass same origin policy and proxy settings v… |
|
CVE-2023-0700
MEDIUM 6.5
Inappropriate implementation in Download in Google Chrome prior to 110.0.5481.77 allowed a remote attacker to potentially spoof the contents of the Omnibox (UR… |
|
CVE-2023-0697
MEDIUM 6.5
Inappropriate implementation in Full screen mode in Google Chrome on Android prior to 110.0.5481.77 allowed a remote attacker to spoof the contents of the secu… |
|
CVE-2022-39842
MEDIUM · vendor
Indexed via Android Security Bulletin; full NVD metadata pending. |
|
CVE-2023-0141
MEDIUM 4.3
Insufficient policy enforcement in CORS in Google Chrome prior to 109.0.5414.74 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (C… |
|
CVE-2023-0140
MEDIUM 6.5
Inappropriate implementation in in File System API in Google Chrome on Windows prior to 109.0.5414.74 allowed a remote attacker to bypass file system restricti… |
|
CVE-2023-0139
MEDIUM 6.5
Insufficient validation of untrusted input in Downloads in Google Chrome on Windows prior to 109.0.5414.74 allowed a remote attacker to bypass download restric… |
|
CVE-2023-0133
MEDIUM 6.5
Inappropriate implementation in in Permission prompts in Google Chrome on Android prior to 109.0.5414.74 allowed a remote attacker to bypass main origin permis… |
|
CVE-2023-0132
MEDIUM 6.5
Inappropriate implementation in in Permission prompts in Google Chrome on Windows prior to 109.0.5414.74 allowed a remote attacker to force acceptance of a per… |
|
CVE-2023-0131
MEDIUM 6.5
Inappropriate implementation in in iframe Sandbox in Google Chrome prior to 109.0.5414.74 allowed a remote attacker to bypass file download restrictions via a … |
|
CVE-2023-0130
MEDIUM 6.5
Inappropriate implementation in in Fullscreen API in Google Chrome on Android prior to 109.0.5414.74 allowed a remote attacker to spoof the contents of the Omn… |
|
CVE-2022-36928
MEDIUM 6.1
Zoom for Android clients before version 5.13.0 contain a path traversal vulnerability. A third party app could exploit this vulnerability to read and write to … |
|
CVE-2022-4025
MEDIUM 4.3
Inappropriate implementation in Paint in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to leak cross-origin data outside an iframe via a crafte… |
|
CVE-2022-3863
MEDIUM 6.1
Use after free in Browser History in Google Chrome prior to 100.0.4896.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML p… |
|
CVE-2022-0801
MEDIUM 6.1
Inappropriate implementation in HTML parser in Google Chrome prior to 99.0.4844.51 allowed a remote attacker to bypass XSS preventions via a crafted HTML page.… |
|
CVE-2022-0337
MEDIUM 6.5
Inappropriate implementation in File System API in Google Chrome on Windows prior to 97.0.4692.71 allowed a remote attacker to obtain potentially sensitive inf… |
|
CVE-2021-21200
MEDIUM 5.4
Out of bounds read in WebUI Settings in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to perform an out of bounds memory read via a crafted HTM… |
|
CVE-2018-16135
MEDIUM 6.5
The Opera Mini application 47.1.2249.129326 for Android allows remote attackers to spoof the Location Permission dialog via a crafted web site. |
|
CVE-2022-46880
MEDIUM 6.5
A missing check related to tex units could have led to a use-after-free and potentially exploitable crash.<br />*Note*: This advisory was added on December 13t… |
|
CVE-2022-46875
MEDIUM 6.5
The executable file warning was not presented when downloading .atloc and .ftploc files, which can run commands on a user's computer. <br>*Note: This issue onl… |
|
CVE-2022-45420
MEDIUM 6.5
Use tables inside of an iframe, an attacker could have caused iframe contents to be rendered outside the boundaries of the iframe, resulting in potential user … |
|
CVE-2022-45418
MEDIUM 6.1
If a custom mouse cursor is specified in CSS, under certain circumstances the cursor could have been drawn over the browser UI, resulting in potential user con… |
|
CVE-2022-45416
MEDIUM 6.5
Keyboard events reference strings like "KeyA" that were at fixed, known, and widely-spread addresses. Cache-based timing attacks such as Prime+Probe could have… |
|
CVE-2022-45411
MEDIUM 6.1
Cross-Site Tracing occurs when a server will echo a request back via the Trace method, allowing an XSS attack to access to authorization headers and cookies in… |
|
CVE-2022-45410
MEDIUM · vendor
When a ServiceWorker intercepted a request with <code>FetchEvent</code>, the origin of the request was lost after the ServiceWorker took ownership of it. This … |
|
CVE-2022-45408
MEDIUM 6.5
Through a series of popups that reuse windowName, an attacker can cause a window to go fullscreen without the user seeing the notification prompt, resulting in… |
|
CVE-2022-45405
MEDIUM 6.5
Freeing arbitrary <code>nsIInputStream</code>'s on a different thread than creation could have led to a use-after-free and potentially exploitable crash. This … |
|
CVE-2022-45404
MEDIUM 6.5
Through a series of popup and <code>window.print()</code> calls, an attacker can cause a window to go fullscreen without the user seeing the notification promp… |
|
CVE-2022-45403
MEDIUM 6.5
Service Workers should not be able to infer information about opaque cross-origin responses; but timing information for cross-origin media combined with Range … |
|
CVE-2022-42929
MEDIUM 6.5
If a website called `window.print()` in a particular way, it could cause a denial of service of the browser, which may persist beyond browser restart depending… |
Manage your fleet with Appaloosa
Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.