Actively exploited vulnerabilities (CISA KEV)

Protection mechanism failure in Windows Shell allows an unauthorized attacker to perform spoofing over a network.

Windows Remote Access Connection Manager Denial of Service Vulnerability

Exposure of sensitive information to an unauthorized actor in Desktop Windows Manager allows an authorized attacker to disclose information locally.

A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Seq…

MEDIUM 5.4

WhatsApp

2025-08-29

Incomplete authorization of linked device synchronization messages in WhatsApp for iOS prior to v2.25.21.73, WhatsApp Business for iOS v2.25.21.78, and WhatsAp…

This issue was addressed with improved checks. This issue is fixed in iOS 15.8.4 and iPadOS 15.8.4, iOS 16.7.11 and iPadOS 16.7.11, iOS 18.3.1 and iPadOS 18.3.…

Indexed via Android Security Bulletin; full NVD metadata pending.

An authorization issue was addressed with improved state management. This issue is fixed in iOS 15.8.4 and iPadOS 15.8.4, iOS 16.7.11 and iPadOS 16.7.11, iOS 1…

A cookie management issue was addressed with improved state management. This issue is fixed in Safari 18.1.1, iOS 17.7.2 and iPadOS 17.7.2, iOS 18.1.1 and iPad…

Windows MSHTML Platform Spoofing Vulnerability

Windows Mark of the Web Security Feature Bypass Vulnerability

Windows Mark of the Web Security Feature Bypass Vulnerability

MEDIUM 5.3

2024-07-02

In the Twilio Authy API, accessed by Authy Android before 25.1.0 and Authy iOS before 26.1.0, an unauthenticated endpoint provided access to certain phone-numb…

An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 17.1.2 and iPadOS 17.1.2, macOS Sonoma 14.1.2, Safari 17.1.2. Pr…

MEDIUM 6.5

2023-09-12

Microsoft Word Information Disclosure Vulnerability

Indexed via Android Security Bulletin; full NVD metadata pending.

Windows SmartScreen Security Feature Bypass Vulnerability

Windows SmartScreen Security Feature Bypass Vulnerability

Windows Mark of the Web Security Feature Bypass Vulnerability

Windows Mark of the Web Security Feature Bypass Vulnerability

MEDIUM 6.5

2022-09-26

Insufficient validation of untrusted input in Intents in Google Chrome on Android prior to 104.0.5112.101 allowed a remote attacker to arbitrarily browse to a …

WinVerifyTrust Signature Validation Vulnerability

MEDIUM 6.1

2021-11-23

Insufficient validation of untrusted input in Intents in Google Chrome on Android prior to 95.0.4638.69 allowed a remote attacker to arbitrarily browser to a m…

Windows Installer Elevation of Privilege Vulnerability

MEDIUM 6.5

2021-10-08

Inappropriate implementation in Memory in Google Chrome prior to 94.0.4606.71 allowed a remote attacker to obtain potentially sensitive information from proces…

Scripting Engine Memory Corruption Vulnerability

MEDIUM 6.5

2021-06-07

Insufficient policy enforcement in PopupBlocker in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass navigation restrictions via a crafte…

Indexed via Android Security Bulletin; full NVD metadata pending.

MEDIUM 4.2

Microsoft Edge

2020-09-11

<p>A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory. The vulnerability could corrupt memory in a way th…

MEDIUM 6.5

Microsoft Edge

2016-09-14

Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to obtain sensitive information via a crafted web site, aka "Microsoft Brows…

MEDIUM 6.5

2013-05-16

Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 do not properly initialize data …