Security
Vulnerabilities in the winget catalog.
Known CVEs for Windows applications shipped via the Microsoft Windows Package Manager community repository. Mapping is best-effort and limited to packages with a confirmed NVD CPE identity. Source: NVD (updated 2h ago).
Critical, last 90 days
Highest severity
Out of bounds read in GPU in Google Chrome on Android prior to 147.0.7727.117 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity:...
AffectsGoogle Chrome
Use after free in DevTools in Google Chrome prior to 147.0.7727.117 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
AffectsMitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.
Mitigation bypass in the Networking: Cookies component. This vulnerability was fixed in Firefox 150 and Thunderbird 150.
Mitigation bypass in the Networking: Cookies component. This vulnerability was fixed in Firefox 150 and Thunderbird 150.
Uninitialized memory in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.
Heap buffer overflow in ANGLE in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)
AffectsRace in Media in Google Chrome on Android prior to 147.0.7727.55 allowed a remote attacker who had compromised the renderer process to corrupt media stream metadata via a crafted HTML page. (Chromium security severity: Low)
AffectsUse after free in PrivateAI in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severi...
AffectsMemory safety bugs present in Firefox 149.0.1 and Thunderbird 149.0.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulne...
Recent
New advisories this month
Document structural anomalies caused inconsistencies between page element relationships and internal index states. When scripts triggered document modifications, object reference validity was not properly maintained, leading to a crash whe...
AffectsFoxit PDF Reader
Flaws in page lifecycle management allow document structure changes to desynchronize internal component states, causing subsequent operations to access invalidated objects and crash the program.
AffectsParsing logic flaws cause non-signature data to be misidentified as valid signatures when processing malformed form field hierarchies, leading to invalid memory writes and program crashes during internal data structure construction.
AffectsCalling a function that triggers a UI refresh after removing comments via a script may access an invalidated object, leading to program crashes.
AffectsA crafted XFA PDF can trigger a use-after-free condition during calculate event processing, causing the application to crash and resulting in an arbitrary code execution.
AffectsImproper control flow management allows a crafted document action chain to cause modal dialog reentry on the main thread, resulting in UI freeze and denial of service.
AffectsInsufficient parameter verification leads to the occurrence of format errors in files, which will trigger an unhandled "std::invalid_argument" exception, ultimately causing the program to terminate.
AffectsMemory safety bugs present in Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited...
Memory safety bugs present in Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could...
Race in GPU in Google Chrome on Windows prior to 147.0.7727.117 allowed a remote attacker to potentially perform a sandbox escape via a crafted video file. (Chromium security severity: Medium)
Affects
Affected packages
Packages with open CVEs
Mozilla Firefox (en-US)
Mozilla
1128
open
Mozilla Firefox (sco)
Mozilla
1128
open
Mozilla Firefox (si)
Mozilla
1128
open
Mozilla Firefox (zh-CN)
Mozilla
1128
open
Mozilla Firefox (zh-TW)
Mozilla
1128
open
Mozilla Firefox (ur)
Mozilla
1128
open
Mozilla Firefox (trs)
Mozilla
1128
open
Mozilla Firefox (sr)
Mozilla
1128
open
Mozilla Thunderbird ESR (lv)
Mozilla
731
open
Google Chrome
Google LLC
1927
open
Microsoft Edge
Microsoft Corporation
220
open
Visual Studio BuildTools 2022
Microsoft Corporation
118
open