CVE Tracker Hub
Track Real Vulnerabilities Across Every Device You Own
A central hub for tracking actively exploited vulnerabilities across Windows, macOS, iPhone, and Android. Learn what CVEs are, why they matter, and which ones are being exploited right now. All data sourced from CISA KEV, NVD, vendor security bulletins, and threat intelligence researchers.
What Is a CVE?
CVE stands for Common Vulnerabilities and Exposures — a standardized system for identifying and tracking known security vulnerabilities. Every CVE gets a unique ID number that security professionals, vendors, and researchers use to reference the same bug unambiguously.
Unique Identification
Every vulnerability gets a unique CVE ID (like CVE-2025-43529) that's recognized worldwide. This means when Apple, Google, CISA, and your security vendor all say "CVE-2025-43529," they're talking about the exact same bug — no confusion, no ambiguity.
Severity Scoring (CVSS)
Each CVE gets a CVSS score from 0 to 10 that measures how severe it is. The score factors in attack vector (network vs local), complexity, required privileges, user interaction, and impact on confidentiality, integrity, and availability.
CISA KEV Catalog
The CISA Known Exploited Vulnerabilities (KEV) catalog is a list of CVEs that have been confirmed as actively exploited in the wild. U.S. federal agencies are required to patch KEV-listed vulnerabilities within a specific deadline. If a CVE is on this list, it's not theoretical — it's being used in real attacks right now.
Zero-Day vs N-Day
A zero-day is a CVE that's being actively exploited before the vendor has released a patch — the vendor has had "zero days" to fix it. An n-day is a CVE that has been patched, but attackers still target devices that haven't updated yet. Most real-world attacks use n-days, not zero-days.
How to Read a CVE ID
CVE IDs follow a standardized format that tells you the year and the sequence number:
CVSS Severity Scale
The Common Vulnerability Scoring System (CVSS) assigns a score from 0.0 to 10.0 based on technical characteristics of the vulnerability. Higher scores mean greater risk.
Minor impact
Moderate risk
Significant risk
Catastrophic
Why Tracking CVEs Is Critical for Your Security
Knowing which CVEs affect your devices — and which ones are being actively exploited — is the foundation of practical security. Here's the lifecycle of a vulnerability and why timing matters.
Researcher finds the vulnerability
A security researcher (or sometimes an attacker) discovers a flaw in software. They report it to the vendor through responsible disclosure, or in some cases, the flaw is found being exploited in the wild first.
A CVE ID is assigned
A CVE Numbering Authority (CNA) — like Microsoft, Apple, Google, or MITRE — assigns a unique CVE ID. The details may be kept private until a patch is available to prevent attackers from exploiting it.
Vendor develops and tests a fix
The vendor writes a patch and tests it. If the CVE is a zero-day (already being exploited), this is rushed. If it's responsibly disclosed, the vendor has time to test thoroughly before release.
Security update is published
The vendor releases a security update (Patch Tuesday, iOS update, Android Security Bulletin, etc.). The CVE details are published so users know what was fixed. This is when the clock starts for you to update.
Attackers target unpatched devices
Once patch details are public, attackers reverse-engineer the fix to understand the vulnerability and build exploits. Any device that hasn't been updated is now a target. This is why updating within 72 hours of a patch release is critical.
If actively exploited, CISA adds it to KEV
If the CVE is confirmed as being exploited in the wild, CISA adds it to the Known Exploited Vulnerabilities catalog. This means it's not just theoretical — real attacks are happening. Federal agencies must patch within the deadline, and you should too.
Key takeaway: The most dangerous CVEs are not zero-days — they're n-days that you haven't patched yet. Most real-world attacks exploit vulnerabilities that have had patches available for weeks or months. Checking these trackers and updating promptly is the single most effective security action you can take.
Device-Specific CVE Trackers
Each tracker covers real, verified CVEs for a specific platform — with CVSS scores, patch status, CISA KEV listing, attack vectors, and mitigation steps. Click any tracker to see the full details.
Windows CVE Tracker
Tracks actively exploited Windows zero-days including ShieldBreak, YellowKey, GreatXML, and the Nightmare Eclipse exploit campaign. All with public PoC exploits.
- CVE-2025-29824 — Win32k Privilege Escalation (CISA KEV)
- CVE-2025-32734 — Win32k Use-After-Free (CISA KEV)
- CVE-2025-49646 — SMB NULL Dereference (CISA KEV)
macOS CVE Tracker
Tracks macOS zero-days including the Screen Sharing RCE (CVE-2026-65400, CVSS 9.8), WebKit exploits, and the DarkSword exploit chain affecting macOS Tahoe.
- CVE-2026-65400 — Screen Sharing Auth Bypass (9.8 Critical)
- CVE-2025-43529 — WebKit UAF (DarkSword chain)
- CVE-2025-14174 — ANGLE Metal OOB Write
iPhone CVE Tracker
Tracks iPhone zero-days including the DarkSword 6-CVE exploit chain (270M devices vulnerable), the Coruna exploit kit, and ImageIO zero-click attacks via iMessage.
- CVE-2025-43300 — ImageIO OOB Write (zero-click iMessage)
- CVE-2026-20700 — dyld PAC/TPRO Bypass (DarkSword)
- CVE-2025-43529 — WebKit UAF (Safari RCE)
Android CVE Tracker
Tracks Android CVEs including the Pixel 9 zero-click exploit chain (Google Project Zero), Samsung APE codec RCE, and the patch fragmentation problem affecting millions of devices.
- CVE-2025-54957 — Dolby UDC OOB Write (9.8 Critical)
- CVE-2025-36934 — BigWave Kernel Sandbox Escape
- CVE-2024-49415 — Samsung APE Codec Zero-Click RCE
Live Vulnerability Feed — Updated Hourly
Real-time data pulled from CISA KEV, NVD, and mobile vulnerability sources. Search, filter by severity or device, export to CSV, or share a filtered view. This feed auto-refreshes in the background via WP-Cron.
Severity Distribution
Top Vendors
This product uses data from the NVD API but is not endorsed or certified by the NVD.
CISA KEV data is a U.S. government work in the public domain. Mobile CVE data sourced from cve.tools.
Not Sure If Your Devices Are Patched?
With 17+ actively exploited CVEs across Windows, macOS, iPhone, and Android, checking every device manually is overwhelming. I can audit all your devices, verify patch levels, configure hardening, and set up monitoring so you're alerted when new threats emerge.