CWE-125 · weakness in Memory Corruption
Out-of-bounds Read
10,109 CVEs · 18 exploited
Out of date: the sync last ran 3 hours ago. Newer CVEs and scores may be missing from the map.
Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.
- exploited in the wild
- 18
- check available
- 5
- likely to be exploited
- 184
Every one of the 10,109 is a mark on the map. Named now: 1 to 26, most at risk first.
- The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive infor…
- Citrix NetScaler Memory Disclosure - CitrixBleed 2
- Citrix NetScaler SAML IDP - Memory Overread
- The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, does not properly consider element data types, which allows r…
- Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.2987.108 for Android allowed a remote attacker to execute a…
- The WAP interface in Trihedral VTScada (formerly VTS) 8.x through 11.x before 11.2.02 allows remote attackers to cause a denial of service (out-of-bounds read and application cras…
- The Treck TCP/IP stack before 6.0.1.66 has an IPv6 Out-of-bounds Read.
- An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 17.1.2 and iPadOS 17.1.2, macOS Sonoma 14.1.2, Safari 17.1.2. Processing web content…
- An out-of-bounds read was addressed with improved input validation. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, iOS 15.7.6 and iPadOS 15.7.6, Safari 16.5, i…
- Windows Common Log File System Driver Elevation of Privilege Vulnerability
- Out of bounds read and write in V8 in Google Chrome prior to 137.0.7151.68 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium secu…
- Out of bounds memory access in V8 in Google Chrome prior to 120.0.6099.224 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium secu…
- Out of bounds read and write in V8 in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium…
Google7 articles2 articles this week: Google patches Chrome zero day exploited in the wild
- Windows NTFS Information Disclosure Vulnerability
- VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability due to an out-of-bounds read in HGFS. A malicious actor with administrative privileges to a vi…
- ALSA: usb-audio: Fix out of bounds reads when finding clock sources
- An out-of-bounds read issue existed that led to the disclosure of kernel memory. This was addressed with improved input validation. This issue is fixed in macOS Monterey 12.3.1, S…
- Lack of boundary checking of a buffer in set_skb_priv() of modem interface driver prior to SMR Oct-2021 Release 1 allows OOB read and it results in arbitrary code execution by der…
- NTPsec > 1.1.3 - 'ctl_getitem' Out-of-Bounds Read
- Pure-FTPd 1.0.24 - Security Vulnerability
- Ollama < 0.17.1 - Information Disclosure
- ProFTPD < 1.3.8a - DoS via Out-of-Bounds Read
- Pure-FTPd < 1.0.52 - Buffer Overflow
- OpenSMTPD before 6.6.4 allows remote code execution because of an out-of-bounds read in mta_io in mta_session.c for multi-line replies. Although this vulnerability affects the cli…
- Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability
- Windows Lightweight Directory Access Protocol (LDAP) Denial of Service Vulnerability
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.