Skip to content
BackEsc
Sign in

CWE-457 · weakness in Memory Corruption

Use of Uninitialized Variable

284 CVEs

Out of date: the sync last ran 3 hours ago. Newer CVEs and scores may be missing from the map.

Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.

likely to be exploited
2

Every one of the 284 is a mark on the map. Named now: 1 to 26, most at risk first.

  1. The Active Template Library (ATL) in Microsoft Visual Studio .NET 2003 SP1, Visual Studio 2005 SP1 and 2008 Gold, and Visual C++ 2005 SP1 and 2008 Gold and SP1; and Windows 2000 S…CVE-2009-0901CVSS 8.8 · 37% likely
  2. When parsing a file that is submitted to the DPDecoder service as a job, the R3D SDK will mistakenly skip over the assignment of a property containing an object referring to a UUI…CVE-2021-40418Blackmagic Design · CVSS 9.8 · 18% likely
  3. Uninitialized read in gdImageCreateFromXbmCVE-2019-11038PHP Group · CVSS 3.1 · 4.3% likely

    PHP

  4. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.931. User interaction is required to exploit this vulner…CVE-2021-31435Foxit · CVSS 7.8 · 2.8% likely

    Foxit

  5. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley View 10.16.0.80. User interaction is required to exploit this vul…CVE-2021-46570Bentley · CVSS 7.8 · 2.1% likely

    Bentley

  6. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.0.80. User interaction is required to exploit…CVE-2021-46566Bentley · CVSS 7.8 · 2.0% likely

    Bentley

  7. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction is required to exploit this vulnerabili…CVE-2021-46631Bentley · CVSS 7.8 · 2.0% likely

    Bentley

  8. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.0.80. User interaction is required to exploit…CVE-2021-46617Bentley · CVSS 7.8 · 2.0% likely

    Bentley

  9. The key_certify function in usr.bin/ssh/key.c in OpenSSH 5.6 and 5.7, when generating legacy certificates using the -t command-line option in ssh-keygen, does not initialize the n…CVE-2011-0539CVSS 7.5 · 1.8% likely
  10. An uninitialized pointer use vulnerability exists in the functionality of WPS Office 11.2.0.11537 that handles Data elements in an Excel file. A specially crafted malformed file c…CVE-2023-31275WPS · CVSS 8.8 · 1.7% likely
  11. WavPack 5.1.0 and earlier is affected by: CWE-457: Use of Uninitialized Variable. The impact is: Unexpected control flow, crashes, and segfaults. The component is: ParseWave64Head…CVE-2019-1010319WavPack · 1.5% likely
  12. WavPack 5.1.0 and earlier is affected by: CWE-457: Use of Uninitialized Variable. The impact is: Unexpected control flow, crashes, and segfaults. The component is: ParseCaffHeader…CVE-2019-1010317WavPack · 1.5% likely
  13. An information disclosure vulnerability exists in the HTTP Server /ping.html functionality of Texas Instruments CC3200 SimpleLink Solution NWP 2.9.0.0. A specially-crafted HTTP re…CVE-2021-21966Texas Instruments · CVSS 5.3 · 1.4% likely
  14. An out-of-bounds write vulnerability exists in the device TestEmail functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted network request can lead to an out-o…CVE-2022-21217CVSS 9.1 · 1.2% likely
  15. Versions of the package fastecdsa before 2.3.2 are vulnerable to Use of Uninitialized Variable on the stack, via the curvemath_mul function in src/curveMath.c, due to being used a…CVE-2024-21502Antonkueltz · CVSS 7.5 · 1.0% likely
  16. GHSL-2024-197: GStreamer uses uninitialized stack memory in Matroska/WebM demuxerCVE-2024-47540gstreamer · CVSS 8.6 · 1.0% likely

    GStreamer

  17. Uninitialized Use in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)CVE-2026-10973Google · CVSS 7.4 · 1.0% likely

    Google

  18. Multiple Vulnerabilities in the Autodesk AutoCAD Desktop SoftwareCVE-2024-23137Autodesk · CVSS 7.8 · 1.0% likely

    Autodesk

  19. An information disclosure vulnerability exists in the ClientConnect() functionality of SoftEther VPN 5.01.9674. A specially crafted network packet can lead to a disclosure of sens…CVE-2023-31192SoftEther VPN · CVSS 5.3 · 1.0% likely

    SoftEther VPN

  20. HDF5 Library through 1.14.3 may use an uninitialized value in H5A__attr_release_table in H5Aint.c.CVE-2024-32611Hdfgroup · CVSS 9.8 · 1.0% likely

    HDFGroup

  21. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.16.02.022. User interaction is required to exploit this vulnerabi…CVE-2022-28320Bentley · CVSS 7.8 · 0.9% likely

    Bentley

  22. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.02.034. User interaction is required to exploi…CVE-2022-28319Bentley · CVSS 7.8 · 0.9% likely

    Bentley

  23. Helm's Missing YAML Content Leads To PanicCVE-2024-26147helm · CVSS 7.5 · 0.9% likely

    The Helm Project

  24. Uninitialized Use in Dawn in Google Chrome on Android prior to 127.0.6533.88 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page.…CVE-2024-6990Google · CVSS 8.8 · 0.9% likely

    Google

  25. Cisco Adaptive Security Appliance Software SSL/TLS Denial of Service VulnerabilityCVE-2020-27124Cisco · CVSS 8.6 · 0.9% likely

    Cisco

  26. A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5). The Tiff_Loader.dll is vulnerable to use of uninitial…CVE-2021-44003Siemens · 0.8% likely

    Siemens

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.

CyberSIXTSignal over noise
Updated AboutDevelopersSign in