Skip to content
BackEsc
Connect AISign inSign up free

CWE-665 · weakness in Memory Corruption

Improper Initialization

336 CVEs · 3 exploited

Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.

Connect AI

exploited in the wild
3
check available
2
likely to be exploited
9

Every one of the 336 is a mark on the map. Named now: 1 to 26, most at risk first.

  1. A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe and push_pipe functions in the Linux ke…CVE-2022-0847Linux · CVSS 7.8 · 93% likelycovered by CyberSIXT

    LinuxSea Turtle

  2. A memory initialization issue was addressed. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.1, iOS 12.4.9, watchOS 6.2.9, Security Update 2020-006 High Sierra, Security Up…CVE-2020-27950Apple · CVSS 5.5 · 17% likely

    Apple

  3. Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 do not properly initialize data structures for the n…CVE-2013-1675Mozilla · CVSS 6.5 · 6.7% likely

    Mozilla

  4. Bitrix Component - Cross-Site ScriptingCVE-2023-1719Bitrix24 · CVSS 7.5 · 6.3% likely

    Bitrix24

  5. Huawei Firewall - Local File InclusionCVE-2019-19411Huawei · 1.2% likely

    Huawei

  6. mod_lua Use of uninitialized value of in r:parsebodyCVE-2022-22719Apache Software Foundation · 70% likely

    Apache1 bounty report

  7. Exim 4 before 4.94.2 has Improper Initialization that can lead to recursion-based stack consumption or other consequences. This occurs because use of certain getc functions is mis…CVE-2020-28019Exim · 62% likely

    Exim

  8. Account takeover via prototype vulnerabilityCVE-2022-46164NodeBB · CVSS 9.4 · 47% likely

    NodeBB

  9. In D-Link DIR-816 A2_v1.10CNB04.img the network can be initialized without authentication via /goform/wizard_end.CVE-2022-37128Dlink · 22% likely

    D-Link

  10. In Docker 19.03.x before 19.03.1 linked against the GNU C Library (aka glibc), code injection can occur when the nsswitch facility dynamically loads a library inside a chroot that…CVE-2019-14271Docker · 19% likely

    Docker

  11. Microsoft Internet Explorer 9 does not properly handle the creation and initialization of string objects, which allows remote attackers to read data from arbitrary process-memory…CVE-2012-0012Microsoft · 16% likely

    Microsoft

  12. Microsoft Office 2010 SP2, Microsoft Office 2013 SP1 and RT SP1, Microsoft Office 2016, and Microsoft Office 2016 Click-to-Run (C2R) allow an information disclosure vulnerability,…CVE-2018-0853Microsoft Corporation · 12% likely

    Microsoft

  13. Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by cons…CVE-2018-14647The Python Project · CVSS 5.3 · 11% likely

    Python1 bounty report

  14. KDC in MIT Kerberos 5 (krb5kdc) does not set a global variable for some krb4 message types, which allows remote attackers to cause a denial of service (crash) and possibly execute…CVE-2008-0062Mit · 10% likely

    Mit

  15. The __skb_flow_dissect function in net/core/flow_dissector.c in the Linux kernel before 4.3 does not ensure that n_proto, ip_proto, and thoff are initialized, which allows remote…CVE-2017-13715Linux · 9.7% likely

    Linux

  16. prefs.php in phpBB 1.4.0 and earlier allows remote authenticated users to execute arbitrary PHP code via an invalid language value, which prevents the variables (1) $l_statsblock…CVE-2001-1471Phpbb · 7.7% likely

    Phpbb Group

  17. Modifications to ACLs (Access Control Lists) in Microsoft Exchange 5.5 do not take effect until the directory store cache is refreshed.CVE-1999-0993Microsoft · 7.1% likely

    Microsoft

  18. An information disclosure vulnerability exists when Microsoft Edge based on Edge HTML improperly handles objects in memory, aka 'Microsoft Edge based on Edge HTML Information Disc…CVE-2019-1299Microsoft · 5.8% likely

    Microsoft

  19. The Hash-based Message Authentication Code (HMAC) provider in Java on Apple Mac OS X 10.4.11, 10.5.4, and 10.5.5 uses an uninitialized variable, which allows remote attackers to e…CVE-2008-3637Apple · 5.7% likely

    Apple

  20. The phase_one_correct function in Libraw before 0.17.1 allows attackers to cause memory errors and possibly execute arbitrary code, related to memory object initialization.CVE-2015-8367Libraw · 5.6% likely

    Libraw

  21. A vulnerability was found in libpq, the default PostgreSQL client library where libpq failed to properly reset its internal state between connections. If an affected version of li…CVE-2018-10915PostgreSQL Global Development Group · CVSS 8.5 · 5.1% likely

    PostgreSQL Global Development Group

  22. HHVM does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP…CVE-2016-1000109Facebook · 5.1% likely

    Meta (Facebook)

  23. Insufficient sanitization of environment variables passed to rsync can bypass the restrictions imposed by rssh, a restricted shell that should restrict users to perform only rsync…CVE-2019-3464Debian GNU/Linux · 4.7% likely
  24. Samba 3.6.6 through 3.6.23, 4.0.x before 4.0.18, and 4.1.x before 4.1.8, when a certain vfs shadow copy configuration is enabled, does not properly initialize the SRV_SNAPSHOT_ARR…CVE-2014-0178Samba · 4.5% likely

    Samba

  25. SQLite through 3.31.1 allows attackers to cause a denial of service (segmentation fault) via a malformed window-function query because the AggInfo object's initialization is misha…CVE-2020-11655Sqlite · 4.3% likely

    Sqlite

  26. The Windows kernel in Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703 and 1709, Windows Server 2016 and Windows Server, version 1709 allows a…CVE-2018-0746Microsoft Corporation · 4.1% likely

    Microsoft

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.

CyberSIXTSignal over noise
Sign inSign up free

Updated