Skip to content
BackEsc
Sign in

CWE-787 · weakness in Memory Corruption

Out-of-bounds Write

11,340 CVEs · 129 exploited

Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.

exploited in the wild
129
check available
2
likely to be exploited
559

Every one of the 11,340 is a mark on the map. Named now: 1 to 26, most at risk first.

  1. Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML pa…CVE-2023-4863Google · CVSS 8.8 · 100% likely

    Google

  2. Stack-based buffer overflow in Adobe Acrobat and Reader 8.1.2 and earlier allows remote attackers to execute arbitrary code via a PDF file that calls the util.printf JavaScript fu…CVE-2008-2992Adobe · CVSS 7.8 · 100% likely

    Adobe

  3. VMware vCenter Server - Out-of-Bounds WriteCVE-2023-34048VMware · CVSS 9.8 · 99% likely

    VMwareUNC3886

  4. VMware ESXi SLP - Heap Overflow DoSCVE-2019-5544VMware · CVSS 9.8 · 98% likely

    VMware

  5. Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word for Mac 2011, Office Compatibility Pack SP3, Word Automation Services on SharePoint…CVE-2015-1641Microsoft · CVSS 7.8 · 97% likely

    MicrosoftAPT41Confucius

  6. Equation Editor in Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allows a remote code execution vulnerability due to the way objec…CVE-2018-0798Microsoft Corporation · CVSS 8.8 · 95% likely

    MicrosoftBitterBRONZE BUTLER

  7. A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as pr…CVE-2021-4034Red Hat · CVSS 7.8 · 95% likelycovered by CyberSIXT

    Red HatCL-UNK-12111 article

  8. The Microsoft (1) JScript 5.8 and (2) VBScript 5.7 and 5.8 engines, as used in Internet Explorer 9 through 11 and other products, allow remote attackers to execute arbitrary code…CVE-2016-0189Microsoft · CVSS 7.5 · 94% likely

    Microsoft

  9. Equation Editor in Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allow a remote code execution vulnerability due to the way object…CVE-2018-0802Microsoft Corporation · CVSS 7.8 · 93% likelycovered by CyberSIXT

    MicrosoftBitterBRONZE BUTLER

  10. WatchGuard Firebox iked Out of Bounds Write VulnerabilityCVE-2025-9242WatchGuard · CVSS 9.3 · 92% likely

    WatchGuard

  11. Adobe Flash Player before 10.3.183.15 and 11.x before 11.1.102.62 on Windows, Mac OS X, Linux, and Solaris; before 11.1.111.6 on Android 2.x and 3.x; and before 11.1.115.6 on Andr…CVE-2012-0754Adobe · CVSS 7.8 · 91% likely

    Adobe

  12. SolarWinds Serv-U FTP - Remote Code ExecutionCVE-2021-35211SolarWinds · CVSS 9 · 91% likely

    SolarWinds

  13. Stack-based buffer overflow in Microsoft Office XP SP3, Office 2003 SP3, Office 2007 SP2, Office 2010, Office 2004 and 2008 for Mac, Office for Mac 2011, and Open XML File Format…CVE-2010-3333Microsoft · CVSS 7.8 · 89% likely

    MicrosoftAoqin DragonAPT36

  14. Unspecified vulnerability in the U3D component in Adobe Reader and Acrobat 10.1.1 and earlier on Windows and Mac OS X, and Adobe Reader 9.x through 9.4.6 on UNIX, allows remote at…CVE-2011-2462Adobe · CVSS 8.8 · 89% likely

    Adobe

  15. A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows VBScript Engine Remote Code Execution Vulnerability." This…CVE-2018-8174Microsoft · CVSS 7.5 · 88% likely

    MicrosoftCobalt GroupTonto Team

  16. Adobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6, and 11.x before 11.0.02 allow remote attackers to execute arbitrary code or cause a denial of service (memory corrup…CVE-2013-0640Adobe · CVSS 7.8 · 87% likely

    Adobe

  17. Tenda Router AC11 - Remote Command InjectionCVE-2021-31755Tenda · CVSS 9.8 · 87% likely

    Tenda

  18. A out-of-bounds write vulnerability in Fortinet FortiOS 7.4.0 through 7.4.2, FortiOS 7.2.0 through 7.2.6, FortiOS 7.0.0 through 7.0.13, FortiOS 6.4.0 through 6.4.14, FortiOS 6.2.0…CVE-2024-21762Fortinet · CVSS 9.6 · 85% likelycovered by CyberSIXT

    Fortinet1 article

  19. Microsoft Office Excel 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Office Excel Viewer 2003 SP3; Office Excel V…CVE-2009-3129Microsoft · CVSS 7.8 · 84% likely

    MicrosoftAPT12

  20. Microsoft XML Core Services 3.0, 4.0, 5.0, and 6.0 accesses uninitialized memory locations, which allows remote attackers to execute arbitrary code or cause a denial of service (m…CVE-2012-1889Microsoft · CVSS 8.8 · 84% likely

    MicrosoftAxiom

  21. The U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, 8.x before 8.2 on Windows and Mac OS X, and 7.x before 7.1.4 allows remote attackers to execute arbitrary code v…CVE-2009-3953Adobe · CVSS 8.8 · 83% likely

    Adobe

  22. The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site,…CVE-2016-7200Microsoft · CVSS 8.8 · 83% likely

    Microsoft

  23. Out-of-Bounds Write in Google Brotli DecoderCVE-2026-111497Google · CVSS 9.2 · 83% likelycovered by CyberSIXT

    Google26 articles2 articles this week: FBI attributes $6.3 billion Binance theft to North Korea

  24. Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64; Adobe AIR before 2.0.2.12610; and Adobe Reader and Acrobat 9.x before 9.3.3, and 8.x before 8.2.3 on Windows and Ma…CVE-2010-1297Adobe · CVSS 7.8 · 83% likely

    Adobe

  25. Stack-based buffer overflow in CoolType.dll in Adobe Reader and Acrobat 9.x before 9.4, and 8.x before 8.2.5 on Windows and Mac OS X, allows remote attackers to execute arbitrary…CVE-2010-2883Adobe · CVSS 7.3 · 81% likely

    Adobe

  26. Vulnerability in the Oracle Solaris product of Oracle Systems (component: Pluggable authentication module). Supported versions that are affected are 10 and 11. Easily exploitable…CVE-2020-14871Oracle Corporation · CVSS 10 · 80% likely

    Oracle

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.

CyberSIXTSignal over noise
Updated AboutDevelopersSign in