Skip to content
BackEsc
Sign in

CWE-843 · weakness in Memory Corruption

Type Confusion

986 CVEs · 42 exploited

Out of date: the sync last ran 3 hours ago. Newer CVEs and scores may be missing from the map.

Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.

exploited in the wild
42
likely to be exploited
37

Every one of the 986 is a mark on the map. Named now: 1 to 26, most at risk first.

  1. Adobe Flash Player before 10.2.154.27 on Windows, Mac OS X, Linux, and Solaris and 10.2.156.12 and earlier on Android; Adobe AIR before 2.6.19140; and Authplay.dll (aka AuthPlayLi…CVE-2011-0611Adobe · CVSS 8.8 · 99% likely

    AdobeAPT12Berserk Bear

  2. Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, and 5.0 Update 33 and earlier allows r…CVE-2012-0507Oracle · CVSS 9.8 · 98% likely

    Oracle

  3. Artifex Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command execution via .rsdparams type confusion with a "/OutputFile (%pipe%" substring in a crafted .eps do…CVE-2017-8291Artifex · CVSS 7.8 · 97% likely

    Artifex

  4. Type confusion in V8 in Google Chrome prior to 90.0.4430.85 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.CVE-2021-21224Google · CVSS 8.8 · 84% likely

    Google

  5. A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerabi…CVE-2019-0752Microsoft · CVSS 7.5 · 82% likely

    Microsoft

  6. Microsoft Internet Explorer 10 and 11 and Microsoft Edge have a type confusion issue in the Layout::MultiColumnBoxBuilder::HandleColumnBreakOnColumnSpanningElement function in msh…CVE-2017-0037Microsoft Corporation · CVSS 8.1 · 80% likely

    Microsoft

  7. The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site,…CVE-2016-7201Microsoft · CVSS 8.8 · 80% likely

    Microsoft

  8. Type confusion in V8 in Google Chrome prior to 80.0.3987.122 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.CVE-2020-6418Google · CVSS 8.8 · 79% likely

    Google

  9. A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability." Thi…CVE-2018-8298Microsoft · CVSS 7.5 · 75% likely

    Microsoft

  10. Type confusion in V8 in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.CVE-2021-30551Google · CVSS 8.8 · 65% likely

    Google

  11. Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.CVE-2020-16009Google · CVSS 8.8 · 48% likely

    Google

  12. Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion. We are aware of targeted attacks in the wild abusing this flaw. Th…CVE-2019-17026Mozilla · CVSS 8.8 · 46% likely

    Mozilla

  13. Scripting Engine Memory Corruption VulnerabilityCVE-2024-38178Microsoft · CVSS 7.5 · 41% likely

    Microsoft

  14. Type Confusion in V8 in Google Chrome prior to 116.0.5845.179 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)CVE-2023-4762Google · CVSS 8.8 · 41% likely

    Google

  15. Type confusion in V8 in Google Chrome prior to 112.0.5615.121 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity…CVE-2023-2033Google · CVSS 8.8 · 41% likely

    Google

  16. A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow for an exploitable crash. We are aware of targeted attacks…CVE-2019-11707Mozilla · CVSS 8.8 · 38% likely

    Mozilla

  17. Type confusion in V8 in Google Chrome prior to 114.0.5735.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity…CVE-2023-3079Google · CVSS 8.8 · 38% likely

    Google

  18. Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, allowed a remote attacker to execute arbitrary code inside a…CVE-2017-5070Google · CVSS 8.8 · 32% likely

    Google

  19. Scripting Engine Memory Corruption VulnerabilityCVE-2025-30397Microsoft · CVSS 7.5 · 27% likely

    Microsoft

  20. Type confusion in V8 in Google Chrome prior to 99.0.4844.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.CVE-2022-1096Google · CVSS 8.8 · 25% likely

    Google

  21. A type confusion issue was addressed with improved checks. This issue is fixed in iOS 16.5.1 and iPadOS 16.5.1, iOS 15.7.7 and iPadOS 15.7.7, macOS Ventura 13.4.1, Safari 16.5.1.…CVE-2023-32439Apple · CVSS 8.8 · 24% likely

    Apple

  22. Type confusion in V8 in Google Chrome prior to 108.0.5359.94 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity:…CVE-2022-4262Google · CVSS 8.8 · 24% likely

    Google

  23. Type confusion in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to exploit heap corruption via a crafted HTML page. (Chromium security severity: High)CVE-2024-7971Google · CVSS 8.8 · 21% likely

    Google

  24. A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, watchOS 5.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Win…CVE-2019-8506Apple · CVSS 8.8 · 16% likely

    Apple

  25. Type Confusion in V8 in Google Chrome prior to 125.0.6422.60 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security sever…CVE-2024-4947Google · CVSS 9.6 · 15% likely

    Google

  26. Type confusion in V8 in Google Chrome prior to 138.0.7204.96 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High)CVE-2025-6554Google · CVSS 8.1 · 14% likely

    Google

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.

CyberSIXTSignal over noise
Updated AboutDevelopersSign in