Skip to content
BackEsc
Sign in

CWE-909 · weakness in Memory Corruption

Missing Initialization of Resource

81 CVEs

Out of date: the sync last ran 3 hours ago. Newer CVEs and scores may be missing from the map.

Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.

Every one of the 81 is a mark on the map. Named now: 1 to 26, most at risk first.

  1. strongSwan 5.6.0 and older allows Remote Denial of Service because of Missing Initialization of a Variable.CVE-2018-108116.2% likely
  2. Improper access control in BlueZ may allow an unauthenticated user to potentially enable information disclosure via adjacent access.CVE-2020-12352BlueZ · 5.8% likely
  3. It was found that cockpit before version 184 used glib's base64 decode functionality incorrectly resulting in a denial of service attack. An unauthenticated attacker could send a…CVE-2019-3804cockpit · CVSS 7.5 · 4.9% likely
  4. While investigating UBSAN errors in https://github.com/apache/arrow/pull/5365 it was discovered Apache Arrow versions 0.12.0 to 0.14.1, left memory Array data uninitialized when r…CVE-2019-12410Apache Software Foundation · 4.6% likely

    Apache

  5. In Wireshark 3.0.0 to 3.0.6 and 2.6.0 to 2.6.12, the CMS dissector could crash. This was addressed in epan/dissectors/asn1/cms/packet-cms-template.c by ensuring that an object ide…CVE-2019-195534.1% likely
  6. It was discovered that the C++ implementation (which underlies the R, Python and Ruby implementations) of Apache Arrow 0.14.0 to 0.14.1 had a uninitialized memory bug when buildin…CVE-2019-12408Apache Software Foundation · 3.2% likely

    Apache

  7. In the Linux kernel before 5.2.14, rds6_inc_info_copy in net/rds/recv.c allows attackers to obtain sensitive information from kernel stack memory because tos and flags fields are…CVE-2019-167142.7% likely
  8. report_vbuild in report.c in Fetchmail before 6.4.20 sometimes omits initialization of the vsnprintf va_list argument, which might allow mail servers to cause a denial of service…CVE-2021-363862.6% likely
  9. An issue was discovered in LibVNCServer before 0.9.13. There is an information leak (of uninitialized memory contents) in the libvncclient/rfbproto.c ConnectToRFBRepeater function.CVE-2018-212472.4% likely
  10. An issue was discovered in function sofia_handle_sip_i_notify in sofia.c in SignalWire freeswitch before 1.10.6, may allow attackers to view sensitive information due to an uninit…CVE-2021-365131.9% likely
  11. im_vips2dz in /libvips/libvips/deprecated/im_vips2dz.c in libvips before 8.8.2 has an uninitialized variable which may cause the leakage of remote server path or stack address.CVE-2020-207391.8% likely
  12. A WebGL framebuffer was not initialized early enough, resulting in memory corruption and an out of bound write. This vulnerability affects Firefox ESR < 78.10, Thunderbird < 78.10…CVE-2021-23994Mozilla · 1.8% likely

    Mozilla

  13. Remote Memory ExposureCVE-2021-23386dns-packet · CVSS 7.7 · 1.4% likely
  14. Uninitialized memory in a canvas object could have caused an incorrect free() leading to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderb…CVE-2021-29980Mozilla · 1.4% likely

    Mozilla

  15. An information disclosure vulnerability exists when the Windows kernel fails to properly initialize a memory address, aka 'Windows Kernel Information Disclosure Vulnerability'. Th…CVE-2020-1419Microsoft · 1.4% likely

    Microsoft

  16. The zabbix-agent2 package before 5.4.9-r1 for Alpine Linux sometimes allows privilege escalation to root because the design incorrectly expected that systemd would (in effect) det…CVE-2022-227041.4% likely
  17. In Eclipse Openj9 to version 0.25.0, usage of the jdk.internal.reflect.ConstantPool API causes the JVM in some cases to pre-resolve certain constant pool entries. This allows a us…CVE-2021-28167The Eclipse Foundation · 1.1% likely

    Eclipse Foundation

  18. In FreeBSD 12.2-STABLE before r368969, 11.4-STABLE before r369047, 12.2-RELEASE before p3, 12.1-RELEASE before p13 and 11.4-RELEASE before p7 msdosfs(5) was failing to zero-fill a…CVE-2020-25579FreeBSD · 1.1% likely
  19. An issue was discovered in the rkyv crate before 0.6.0 for Rust. When an archive is created via serialization, the archive content may contain uninitialized values of certain part…CVE-2021-319191.1% likely
  20. An issue was discovered in the Linux kernel through 5.17.5. io_rw_init_file in fs/io_uring.c lacks initialization of kiocb->private.CVE-2022-299681.1% likely
  21. An issue was discovered in the pnet crate before 0.27.2 for Rust. There is a segmentation fault (upon attempted dereference of an uninitialized descriptor) because of an erroneous…CVE-2019-250541.0% likely
  22. Phoenix Contact mGuard Devices versions before 8.8.3: LAN ports get functional after reboot even if they are disabled in the device configurationCVE-2020-12523Phoenix Contact · CVSS 5.4 · 0.9% likely

    Phoenix Contact

  23. In libavc, there is a missing variable initialization. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed…CVE-2019-9321Android · 0.7% likely
  24. In libavc, there is a missing variable initialization. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed…CVE-2019-9320Android · 0.7% likely
  25. In libavc, there is a missing variable initialization. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed…CVE-2019-9319Android · 0.7% likely
  26. In libhevc, there is a missing variable initialization. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed…CVE-2019-9318Android · 0.7% likely

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.

CyberSIXTSignal over noise
Updated AboutDevelopersSign in