Skip to content
CVE Tracker

CWE-824

306 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 4 of them as exploited in the wild.

All 306 in the listAtom feed of new CVEsWhat CWE-824 is, at MITRE (opens in a new tab)
Published CVEs
306
Last 12 months
46
Critical
20
Known exploited
4

Critical 20High 183Medium 86Low 16Not scored 1

CVEs per yearBy the year they were published

  1. 20151
  2. 20174
  3. 201820
  4. 20183
  5. 202019
  6. 20209
  7. 202346
  8. 202449
  9. 202445
  10. 202531
  11. 202519
  12. 202642

Known exploitedNewest addition to KEV first

  • CVE-2026-109619

    RCE via stale global state

    PHP Group · PHP

    ExploitedCritical9.2
  • CVE-2026-109618

    RCE via OOM corruption

    PHP Group · PHP

    ExploitedCritical9.2
  • CVE-2022-21971

    Windows Runtime Remote Code Execution Vulnerability

    Microsoft · Windows 10 Version 1809

    ExploitedHigh7.8
  • CVE-2015-1770

    Microsoft Office 2013 SP1 and 2013 RT SP1 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Uninitialized…

    Product not named

    ExploitedHigh8.8

Newest CVEs

  • CVE-2026-115327

    libyang through 6.4.13 Uninitialized Pointer Free in NETCONF RPC Parser

    CESNET · libyang

    Medium6.0
  • CVE-2026-109619

    RCE via stale global state

    PHP Group · PHP

    ExploitedCritical9.2
  • CVE-2026-109618

    RCE via OOM corruption

    PHP Group · PHP

    ExploitedCritical9.2
  • CVE-2026-94018

    NetX Duo Web HTTP server releases an uninitialized packet pointer on the PUT Content-Length underflow path

    Eclipse Foundation · Eclipse ThreadX - NetX Duo

    High8.8
  • CVE-2026-86847

    Dpdk: dpdk: guest can trigger infinite loop in vhost-crypto writeback chain cleanup

    Red Hat · Red Hat Enterprise Linux 10

    Medium6.5
  • CVE-2026-110603

    LASzip through 3.5.0 Invalid Free via Truncated VLR Header in laszip_read_header

    rapidlasso · LASzip

    Medium5.8
  • CVE-2026-110602

    libmspack through 0.11alpha Uninitialized Pointer Free via kwajd_open Error Path

    kyz · libmspack

    Medium5.8
  • CVE-2026-109774

    Invalid pointer, undefined behavior in the DOM: Notifications component

    Mozilla · Firefox

    Critical9.8
  • CVE-2026-49933

    In handle_le_monitor_device_event of msft.cc, there is a possible control-flow hijack in the privileged bluetooth process due to an uninitialized pointer…

    Google · Android

    High7.8
  • CVE-2026-66081

    Apache Thrift: c_glib read_message_begin leaves output parameters unset for non-versioned messages

    Apache Software Foundation · Apache Thrift

    High8.7

Vendors it comes up for most

  1. Adobe47
  2. Siemens15
  3. tensorflow14
  4. Linux13
  5. Mozilla12
  6. Qualcomm, Inc.7
  7. Foxit6
  8. Horner Automation6
  9. Ansys5
  10. Juniper Networks5