Skip to content
CVE Tracker

CWE-908

1,010 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 4 of them as exploited in the wild.

All 1,010 in the listAtom feed of new CVEsWhat CWE-908 is, at MITRE (opens in a new tab)
Published CVEs
1,010
Last 12 months
315
Critical
74
Known exploited
4

Critical 74High 316Medium 555Low 56Not scored 9

CVEs per yearBy the year they were published

  1. 20153
  2. 20162
  3. 201836
  4. 201975
  5. 202264
  6. 202488
  7. 20245
  8. 2025159
  9. 202565
  10. 202575
  11. 2026302
  12. 2026106

Known exploitedNewest addition to KEV first

  • CVE-2026-85880

    Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability

    Microsoft · Windows 10 Version 1607

    ExploitedHigh7.8
  • CVE-2025-5777

    NetScaler ADC and NetScaler Gateway - Insufficient input validation leading to memory overread

    NetScaler · ADC

    ExploitedCritical9.3
  • CVE-2024-50302

    HID: core: zero-initialize the report buffer

    Linux · Linux

    ExploitedMedium5.5
  • CVE-2024-29745

    there is a possible Information Disclosure due to uninitialized data. This could lead to local information disclosure with no additional execution privileges…

    Google · Android

    ExploitedMedium5.5

Newest CVEs

  • CVE-2026-121176

    Uninitialized resource in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page.…

    Google · Chrome

    Not scored
  • CVE-2026-121033

    Uninitialized resource in GPU in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to read…

    Google · Chrome

    Not scored
  • CVE-2026-121072

    Uninitialized resource in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium…

    Google · Chrome

    Not scored
  • CVE-2026-121227

    Uninitialized resource in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to read memory…

    Google · Chrome

    Not scored
  • CVE-2026-121213

    Uninitialized resource in Images in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page.…

    Google · Chrome

    Not scored
  • CVE-2026-121143

    Uninitialized resource in GPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to read memory outside…

    Google · Chrome

    Not scored
  • CVE-2026-121207

    Uninitialized resource in Dawn in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker to read memory outside the sandbox via a crafted…

    Google · Chrome

    Not scored
  • CVE-2026-121095

    Uninitialized resource in WebGL in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page.…

    Google · Chrome

    Not scored
  • CVE-2026-121173

    Uninitialized resource in WebGL in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page.…

    Google · Chrome

    Not scored
  • CVE-2026-120684

    MongoDB C Driver GridFS gap lets a shared writer recover a protected client's password

    MongoDB · C Driver

    Medium6.0

Vendors it comes up for most

  1. Linux281
  2. Microsoft138
  3. Google119
  4. Mozilla23
  5. Red Hat11
  6. Qualcomm, Inc.9
  7. tensorflow9
  8. FFmpeg8
  9. MediaTek, Inc.8
  10. Autodesk7