Skip to content
CVE Ledger
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API documentationPage
  • MCP serverPage
  • Data sourcesPage
  • ChangelogPage
  • AboutPage
  • How it's builtPage

CWE-908

1,014 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 4 of them as exploited in the wild.

All 1,014 in the listAtom feed of new CVEsWhat CWE-908 is, at MITRE (opens in a new tab)
Published CVEs
1,014
Last 12 months
319
Critical
74
Known exploited
4

Critical 74High 317Medium 559Low 58Not scored 6

CVEs per yearBy the year they were published

  1. 20153
  2. 20162
  3. 20174
  4. 201821
  5. 201975
  6. 202056
  7. 202172
  8. 202247
  9. 202344
  10. 2024186
  11. 2025160
  12. 2026314

Known exploitedNewest addition to KEV first

  • CVE-2026-85880

    Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability

    Microsoft · Windows 10 Version 1607

    ExploitedHigh7.8
  • CVE-2025-5777

    NetScaler ADC and NetScaler Gateway - Insufficient input validation leading to memory overread

    NetScaler · ADC

    ExploitedCritical9.3
  • CVE-2024-50302

    HID: core: zero-initialize the report buffer

    Linux · Linux

    ExploitedMedium5.5
  • CVE-2024-29745

    there is a possible Information Disclosure due to uninitialized data. This could lead to local information disclosure with no additional execution privileges…

    Google · Android

    ExploitedMedium5.5

Newest CVEs

  • CVE-2026-102664

    ProxySQL: Uninitialized heap read in MySQL compressed packet decompression via zlib path

    sysown · proxysql

    High7.1
  • CVE-2026-121176

    Uninitialized resource in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page.…

    Google · Chrome

    Medium6.5
  • CVE-2026-121033

    Uninitialized resource in GPU in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to read…

    Google · Chrome

    Not scored
  • CVE-2026-121072

    Uninitialized resource in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium…

    Google · Chrome

    Medium6.5
  • CVE-2026-121227

    Uninitialized resource in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to read memory…

    Google · Chrome

    Not scored
  • CVE-2026-121213

    Uninitialized resource in Images in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page.…

    Google · Chrome

    Medium6.5
  • CVE-2026-121143

    Uninitialized resource in GPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to read memory outside…

    Google · Chrome

    Not scored
  • CVE-2026-121207

    Uninitialized resource in Dawn in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker to read memory outside the sandbox via a crafted…

    Google · Chrome

    Not scored
  • CVE-2026-121095

    Uninitialized resource in WebGL in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page.…

    Google · Chrome

    Not scored
  • CVE-2026-121173

    Uninitialized resource in WebGL in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page.…

    Google · Chrome

    Not scored

Vendors it comes up for most

  1. Linux281
  2. Microsoft138
  3. Google119
  4. Mozilla24
  5. Red Hat11
  6. Qualcomm, Inc.9
  7. tensorflow9
  8. FFmpeg8
  9. MediaTek, Inc.8
  10. Autodesk7