CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (2026-10-19 05:50 UTC)

What this means for you

This week: 5,436 CVEs published, 357 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 5,436; Show in the list
Critical, last 7 days: 357; Show in the list
Healthcare-tagged, last 7 days: 4; Show in the list
Known exploited (CISA KEV): 1,747; Show in the list

Showing CVEs that name the product microsoft:internet_explorer. Show all products

46 CVEs, showing 1 to 46

CVE	Severity	Title	Published
CVE-2021-27085 Known exploited	High 8.8	Internet Explorer Remote Code Execution Vulnerability Assigned by microsoft	Mar 11, 2021
CVE-2021-26411 Known exploited	High 8.8	Internet Explorer Memory Corruption Vulnerability Assigned by microsoft	Mar 11, 2021
CVE-2020-0878 Known exploited	Medium 4.2	Microsoft Browser Memory Corruption Vulnerability Assigned by microsoft	Sep 11, 2020
CVE-2020-1380 Known exploited	High 7.8	Scripting Engine Memory Corruption Vulnerability Assigned by microsoft	Aug 17, 2020
CVE-2020-0968 Known exploited	High 7.5	A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'. Assigned by microsoft	Apr 15, 2020
CVE-2020-0674 Known exploited	High 7.5	A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'. Assigned by microsoft	Feb 11, 2020
CVE-2019-1429 Known exploited	High 7.5	A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'. Assigned by microsoft	Nov 12, 2019
CVE-2019-1367 Known exploited	High 7.5	A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'. Assigned by microsoft	Sep 23, 2019
CVE-2019-0752 Known exploited	High 7.5	A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'. Assigned by microsoft	Apr 9, 2019
CVE-2019-0676 Known exploited	Medium 6.5	An information disclosure vulnerability exists when Internet Explorer improperly handles objects in memory.An attacker who successfully exploited this vulnerability could test for the presence of fil… Assigned by microsoft	Mar 6, 2019
CVE-2019-0541 Known exploited	High 8.8	A remote code execution vulnerability exists in the way that the MSHTML engine inproperly validates input, aka "MSHTML Engine Remote Code Execution Vulnerability." This affects Microsoft Office, Micr… Assigned by microsoft	Jan 8, 2019
CVE-2018-8653 Known exploited	High 7.5	A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scripting Engine Memory Corruption Vulnerability." This affects… Assigned by microsoft	Dec 20, 2018
CVE-2018-8373 Known exploited	High 7.5	A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scripting Engine Memory Corruption Vulnerability." This affects… Assigned by microsoft	Aug 15, 2018
CVE-2017-8529	Medium 6.5	Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, and Windows Server 2012 and R2 allow an attacker to detect specific files on the user's compu… Assigned by microsoft	Jun 15, 2017
CVE-2017-0222 Known exploited	High 8.8	A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory Corruption Vulnerability." This CVE ID is unique from CVE-2017… Assigned by microsoft	May 12, 2017
CVE-2017-0210 Known exploited	High 8.8	An elevation of privilege vulnerability exists when Internet Explorer does not properly enforce cross-domain policies, which could allow an attacker to access information from one domain and inject i… Assigned by microsoft	Apr 12, 2017
CVE-2017-0149 Known exploited	High 8.8	Microsoft Internet Explorer 9 through 11 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corrup… Assigned by microsoft	Mar 17, 2017
CVE-2017-0059 Known exploited	Medium 4.3	Microsoft Internet Explorer 9 through 11 allow remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Internet Explorer Information Disclosure Vulnerability… Assigned by microsoft	Mar 17, 2017
CVE-2017-0037 Known exploited	High 8.1	Microsoft Internet Explorer 10 and 11 and Microsoft Edge have a type confusion issue in the Layout::MultiColumnBoxBuilder::HandleColumnBreakOnColumnSpanningElement function in mshtml.dll, which allow… Assigned by microsoft	Feb 26, 2017
CVE-2016-3298 Known exploited	Medium 6.5	Microsoft Internet Explorer 9 through 11 and the Internet Messaging API in Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allow remote attackers to determine the existence o… Assigned by microsoft	Oct 14, 2016
CVE-2016-3351 Known exploited	Medium 6.5	Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to obtain sensitive information via a crafted web site, aka "Microsoft Browser Information Disclosure Vulnerability." Assigned by microsoft	Sep 14, 2016
CVE-2016-0189 Known exploited	High 7.5	The Microsoft (1) JScript 5.8 and (2) VBScript 5.7 and 5.8 engines, as used in Internet Explorer 9 through 11 and other products, allow remote attackers to execute arbitrary code or cause a denial of… Assigned by microsoft	May 11, 2016
CVE-2016-0162 Known exploited	Medium 4.3	Microsoft Internet Explorer 9 through 11 allows remote attackers to determine the existence of files via crafted JavaScript code, aka "Internet Explorer Information Disclosure Vulnerability." Assigned by microsoft	Apr 12, 2016
CVE-2015-2502 Known exploited	High 8.8	Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerabilit… Assigned by microsoft	Aug 19, 2015
CVE-2015-2423	Medium 4.3	Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, Windows 10, Excel 2007 SP3, PowerPoin… Assigned by microsoft	Aug 15, 2015
CVE-2015-2425 Known exploited	High 8.8	Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vuln… Assigned by microsoft	Jul 14, 2015
CVE-2015-2419 Known exploited	High 8.8	JScript 9 in Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "JScript9 Memory Corr… Assigned by microsoft	Jul 14, 2015
CVE-2015-0071 Known exploited	Medium 6.5	Microsoft Internet Explorer 9 through 11 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Internet Explorer ASLR Bypass Vulnerability." Assigned by microsoft	Feb 11, 2015
CVE-2015-0313 Known exploited	High 7.8	Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows remote attackers to execute ar… Assigned by adobe	Feb 2, 2015
CVE-2015-0311 Known exploited	High 7.8	Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Windows and OS X and through 11.2.202.438 on Linux allows remote attackers to execute… Assigned by adobe	Jan 23, 2015
CVE-2014-4123 Known exploited	High 8.8	Microsoft Internet Explorer 7 through 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation of Privilege Vulnerability," as exploited in the wild in O… Assigned by microsoft	Oct 15, 2014
CVE-2014-2817 Known exploited	High 8.8	Microsoft Internet Explorer 6 through 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation of Privilege Vulnerability." Assigned by microsoft	Aug 12, 2014
CVE-2014-1776 Known exploited	Critical 9.8	Use-after-free vulnerability in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via vectors related to the… Assigned by microsoft	Apr 27, 2014
CVE-2013-7331 Known exploited	Medium 6.5	The Microsoft.XMLDOM ActiveX control in Microsoft Windows 8.1 and earlier allows remote attackers to determine the existence of local pathnames, UNC share pathnames, intranet hostnames, and intranet… Assigned by mitre	Feb 26, 2014
CVE-2014-0322 Known exploited	High 8.8	Use-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code via vectors involving crafted JavaScript code, CMarkup, and the onpropertychange… Assigned by microsoft	Feb 14, 2014
CVE-2013-3897 Known exploited	High 8.8	Use-after-free vulnerability in the CDisplayPointer class in mshtml.dll in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (mem… Assigned by microsoft	Oct 9, 2013
CVE-2013-3893 Known exploited	High 8.8	Use-after-free vulnerability in the SetMouseCapture implementation in mshtml.dll in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code via crafted JavaScript s… Assigned by microsoft	Sep 18, 2013
CVE-2013-3163 Known exploited	High 8.8	Microsoft Internet Explorer 8 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corru… Assigned by microsoft	Jul 10, 2013
CVE-2013-1347 Known exploited	High 8.8	Microsoft Internet Explorer 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly allocated or (2) is… Assigned by microsoft	May 5, 2013
CVE-2013-2551 Known exploited	High 8.8	Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, as demonstr… Assigned by mitre	Mar 11, 2013
CVE-2012-4792 Known exploited	High 8.8	Use-after-free vulnerability in Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to an object that (1) was not pro… Assigned by microsoft	Dec 30, 2012
CVE-2012-4969 Known exploited	High 8.1	Use-after-free vulnerability in the CMshtmlEd::Exec function in mshtml.dll in Microsoft Internet Explorer 6 through 9 allows remote attackers to execute arbitrary code via a crafted web site, as expl… Assigned by mitre	Sep 18, 2012
CVE-2011-3389	Medium 4.3	The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode wi… Assigned by mitre	Sep 6, 2011
CVE-2010-3962 Known exploited	High 8.1	Use-after-free vulnerability in Microsoft Internet Explorer 6, 7, and 8 allows remote attackers to execute arbitrary code via vectors related to Cascading Style Sheets (CSS) token sequences and the c… Assigned by microsoft	Nov 5, 2010
CVE-2010-0806 Known exploited	High 8.8	Use-after-free vulnerability in the Peer Objects component (aka iepeers.dll) in Microsoft Internet Explorer 6, 6 SP1, and 7 allows remote attackers to execute arbitrary code via vectors involving acc… Assigned by microsoft	Mar 10, 2010
CVE-2010-0249 Known exploited	High 8.8	Use-after-free vulnerability in Microsoft Internet Explorer 6, 6 SP1, 7, and 8 on Windows 2000 SP4; Windows XP SP2 and SP3; Windows Server 2003 SP2; Windows Vista Gold, SP1, and SP2; Windows Server 2… Assigned by microsoft	Jan 15, 2010

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.