Microsoft Internet Explorer vulnerabilities

1,635 CVEs affecting Microsoft Internet Explorer, 43 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-26419, published 2021-05-11.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2010-3962: Microsoft Internet Explorer Uninitialized Memory Corruption Vulnerability, published 2010-11-05. High severity, CVSS 8.1. Actively exploited: in CISA KEV since 2025-10-06. EPSS: 96.8% chance of exploitation in the next 30 days. Use-after-free vulnerability in Microsoft Internet Explorer 6, 7, and 8 allows remote attackers to execute arbitrary code via vectors related to Cascading Style Sheets (CSS) token sequences and the…
CVE-2015-0313: Adobe Flash Player Use-After-Free Vulnerability, published 2015-02-02. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2022-04-13. EPSS: 95.3% chance of exploitation in the next 30 days. Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows remote attackers to execute…
CVE-2016-0189: Microsoft Internet Explorer Memory Corruption Vulnerability, published 2016-05-11. High severity, CVSS 7.5. Actively exploited: in CISA KEV since 2022-03-28. EPSS: 94.1% chance of exploitation in the next 30 days. The Microsoft (1) JScript 5.8 and (2) VBScript 5.7 and 5.8 engines, as used in Internet Explorer 9 through 11 and other products, allow remote attackers to execute arbitrary code or cause a denial of…
CVE-2010-0249: Microsoft Internet Explorer Use-After-Free Vulnerability, published 2010-01-15. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2026-05-20. EPSS: 91.9% chance of exploitation in the next 30 days. Use-after-free vulnerability in Microsoft Internet Explorer 6, 6 SP1, 7, and 8 on Windows 2000 SP4; Windows XP SP2 and SP3; Windows Server 2003 SP2; Windows Vista Gold, SP1, and SP2; Windows Server…
CVE-2013-3893: Microsoft Internet Explorer Resource Management Errors Vulnerability, published 2013-09-18. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2025-08-12. EPSS: 87.5% chance of exploitation in the next 30 days. Use-after-free vulnerability in the SetMouseCapture implementation in mshtml.dll in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code via crafted JavaScript…
CVE-2020-0674: Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability, published 2020-02-11. High severity, CVSS 7.5. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 86.9% chance of exploitation in the next 30 days. A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID…
CVE-2015-0311: Adobe Flash Player Remote Code Execution Vulnerability, published 2015-01-23. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2022-04-13. EPSS: 85.6% chance of exploitation in the next 30 days. Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Windows and OS X and through 11.2.202.438 on Linux allows remote attackers to execute…
CVE-2014-0322: Microsoft Internet Explorer Use-After-Free Vulnerability, published 2014-02-14. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2022-05-04. EPSS: 85.1% chance of exploitation in the next 30 days. Use-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code via vectors involving crafted JavaScript code, CMarkup, and the onpropertychange…
CVE-2014-1776: Microsoft Internet Explorer Memory Corruption Vulnerability, published 2014-04-27. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2022-01-28. EPSS: 82.7% chance of exploitation in the next 30 days. Use-after-free vulnerability in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via vectors related to the…
CVE-2010-0806: Microsoft Internet Explorer Use-After-Free Vulnerability, published 2010-03-10. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2026-05-20. EPSS: 82.2% chance of exploitation in the next 30 days. Use-after-free vulnerability in the Peer Objects component (aka iepeers.dll) in Microsoft Internet Explorer 6, 6 SP1, and 7 allows remote attackers to execute arbitrary code via vectors involving…

Latest

CVE-2021-26419, published 2021-05-11. High severity, CVSS 7.5. EPSS: 22.8% chance of exploitation in the next 30 days. Scripting Engine Memory Corruption Vulnerability
CVE-2021-27085: Microsoft Internet Explorer Remote Code Execution Vulnerability, published 2021-03-11. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 5.4% chance of exploitation in the next 30 days. Internet Explorer Remote Code Execution Vulnerability
CVE-2021-26411: Microsoft Internet Explorer Memory Corruption Vulnerability, published 2021-03-11. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 80.8% chance of exploitation in the next 30 days. Internet Explorer Memory Corruption Vulnerability
CVE-2020-17058, published 2020-11-11. High severity, CVSS 7.5. EPSS: 3.1% chance of exploitation in the next 30 days. Microsoft Browser Memory Corruption Vulnerability
CVE-2020-17053, published 2020-11-11. High severity, CVSS 7.5. EPSS: 3.2% chance of exploitation in the next 30 days. Internet Explorer Memory Corruption Vulnerability
CVE-2020-17052, published 2020-11-11. High severity, CVSS 7.5. EPSS: 2.7% chance of exploitation in the next 30 days. Scripting Engine Memory Corruption Vulnerability
CVE-2020-1506, published 2020-09-11. Medium severity, CVSS 6.1. EPSS: 2.1% chance of exploitation in the next 30 days. <p>An elevation of privilege vulnerability exists in the way that the Wininit.dll handles objects in memory. An attacker who successfully exploited the vulnerability could execute code with elevated…
CVE-2020-1012, published 2020-09-11. High severity, CVSS 8.8. EPSS: 3.7% chance of exploitation in the next 30 days. <p>An elevation of privilege vulnerability exists in the way that the Wininit.dll handles objects in memory. An attacker who successfully exploited the vulnerability could execute code with elevated…
CVE-2020-0878: Microsoft Edge and Internet Explorer Memory Corruption Vulnerability, published 2020-09-11. Medium severity, CVSS 4.2. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 2.7% chance of exploitation in the next 30 days. <p>A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory. The vulnerability could corrupt memory in a way that could allow an attacker to execute…
CVE-2020-1570, published 2020-08-17. High severity, CVSS 7.5. EPSS: 8.8% chance of exploitation in the next 30 days. A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer. The vulnerability could corrupt memory in such a way that an attacker…