winzip winzip

Name: winzip winzip
Brand: winzip

productUS

cpe:2.3:a:winzip:winzip:*:*:*:*:*:*:*:*

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

critical

by severity

0critical8high5medium1low

updated 2026-10-28

vulnerabilities (14)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2006-5198US	medium4.0	62.1% (99th)	Exploit	no fix	2006-11-14	= 10.0
CVE-2004-0333US	high10.0	24.2% (98th)	Exploit	no fix	2004-11-23	3 versions
CVE-2006-3890US	high9.3	14.6% (97th)	Exploit	no fix	2006-11-21	5 versions
CVE-2006-6884US	high9.3	4.69% (92nd)	Exploit	no fix	2006-12-31	= 10.0_build_6667
CVE-2004-1465US	low3.7	1.14% (66th)	Exploit	no fix	2004-12-31	4 versions
CVE-2007-0264US	medium6.6	0.73% (54th)	Exploit	no fix	2007-01-16	= 9.0
CVE-2002-0370US	high7.5	43.3% (99th)	—	no fix	2002-10-10	= 7.0
CVE-2025-1240US	high8.8	10.3% (96th)	—	76.8	2025-02-11	3 versions
CVE-2004-0234US	high10.0	10.3% (96th)	—	no fix	2004-08-18	= 9.0
CVE-2004-0235US	medium6.4	4.12% (91st)	—	no fix	2004-08-18	= 9.0
CVE-2008-3442US	high7.5	3.76% (90th)	—	no fix	2008-08-01	5 versions
CVE-2024-8811US	high7.8	0.44% (38th)	—	76.8	2024-11-22	< 76.8
CVE-2001-0449US	medium4.6	0.42% (36th)	—	no fix	2001-06-27	= 8.0
CVE-2003-1376US	medium4.6	0.24% (15th)	—	no fix	2003-12-31	= 8.0

The flaw types (CWEs) most of these CVEs share.

CWE-119Improper Restriction of Operations within the Bounds of a Memory Buffer6 CVEs
CWE-20Improper Input Validation3 CVEs
CWE-94Improper Control of Generation of Code ('Code Injection')2 CVEs
CWE-120Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')1 CVEs
CWE-121Stack-based Buffer Overflow1 CVEs
CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')1 CVEs
CWE-254CWE-2541 CVEs
CWE-255CWE-2551 CVEs

Which sources assert this record, and when.

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.