Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
The year’s CVE activity with KEV, EPSS and exploit data as a PDF: heatmaps, a vendor treemap, and the lists worth checking against your estate.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
396,163 CVEs1,717 in CISA KEV17,157 with EPSS ≥ 10%25,049 with a public exploitUpdated 22 September 2026
25,049 results · page 132 of 501
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2014-3444 | The GetGUID function in codecs/dmp4.dll in RealNetworks RealPlayer 16.0.3.51 and earlier allows remote attackers to execute arbitrary code or cause a denial of service (write access violation and application crash) via a malformed .3gp file. | EXPLOIT ✓HIGH 9.3EPSS 5.59% | 20 May 2014 |
| CVE-2013-6765 | OpenVAS Manager 3.0 before 3.0.7 and 4.0 before 4.0.4 allows remote attackers to bypass the OMP authentication restrictions and execute OMP commands via a crafted OMP request for version information, which causes the state to be set to CLIENT_AUTHENTIC,… | EXPLOITHIGH 7.5EPSS 7.27% | 19 May 2014 |
| CVE-2014-2085 | Reason: This issue was MERGED into CVE-2014-2084 in accordance with CVE content decisions, because it is the same type of vulnerability and affects the same versions. | EXPLOITUnscoredEPSS — | 17 May 2014 |
| CVE-2014-2084 | Skybox View Appliances with ISO 6.3.33-2.14, 6.3.31-2.14, 6.4.42-2.54, 6.4.45-2.56, and 6.4.46-2.57 does not properly restrict access to the Admin interface, which allows remote attackers to obtain sensitive information via a request to (1)… | EXPLOIT ×2HIGH 8.5EPSS 4.41% | 17 May 2014 |
| CVE-2013-7382 | VICIDIAL dialer (aka Asterisk GUI client) 2.8-403a, 2.7, 2.7RC1, and earlier has a hardcoded password of donotedit for the (1) VDAD and (2) VDCL users, which makes it easier for remote attackers to obtain access. | EXPLOIT ✓MEDIUM 5.0EPSS 2.79% | 17 May 2014 |
| CVE-2014-0749 | Stack-based buffer overflow in lib/Libdis/disrsi_.c in Terascale Open-Source Resource and Queue Manager (aka TORQUE Resource Manager) 2.5.x through 2.5.13 allows remote attackers to execute arbitrary code via a large count value. | EXPLOITHIGH 10.0EPSS 17.5% | 16 May 2014 |
| CVE-2014-1649 | The server in Symantec Workspace Streaming (SWS) before 7.5.0.749 allows remote attackers to access files and functionality by sending a crafted XMLRPC request over HTTPS. | EXPLOIT ✓HIGH 7.9EPSS 42.3% | 16 May 2014 |
| CVE-2014-0782 | Stack-based buffer overflow in BKESimmgr.exe in the Expanded Test Functions package in Yokogawa CENTUM CS 1000, CENTUM CS 3000 Entry Class R3.09.50 and earlier, CENTUM VP R5.03.00 and earlier, CENTUM VP Entry Class R5.03.00 and earlier, Exaopc R3.71.02… | EXPLOIT ✓HIGH 8.3EPSS 56.8% | 16 May 2014 |
| CVE-2014-3757 | SQL injection vulnerability in sorter.php in the phpManufaktur kitForm extension 0.43 and earlier for the KeepInTouch (KIT) module allows remote attackers to execute arbitrary SQL commands via the sorter_value parameter. | EXPLOITHIGH 7.5EPSS 1.38% | 15 May 2014 |
| CVE-2014-3247 | Cross-site scripting (XSS) vulnerability in Collabtive 1.2 allows remote authenticated users to inject arbitrary web script or HTML via the desc parameter in an Add project (addpro) action to admin.php. | EXPLOIT ✓MEDIUM 4.3EPSS 1.74% | 15 May 2014 |
| CVE-2013-4730 | Buffer overflow in PCMan's FTP Server 2.0.7 allows remote attackers to execute arbitrary code via a long string in a USER command. | EXPLOIT ×10 ✓HIGH 10.0EPSS 66.5% | 15 May 2014 |
| CVE-2014-3443 | JetMPAd.ax in JetAudio 8.1.1 and earlier allows remote attackers to cause a denial of service (crash) via a crafted .ogg file. | EXPLOIT ✓MEDIUM 4.3EPSS 2.29% | 14 May 2014 |
| CVE-2014-3441 | codec\libpng_plugin.dll in VideoLAN VLC Media Player 2.1.3 allows remote attackers to cause a denial of service (crash) via a crafted .png file, as demonstrated by a png in a .wave file. | EXPLOIT ✓MEDIUM 4.3EPSS 3.99% | 14 May 2014 |
| CVE-2014-3146 | Incomplete blacklist vulnerability in the lxml.html.clean module in lxml before 3.3.5 allows remote attackers to conduct cross-site scripting (XSS) attacks via control characters in the link scheme to the clean_html function. | EXPLOIT ✓MEDIUM 6.1EPSS 6.33% | 14 May 2014 |
| CVE-2014-1603 | Multiple cross-site scripting (XSS) vulnerabilities in GetSimple CMS 3.3.1 allow remote attackers to inject arbitrary web script or HTML via the (1) param parameter to admin/load.php or (2) user, (3) email, or (4) name parameter in a Save Settings… | EXPLOITMEDIUM 4.3EPSS 3.22% | 14 May 2014 |
| CVE-2013-7376 | Multiple cross-site request forgery (CSRF) vulnerabilities in OpenX 2.8.10, possibly before revision 82710, allow remote attackers to hijack the authentication of administrators, as demonstrated by requests that conduct directory traversal attacks via… | EXPLOITMEDIUM 6.8EPSS 1.25% | 14 May 2014 |
| CVE-2013-4468 | VICIDIAL dialer (aka Asterisk GUI client) 2.8-403a, 2.7, 2.7RC1, and earlier allows remote authenticated users to execute arbitrary commands via shell metacharacters in the extension parameter in an OriginateVDRelogin action to manager_send.php. | EXPLOIT ✓MEDIUM 6.5EPSS 32.3% | 14 May 2014 |
| CVE-2013-3514 | Multiple directory traversal vulnerabilities in OpenX before 2.8.10 revision 82710 allow remote administrators to read arbitrary files via a .. | EXPLOITMEDIUM 4.3EPSS 3.33% | 14 May 2014 |
| CVE-2013-2226 | Multiple SQL injection vulnerabilities in GLPI before 0.83.9 allow remote attackers to execute arbitrary SQL commands via the (1) users_id_assign parameter to ajax/ticketassigninformation.php, (2) filename parameter to front/document.form.php, or (3)… | EXPLOITHIGH 7.5EPSS 2.77% | 14 May 2014 |
| CVE-2013-1765 | Multiple cross-site scripting (XSS) vulnerabilities in jwplayer.swf in the smart-flv plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) link or (2) playerready parameter. | EXPLOIT ✓MEDIUM 4.3EPSS 3.91% | 14 May 2014 |
| CVE-2014-1815 | Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, as exploited in the wild in May 2014, aka "Internet Explorer Memory Corruption… | EXPLOITHIGH 9.3EPSS 20.3% | 14 May 2014 |
| CVE-2014-1806 | The .NET Remoting implementation in Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, 4.5, and 4.5.1 does not properly restrict memory access, which allows remote attackers to execute arbitrary code via vectors involving malformed objects, aka… | EXPLOITHIGH 10.0EPSS 39.6% | 14 May 2014 |
| CVE-2014-3225 | Absolute path traversal vulnerability in the web interface in Cobbler 2.4.x through 2.6.x allows remote authenticated users to read arbitrary files via the Kickstart field in a profile. | EXPLOITMEDIUM 4.0EPSS 8.88% | 14 May 2014 |
| CVE-2014-2046 | cgi-bin/rpcBridge in the web interface 1.1 on Broadcom Ltd PIPA C211 rev2 does not properly restrict access, which allows remote attackers to (1) obtain credentials and other sensitive information via a certain request to the… | EXPLOIT ✓HIGH 9.7EPSS 3.82% | 14 May 2014 |
| CVE-2014-1849 | Foscam IP camera 11.37.2.49 and other versions, when using the Foscam DynDNS option, generates credentials based on predictable camera subdomain names, which allows remote attackers to spoof or hijack arbitrary cameras and conduct other attacks by… | EXPLOIT ✓HIGH 10.0EPSS 12.1% | 14 May 2014 |
| CVE-2013-4490 | The SSH key upload feature (lib/gitlab_keys.rb) in gitlab-shell before 1.7.3, as used in GitLab 5.0 before 5.4.1 and 6.x before 6.2.3, allows remote authenticated users to execute arbitrary commands via shell metacharacters in the public key. | EXPLOIT ✓MEDIUM 6.5EPSS 42.1% | 13 May 2014 |
| CVE-2014-3246 | SQL injection vulnerability in Collabtive 1.2 allows remote authenticated users to execute arbitrary SQL commands via the folder parameter in a fileview_list action to manageajax.php. | EXPLOIT ✓MEDIUM 6.5EPSS 1.33% | 13 May 2014 |
| CVE-2014-2989 | Cross-site request forgery (CSRF) vulnerability in Open Assessment Technologies TAO 2.5.6 allows remote attackers to hijack the authentication of administrators for requests that create administrative accounts via a request to Users/add. | EXPLOIT ✓MEDIUM 6.8EPSS 1.20% | 13 May 2014 |
| CVE-2014-2928 | The iControl API in F5 BIG-IP LTM, APM, ASM, GTM, Link Controller, and PSM 10.0.0 through 10.2.4 and 11.0.0 through 11.5.1, BIG-IP AAM 11.4.0 through 11.5.1, BIG-IP AFM and PEM 11.3.0 through 11.5.1, BIG-IP Analytics 11.0.0 through 11.5.1, BIG-IP Edge… | EXPLOIT ✓HIGH 7.1EPSS 40.1% | 12 May 2014 |
| CVE-2013-5748 | Cross-site request forgery (CSRF) vulnerability in management/prioritize_planning.php in SimpleRisk before 20130916-001 allows remote attackers to hijack the authentication of users for requests that add projects via an add_project action. | EXPLOITMEDIUM 6.8EPSS 1.99% | 12 May 2014 |
| CVE-2014-2934 | Multiple SQL injection vulnerabilities in Caldera 9.20 allow remote attackers to execute arbitrary SQL commands via the tr parameter to (1) costview2/jobs.php or (2) costview2/printers.php. | EXPLOIT ×2 ✓HIGH 7.5EPSS 1.54% | 8 May 2014 |
| CVE-2014-2913 | Incomplete blacklist vulnerability in nrpe.c in Nagios Remote Plugin Executor (NRPE) 2.15 and earlier allows remote attackers to execute arbitrary commands via a newline character in the -a option to libexec/check_nrpe. | EXPLOIT ×2HIGH 7.5EPSS 15.3% | 7 May 2014 |
| CVE-2014-0196 | Linux Kernel Race Condition Vulnerability | KEVEXPLOITMEDIUM 5.5EPSS 22.5% | 7 May 2014 |
| CVE-2014-2347 | Amtelco miSecureMessages (aka MSM) 6.2 does not properly manage sessions, which allows remote authenticated users to obtain sensitive information via a modified message request. | EXPLOITLOW 3.5EPSS 2.42% | 6 May 2014 |
| CVE-2014-3220 | F5 BIG-IQ Cloud and Security 4.0.0 through 4.1.0 allows remote authenticated users to change the password of arbitrary users via the name parameter in a request to the user's page in mgmt/shared/authz/users/. | EXPLOITHIGH 9.0EPSS 11.0% | 5 May 2014 |
| CVE-2013-7375 | SQL injection vulnerability in includes/classes/Authenticate.class.php in PHP-Fusion 7.02.01 through 7.02.05 allows remote attackers to execute arbitrary SQL commands via the user ID in a user cookie, a different vulnerability than CVE-2013-1803. | EXPLOITHIGH 7.5EPSS 3.62% | 5 May 2014 |
| CVE-2013-1803 | Multiple SQL injection vulnerabilities in PHP-Fusion before 7.02.06 allow remote attackers to execute arbitrary SQL commands via the (1) orderby parameter to downloads.php; or remote authenticated users with certain permissions to execute arbitrary SQL… | EXPLOITHIGH 7.5EPSS 4.05% | 5 May 2014 |
| CVE-2014-3139 | recoveryconsole/bpl/snmpd.php in Unitrends Enterprise Backup 7.3.0 allows remote attackers to bypass authentication by setting the auth parameter to a certain string. | EXPLOITHIGH 7.5EPSS 3.31% | 2 May 2014 |
| CVE-2014-3138 | SQL injection vulnerability in Xerox DocuShare before 6.53 Patch 6 Hotfix 2, 6.6.1 Update 1 before Hotfix 24, and 6.6.1 Update 2 before Hotfix 3 allows remote authenticated users to execute arbitrary SQL commands via the PATH_INFO to… | EXPLOITMEDIUM 6.5EPSS 2.71% | 2 May 2014 |
| CVE-2013-1807 | PHP-Fusion before 7.02.06 stores backup files with predictable filenames in an unrestricted directory under the web document root, which might allow remote attackers to obtain sensitive information via a direct request to the backup file in… | EXPLOITMEDIUM 5.0EPSS 7.62% | 30 April 2014 |
| CVE-2013-1806 | Multiple directory traversal vulnerabilities in PHP-Fusion before 7.02.06 allow remote authenticated users to include and execute arbitrary files via a .. | EXPLOITMEDIUM 6.5EPSS 7.84% | 30 April 2014 |
| CVE-2013-1805 | Reason: This issue was MERGED into CVE-2013-1806 in accordance with CVE content decisions, because it is the same type of vulnerability and affects the same versions. | EXPLOITUnscoredEPSS — | 30 April 2014 |
| CVE-2014-0114 | Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to… | EXPLOIT ✓HIGH 7.5EPSS 99.0% | 30 April 2014 |
| CVE-2013-1804 | Multiple cross-site scripting (XSS) vulnerabilities in PHP-Fusion before 7.02.06 allow remote attackers to inject arbitrary web script or HTML via the (1) highlight parameter to forum/viewthread.php; or remote authenticated users with certain… | EXPLOITMEDIUM 4.3EPSS 4.44% | 29 April 2014 |
| CVE-2014-1843 | Directory traversal vulnerability in the web interface in Titan FTP Server before 10.40 build 1829 allows remote attackers to obtain the property information of an arbitrary home folder via a Properties action with a .. | EXPLOITMEDIUM 5.0EPSS 4.67% | 29 April 2014 |
| CVE-2014-1842 | Directory traversal vulnerability in the web interface in Titan FTP Server before 10.40 build 1829 allows remote attackers to list all usernames via a Go action with a .. | EXPLOITMEDIUM 5.0EPSS 4.79% | 29 April 2014 |
| CVE-2014-1841 | Directory traversal vulnerability in the web interface in Titan FTP Server before 10.40 build 1829 allows remote attackers to copy an arbitrary user's home folder via a Move action with a .. | EXPLOITMEDIUM 5.0EPSS 4.85% | 29 April 2014 |
| CVE-2014-0515 | Buffer overflow in Adobe Flash Player before 11.7.700.279 and 11.8.x through 13.0.x before 13.0.0.206 on Windows and OS X, and before 11.2.202.356 on Linux, allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the… | EXPLOIT ✓HIGH 10.0EPSS 94.6% | 29 April 2014 |
| CVE-2014-0113 | CookieInterceptor in Apache Struts before 2.3.20, when a wildcard cookiesName value is used, does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via a crafted… | EXPLOIT ✓HIGH 7.5EPSS 77.8% | 29 April 2014 |
| CVE-2014-0112 | ParametersInterceptor in Apache Struts before 2.3.20 does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via a crafted request. | EXPLOIT ×2 ✓HIGH 7.5EPSS 97.9% | 29 April 2014 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.