Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
The year’s CVE activity with KEV, EPSS and exploit data as a PDF: heatmaps, a vendor treemap, and the lists worth checking against your estate.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
396,163 CVEs1,721 in CISA KEV17,157 with EPSS ≥ 10%25,049 with a public exploitUpdated 22 September 2026
25,049 results · page 136 of 501
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2014-1219 | CA 2E Web Option r8.1.2 accepts a predictable substring of a W2E_SSNID session token in place of the entire token, which allows remote attackers to hijack sessions by changing characters at the end of this substring, as demonstrated by terminating a… | EXPLOITMEDIUM 5.1EPSS 4.60% | 14 February 2014 |
| CVE-2013-5015 | SQL injection vulnerability in the management console in Symantec Endpoint Protection Manager (SEPM) 11.0 before 11.0.7405.1424 and 12.1 before 12.1.4023.4080, and Symantec Protection Center Small Business Edition 12.x before 12.1.4023.4080, allows… | EXPLOIT ×2 ✓MEDIUM 6.5EPSS 28.8% | 14 February 2014 |
| CVE-2013-5014 | The management console in Symantec Endpoint Protection Manager (SEPM) 11.0 before 11.0.7405.1424 and 12.1 before 12.1.4023.4080, and Symantec Protection Center Small Business Edition 12.x before 12.1.4023.4080, allows remote attackers to read arbitrary… | EXPLOIT ×2 ✓HIGH 7.5EPSS 67.6% | 14 February 2014 |
| CVE-2013-6229 | Multiple cross-site scripting (XSS) vulnerabilities in Atmail Webmail Server 7.0.2 allow remote attackers to inject arbitrary web script or HTML via the (1) filter parameter to… | EXPLOIT ×3 ✓MEDIUM 4.3EPSS 1.71% | 12 February 2014 |
| CVE-2014-0257 | Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, 4.5, and 4.5.1 does not properly determine whether it is safe to execute a method, which allows remote attackers to execute arbitrary code via (1) a crafted web site or (2) a crafted… | EXPLOIT ✓HIGH 9.3EPSS 69.8% | 12 February 2014 |
| CVE-2014-1459 | SQL injection vulnerability in dg-admin/index.php in doorGets CMS 5.2 and earlier allows remote authenticated administrators to execute arbitrary SQL commands via the _position_down_id parameter. | EXPLOITMEDIUM 6.5EPSS 2.27% | 11 February 2014 |
| CVE-2014-1401 | Multiple SQL injection vulnerabilities in AuraCMS 2.3 and earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) search parameter to mod/content/content.php or (2) CLIENT_IP, (3) X_FORWARDED_FOR, (4) X_FORWARDED, (5)… | EXPLOITMEDIUM 6.5EPSS 2.98% | 11 February 2014 |
| CVE-2014-0980 | Buffer overflow in Poster Software PUBLISH-iT 3.6d allows remote attackers to execute arbitrary code via a crafted PUI file. | EXPLOIT ×4 ✓HIGH 9.3EPSS 40.4% | 11 February 2014 |
| CVE-2013-3294 | Multiple SQL injection vulnerabilities in Exponent CMS before 2.2.0 release candidate 1 allow remote attackers to execute arbitrary SQL commands via the (1) src or (2) username parameter to index.php. | EXPLOITHIGH 7.5EPSS 2.38% | 11 February 2014 |
| CVE-2013-2639 | Cross-site scripting (XSS) vulnerability in CTERA Cloud Storage OS before 3.2.29.0, 3.2.42.0, and earlier allows remote attackers to inject arbitrary web script or HTML via the description in a project folder. | EXPLOITMEDIUM 4.3EPSS 1.41% | 11 February 2014 |
| CVE-2010-4777 | The Perl_reg_numbered_buff_fetch function in Perl 5.10.0, 5.12.0, 5.14.0, and other versions, when running with debugging enabled, allows context-dependent attackers to cause a denial of service (assertion failure and application exit) via crafted input… | EXPLOIT ✓MEDIUM 4.3EPSS 6.02% | 10 February 2014 |
| CVE-2014-1915 | Multiple cross-site request forgery (CSRF) vulnerabilities in Command School Student Management System 1.06.01 allow remote attackers to hijack the authentication of (1) administrators for requests that change the administrator password via an update… | EXPLOIT ×2 ✓MEDIUM 6.8EPSS 2.47% | 7 February 2014 |
| CVE-2014-0038 | The compat_sys_recvmmsg function in net/compat.c in the Linux kernel before 3.13.2, when CONFIG_X86_X32 is enabled, allows local users to gain privileges via a recvmmsg system call with a crafted timeout pointer parameter. | EXPLOIT ×4 ✓MEDIUM 6.9EPSS 35.5% | 6 February 2014 |
| CVE-2013-7319 | Cross-site scripting (XSS) vulnerability in the Download Manager plugin before 2.5.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via the title field. | EXPLOIT ✓MEDIUM 4.3EPSS 4.58% | 6 February 2014 |
| CVE-2011-4613 | The X.Org X wrapper (xserver-wrapper.c) in Debian GNU/Linux and Ubuntu Linux does not properly verify the TTY of a user who is starting X, which allows local users to bypass intended access restrictions by associating stdin with a file that is… | EXPLOITMEDIUM 4.6EPSS 0.86% | 5 February 2014 |
| CVE-2013-4978 | Stack-based buffer overflow in AloahaPDFViewer 5.0.0.7 and earlier in Aloaha PDF Suite FREE allows remote attackers to execute arbitrary code via a crafted PDF file. | EXPLOIT ✓HIGH 9.3EPSS 7.19% | 5 February 2014 |
| CVE-2013-3639 | Multiple cross-site scripting (XSS) vulnerabilities in Xaraya 2.4.0-b1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) id, (2) interface, (3) name, or (4) tabmodule parameter to index.php. | EXPLOIT ✓MEDIUM 4.3EPSS 3.22% | 5 February 2014 |
| CVE-2013-1852 | SQL injection vulnerability in leaguemanager.php in the LeagueManager plugin before 3.8.1 for WordPress allows remote attackers to execute arbitrary SQL commands via the league_id parameter in the leaguemanager-export page to wp-admin/admin.php. | EXPLOITHIGH 7.5EPSS 5.42% | 5 February 2014 |
| CVE-2013-1466 | Multiple cross-site scripting (XSS) vulnerabilities in glFusion before 1.2.2.pl4 allow remote attackers to inject arbitrary web script or HTML via the (1) subject parameter to profiles.php; (2) address1, (3) address2, (4) calendar_type, (5) city, (6)… | EXPLOITMEDIUM 4.3EPSS 3.77% | 5 February 2014 |
| CVE-2014-0497 | Adobe Flash Player Integer Underflow Vulnerablity | KEVEXPLOIT ✓CRITICAL 9.8EPSS 99.9% | 5 February 2014 |
| CVE-2012-6493 | Cross-site request forgery (CSRF) vulnerability in Rapid7 Nexpose Security Console before 5.5.4 allows remote attackers to hijack the authentication of unspecified victims for requests that delete scan data and sites via a request to data/site/delete. | EXPLOIT ✓MEDIUM 6.8EPSS 2.31% | 4 February 2014 |
| CVE-2013-3365 | TRENDnet TEW-812DRU router allows remote authenticated users to execute arbitrary commands via shell metacharacters in the (1) wan network prefix to internet/ipv6.asp; (2) remote port to adm/management.asp; (3) pptp username, (4) pptp password, (5) ip,… | EXPLOITHIGH 8.5EPSS 3.90% | 4 February 2014 |
| CVE-2013-3098 | Multiple cross-site request forgery (CSRF) vulnerabilities in TRENDnet TEW-812DRU router with firmware before 1.0.9.0 allow remote attackers to hijack the authentication of administrators for requests that (1) change admin credentials in a request to… | EXPLOITMEDIUM 6.8EPSS 1.15% | 4 February 2014 |
| CVE-2014-0329 | The TELNET service on the ZTE ZXV10 W300 router 2.1.0 has a hardcoded password ending with airocon for the admin account, which allows remote attackers to obtain administrative access by leveraging knowledge of the MAC address characters present at the… | EXPLOITHIGH 9.3EPSS 8.52% | 4 February 2014 |
| CVE-2013-7183 | cgi-bin/reboot.cgi on Seowon Intech SWC-9100 routers allows remote attackers to (1) cause a denial of service (reboot) via a default_reboot action or (2) reset all configuration values via a factory_default action. | EXPLOIT ✓HIGH 7.8EPSS 3.20% | 4 February 2014 |
| CVE-2013-7179 | The ping functionality in cgi-bin/diagnostic.cgi on Seowon Intech SWC-9100 routers allows remote attackers to execute arbitrary commands via shell metacharacters in the ping_ipaddr parameter. | EXPLOIT ✓HIGH 8.3EPSS 4.10% | 4 February 2014 |
| CVE-2014-1204 | SQL injection vulnerability in Tableau Server 8.0.x before 8.0.7 and 8.1.x before 8.1.2 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors. | EXPLOIT ✓HIGH 7.5EPSS 4.18% | 31 January 2014 |
| CVE-2014-1610 | MediaWiki 1.22.x before 1.22.2, 1.21.x before 1.21.5, and 1.19.x before 1.19.11, when DjVu or PDF file upload support is enabled, allows remote attackers to execute arbitrary commands via shell metacharacters in (1) the page parameter to… | EXPLOIT ×2 ✓MEDIUM 6.0EPSS 42.8% | 30 January 2014 |
| CVE-2014-0793 | Multiple cross-site scripting (XSS) vulnerabilities in the StackIdeas Komento (com_komento) component before 1.7.3 for Joomla! allow remote attackers to inject arbitrary web script or HTML via the (1) website or (2) latitude parameter in a comment to… | EXPLOITMEDIUM 4.3EPSS 1.75% | 30 January 2014 |
| CVE-2013-7246 | Buffer overflow in the IconCreate method in an ActiveX control in the DaumGame ActiveX plugin 1.1.0.4 and 1.1.0.5 allows remote attackers to execute arbitrary code via a long string, as exploited in the wild in January 2014. | EXPLOIT ✓HIGH 9.3EPSS 11.2% | 30 January 2014 |
| CVE-2013-0177 | Multiple cross-site scripting (XSS) vulnerabilities in widget/screen/ModelScreenWidget.java in Apache Open For Business Project (aka OFBiz) 10.04.x before 10.04.05, 11.04.01, and possibly 09.04.x allow remote authenticated users to inject arbitrary web… | EXPLOIT ✓LOW 3.5EPSS 21.2% | 30 January 2014 |
| CVE-2014-1683 | The bashMail function in cms/data/skins/techjunkie/fragments/contacts/functions.php in SkyBlueCanvas CMS before 1.1 r248-04, when the pid parameter is 4, allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) name, (2)… | EXPLOIT ×2 ✓MEDIUM 6.8EPSS 31.4% | 29 January 2014 |
| CVE-2013-5092 | Cross-site scripting (XSS) vulnerability in afa/php/Login.php in AlgoSec Firewall Analyzer 6.1-b86 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO. | EXPLOIT ✓MEDIUM 4.3EPSS 3.25% | 29 January 2014 |
| CVE-2013-4898 | Unrestricted file upload vulnerability in the user profile page feature in the Timeline Plugin 4.2.5p9 for SocialEngine allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a… | EXPLOITMEDIUM 6.5EPSS 3.16% | 29 January 2014 |
| CVE-2013-4889 | Multiple cross-site request forgery (CSRF) vulnerabilities in index.php in Digital Signage Xibo 1.4.2 allow remote attackers to hijack the authentication of administrators for requests that (1) add a new administrator via the AddUser action or (2)… | EXPLOIT ✓MEDIUM 6.8EPSS 0.87% | 29 January 2014 |
| CVE-2013-4888 | Cross-site scripting (XSS) vulnerability in index.php in Digital Signage Xibo 1.4.2 allows remote attackers to inject arbitrary web script or HTML via the layout parameter in the layout page. | EXPLOIT ✓MEDIUM 4.3EPSS 1.41% | 29 January 2014 |
| CVE-2013-5094 | Cross-site scripting (XSS) vulnerability in index.exp in McAfee Vulnerability Manager 7.5 allows remote attackers to inject arbitrary web script or HTML via the cert_cn cookie parameter. | EXPLOIT ✓MEDIUM 4.3EPSS 1.84% | 28 January 2014 |
| CVE-2012-5192 | Directory traversal vulnerability in gmap/view_overlay.php in Bitweaver 2.8.1 and earlier allows remote attackers to read arbitrary files via "''%2F" (dot dot encoded slash) sequences in the overlay_type parameter. | EXPLOIT ✓MEDIUM 5.0EPSS 52.5% | 28 January 2014 |
| CVE-2014-1664 | The Citrix GoToMeeting application 5.0.799.1238 for Android logs HTTP requests containing sensitive information, which allows attackers to obtain user IDs, meeting details, and authentication tokens via an application that reads the system log file. | EXPLOIT ✓MEDIUM 5.0EPSS 2.98% | 26 January 2014 |
| CVE-2014-0794 | SQL injection vulnerability in the JV Comment (com_jvcomment) component before 3.0.3 for Joomla! allows remote authenticated users to execute arbitrary SQL commands via the id parameter in a comment.like action to index.php. | EXPLOITMEDIUM 4.3EPSS 1.29% | 26 January 2014 |
| CVE-2014-1671 | Multiple SQL injection vulnerabilities in Dell KACE K1000 5.4.76847 and possibly earlier allow remote attackers or remote authenticated users to execute arbitrary SQL commands via the macAddress element in a (1) getUploadPath or (2) getKBot SOAP request… | EXPLOIT ✓MEDIUM 6.5EPSS 1.95% | 26 January 2014 |
| CVE-2013-7248 | Franklin Fueling Systems TS-550 evo with firmware 2.0.0.6833 and other versions before 2.4.0 has a hardcoded password for the roleDiag account, which allows remote attackers to gain root privileges, as demonstrated using a cmdWebCheckRole action in a… | EXPLOIT ✓HIGH 10.0EPSS 4.16% | 26 January 2014 |
| CVE-2013-7247 | cgi-bin/tsaws.cgi in Franklin Fueling Systems TS-550 evo with firmware 2.0.0.6833 and other versions before 2.4.0 allows remote attackers to discover sensitive information (user names and password hashes) via the cmdWebGetConfiguration action in a… | EXPLOIT ✓MEDIUM 5.0EPSS 2.63% | 26 January 2014 |
| CVE-2013-7137 | The "remember me" functionality in login.php in Burden before 1.8.1 allows remote attackers to bypass authentication and gain privileges by setting the burden_user_rememberme cookie to 1. | EXPLOITCRITICAL 9.8EPSS 16.1% | 26 January 2014 |
| CVE-2014-0750 | Directory traversal vulnerability in gefebt.exe in the WebView CimWeb components in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY through 8.2 SIM 24, and Proficy Process Systems with CIMPLICITY, allows remote attackers to execute arbitrary… | EXPLOIT ✓HIGH 7.5EPSS 70.2% | 25 January 2014 |
| CVE-2014-1202 | The WSDL/WADL import functionality in SoapUI before 4.6.4 allows remote attackers to execute arbitrary Java code via a crafted request parameter in a WSDL file. | EXPLOITHIGH 9.3EPSS 7.67% | 25 January 2014 |
| CVE-2013-7316 | Cross-site scripting (XSS) vulnerability in GitLab 6.0 and other versions before 6.5.0 allows remote attackers to inject arbitrary web script or HTML via a crafted HTML file, as demonstrated by README.html. | EXPLOIT ✓MEDIUM 4.3EPSS 1.84% | 24 January 2014 |
| CVE-2013-7184 | Gretech GOM Media Player 2.2.56.5158 and earlier allows remote attackers to cause a denial of service (memory corruption) via a crafted AVI file. | EXPLOITMEDIUM 4.3EPSS 2.21% | 24 January 2014 |
| CVE-2014-1637 | Command School Student Management System 1.06.01 does not properly restrict access to sw/backup/backup_ray2.php, which allows remote attackers to download a database backup via a direct request. | EXPLOIT ✓MEDIUM 5.0EPSS 6.94% | 22 January 2014 |
| CVE-2014-1636 | Multiple SQL injection vulnerabilities in Command School Student Management System 1.06.01 allow remote attackers to execute arbitrary SQL commands via the id parameter in an edit action to (1) admin_school_names.php, (2) admin_subjects.php, (3)… | EXPLOIT ×12 ✓HIGH 7.5EPSS 3.80% | 22 January 2014 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.