Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
The year’s CVE activity with KEV, EPSS and exploit data as a PDF: heatmaps, a vendor treemap, and the lists worth checking against your estate.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
396,587 CVEs1,721 in CISA KEV17,395 with EPSS ≥ 10%25,049 with a public exploitUpdated 23 September 2026
25,049 results · page 182 of 501
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2010-3904 | Linux Kernel Improper Input Validation Vulnerability | KEVEXPLOIT ×2 ✓HIGH 7.8EPSS 14.5% | 6 December 2010 |
| CVE-2010-3449 | Cross-site request forgery (CSRF) vulnerability in Redback before 1.2.4, as used in Apache Archiva 1.0 through 1.0.3, 1.1 through 1.1.4, 1.2 through 1.2.2, and 1.3 through 1.3.1; and Apache Continuum 1.3.6, 1.4.0, and 1.1 through 1.2.3.1; allows remote… | EXPLOIT ✓MEDIUM 6.8EPSS 4.84% | 6 December 2010 |
| CVE-2010-4398 | Microsoft Windows Kernel Stack-Based Buffer Overflow Vulnerability | KEVEXPLOIT ✓HIGH 7.8EPSS 8.66% | 6 December 2010 |
| CVE-2010-4254 | Mono, when Moonlight before 2.3.0.1 or 2.99.x before 2.99.0.10 is used, does not properly validate arguments to generic methods, which allows remote attackers to bypass generic constraints, and possibly execute arbitrary code, via a crafted method call. | EXPLOIT ✓HIGH 7.5EPSS 13.6% | 6 December 2010 |
| CVE-2010-4406 | Directory traversal vulnerability in gallery.php in Brunetton LittlePhpGallery 1.0.2, when magic_quotes_gpc is disabled, allows remote attackers to list, include, and execute arbitrary local files via a ..// (dot dot slash slash) in the repertoire… | EXPLOIT ✓MEDIUM 6.8EPSS 1.95% | 6 December 2010 |
| CVE-2010-4401 | languages.inc.php in DynPG CMS 4.2.0 allows remote attackers to obtain sensitive information via a direct request, which reveals the installation path in an error message. | EXPLOITMEDIUM 5.0EPSS 5.61% | 6 December 2010 |
| CVE-2010-4400 | SQL injection vulnerability in _rights.php in DynPG CMS 4.2.0 allows remote attackers to execute arbitrary SQL commands via the giveRights_UserId parameter. | EXPLOITHIGH 7.5EPSS 2.16% | 6 December 2010 |
| CVE-2010-4399 | Directory traversal vulnerability in languages.inc.php in DynPG CMS 4.1.1 and 4.2.0, when magic_quotes_gpc is disabled, allows remote attackers to read arbitrary files via a .. | EXPLOITMEDIUM 4.3EPSS 5.56% | 6 December 2010 |
| CVE-2010-4313 | Unrestricted file upload vulnerability in fileman_file_upload.php in Orbis CMS 1.0.2 allows remote authenticated users to execute arbitrary code by uploading a .php file, and then accessing it via a direct request to the file in uploads/. | EXPLOITMEDIUM 6.0EPSS 2.71% | 2 December 2010 |
| CVE-2010-4283 | PHP remote file inclusion vulnerability in extras/pandora_diag.php in Pandora FMS before 3.1.1 allows remote attackers to execute arbitrary PHP code via a URL in the argv[1] parameter. | EXPLOITHIGH 7.5EPSS 9.41% | 2 December 2010 |
| CVE-2010-4282 | Multiple directory traversal vulnerabilities in Pandora FMS before 3.1.1 allow remote attackers to include and execute arbitrary local files via (1) the page parameter to ajax.php or (2) the id parameter to general/pandora_help.php, and allow remote… | EXPLOITHIGH 7.5EPSS 19.6% | 2 December 2010 |
| CVE-2010-4281 | Incomplete blacklist vulnerability in the safe_url_extraclean function in ajax.php in Pandora FMS before 3.1.1 allows remote attackers to execute arbitrary PHP code by using a page parameter containing a UNC share pathname, which bypasses the check for… | EXPLOITHIGH 7.5EPSS 9.59% | 2 December 2010 |
| CVE-2010-4280 | Multiple SQL injection vulnerabilities in Pandora FMS before 3.1.1 allow remote authenticated users to execute arbitrary SQL commands via (1) the id_group parameter in an operation/agentes/ver_agente action to ajax.php or (2) the group_id parameter in… | EXPLOIT ×2HIGH 7.5EPSS 5.34% | 2 December 2010 |
| CVE-2010-4279 | The default configuration of Pandora FMS 3.1 and earlier specifies an empty string for the loginhash_pwd field, which allows remote attackers to bypass authentication by sending a request to index.php with "admin" in the loginhash_user parameter, in… | EXPLOIT ×2 ✓HIGH 10.0EPSS 65.6% | 2 December 2010 |
| CVE-2010-4278 | operation/agentes/networkmap.php in Pandora FMS before 3.1.1 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the layout parameter in an operation/agentes/networkmap action to index.php. | EXPLOIT ✓HIGH 9.0EPSS 11.3% | 2 December 2010 |
| CVE-2010-4371 | Buffer overflow in the in_mod plugin in Winamp before 5.6 allows remote attackers to have an unspecified impact via vectors related to the comment box. | EXPLOIT ×3 ✓HIGH 9.3EPSS 6.10% | 2 December 2010 |
| CVE-2010-4367 | awstats.cgi in AWStats before 7.0 accepts a configdir parameter in the URL, which allows remote attackers to execute arbitrary commands via a crafted configuration file located on a (1) WebDAV server or (2) NFS server. | EXPLOIT ✓HIGH 7.5EPSS 27.7% | 2 December 2010 |
| CVE-2010-3267 | Multiple SQL injection vulnerabilities in BugTracker.NET before 3.4.5 allow remote authenticated users to execute arbitrary SQL commands via (1) the qu_id parameter to bugs.aspx, (2) the row_id parameter to delete_query.aspx, the (3) new_project or (4)… | EXPLOIT ✓MEDIUM 6.5EPSS 1.94% | 2 December 2010 |
| CVE-2010-3266 | Multiple cross-site scripting (XSS) vulnerabilities in BugTracker.NET before 3.4.5 allow remote authenticated users to inject arbitrary web script or HTML via (1) the pcd parameter to edit_bug.aspx, (2) the bug_id parameter to edit_comment.aspx, (3) the… | EXPLOIT ×2 ✓LOW 3.5EPSS 2.80% | 2 December 2010 |
| CVE-2010-4366 | Multiple cross-site scripting (XSS) vulnerabilities in forum_new_topic.php in Chameleon Social Networking allow remote attackers to inject arbitrary web script or HTML via the (1) thread_title and (2) thread_description parameters in a message. | EXPLOIT ✓MEDIUM 4.3EPSS 1.54% | 1 December 2010 |
| CVE-2010-4365 | SQL injection vulnerability in JE Ajax Event Calendar (com_jeajaxeventcalendar) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the event_id parameter in an alleventlist_more action to index.php. | EXPLOIT ×2HIGH 7.5EPSS 1.00% | 1 December 2010 |
| CVE-2010-4362 | Multiple SQL injection vulnerabilities in MicroNetsoft RV Dealer Website allow remote attackers to execute arbitrary SQL commands via the (1) selStock parameter to search.asp and the (2) orderBy parameter to showAlllistings.asp. | EXPLOIT ✓HIGH 7.5EPSS 0.98% | 1 December 2010 |
| CVE-2010-4360 | Multiple SQL injection vulnerabilities in index.php in Jurpopage 0.2.0 allow remote attackers to execute arbitrary SQL commands via the (1) note and (2) pg parameters, different vectors than CVE-2010-4359. | EXPLOIT ✓HIGH 7.5EPSS 0.91% | 1 December 2010 |
| CVE-2010-4359 | SQL injection vulnerability in index.php in Jurpopage 0.2.0 allows remote attackers to execute arbitrary SQL commands via the category parameter. | EXPLOIT ✓HIGH 7.5EPSS 1.02% | 1 December 2010 |
| CVE-2010-4357 | SQL injection vulnerability in comments.php in SiteEngine 7.1 allows remote attackers to execute arbitrary SQL commands via the module parameter. | EXPLOITHIGH 7.5EPSS 0.98% | 1 December 2010 |
| CVE-2010-4356 | SQL injection vulnerability in news_default.asp in Site2Nite Big Truck Broker allows remote attackers to execute arbitrary SQL commands via the txtSiteId parameter. | EXPLOIT ✓HIGH 7.5EPSS 0.98% | 1 December 2010 |
| CVE-2009-5019 | Web Wiz NewsPad stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for database/NewsPad.mdb. | EXPLOIT ×2 ✓MEDIUM 5.0EPSS 2.79% | 1 December 2010 |
| CVE-2008-7269 | Open redirect vulnerability in api.php in SiteEngine 5.x allows user-assisted remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the forward parameter in a logout action. | EXPLOIT ✓MEDIUM 5.8EPSS 8.39% | 1 December 2010 |
| CVE-2008-7267 | SQL injection vulnerability in announcements.php in SiteEngine 5.x allows remote attackers to execute arbitrary SQL commands via the id parameter. | EXPLOIT ×2 ✓HIGH 7.5EPSS 1.19% | 1 December 2010 |
| CVE-2010-3858 | The setup_arg_pages function in fs/exec.c in the Linux kernel before 2.6.36, when CONFIG_STACK_GROWSDOWN is used, does not properly restrict the stack memory consumption of the (1) arguments and (2) environment for a 32-bit application on a 64-bit… | EXPLOITMEDIUM 4.9EPSS 0.91% | 30 November 2010 |
| CVE-2010-4249 | The wait_for_unix_gc function in net/unix/garbage.c in the Linux kernel before 2.6.37-rc3-next-20101125 does not properly select times for garbage collection of inflight sockets, which allows local users to cause a denial of service (system hang) via… | EXPLOIT ✓MEDIUM 4.9EPSS 0.89% | 29 November 2010 |
| CVE-2010-4077 | The ntty_ioctl_tiocgicount function in drivers/char/nozomi.c in the Linux kernel 2.6.36.1 and earlier does not properly initialize a certain structure member, which allows local users to obtain potentially sensitive information from kernel stack memory… | EXPLOITLOW 1.9EPSS 1.04% | 29 November 2010 |
| CVE-2010-4073 | The ipc subsystem in the Linux kernel before 2.6.37-rc1 does not initialize certain structures, which allows local users to obtain potentially sensitive information from kernel stack memory via vectors related to the (1) compat_sys_semctl, (2)… | EXPLOIT ✓LOW 1.9EPSS 1.48% | 29 November 2010 |
| CVE-2010-4298 | SQL injection vulnerability in the download module in Free Simple Software 1.0 allows remote attackers to execute arbitrary SQL commands via the downloads_id parameter in a download_now action to index.php. | EXPLOIT ×2 ✓HIGH 7.5EPSS 0.99% | 26 November 2010 |
| CVE-2010-4172 | Multiple cross-site scripting (XSS) vulnerabilities in the Manager application in Apache Tomcat 6.0.12 through 6.0.29 and 7.0.0 through 7.0.4 allow remote attackers to inject arbitrary web script or HTML via the (1) orderBy or (2) sort parameter to… | EXPLOIT ✓MEDIUM 4.3EPSS 42.0% | 26 November 2010 |
| CVE-2010-3830 | Networking in Apple iOS before 4.2 accesses an invalid pointer during the processing of packet filter rules, which allows local users to gain privileges via unspecified vectors. | EXPLOIT ✓HIGH 7.2EPSS 0.69% | 26 November 2010 |
| CVE-2010-4301 | epan/dissectors/packet-zbee-zcl.c in the ZigBee ZCL dissector in Wireshark 1.4.0 through 1.4.1 allows remote attackers to cause a denial of service (infinite loop) via a crafted ZCL packet, related to Discover Attributes. | EXPLOITMEDIUM 5.0EPSS 9.29% | 26 November 2010 |
| CVE-2010-4300 | Heap-based buffer overflow in the dissect_ldss_transfer function (epan/dissectors/packet-ldss.c) in the LDSS dissector in Wireshark 1.2.0 through 1.2.12 and 1.4.0 through 1.4.1 allows remote attackers to cause a denial of service (crash) and possibly… | EXPLOIT ✓HIGH 7.5EPSS 13.8% | 26 November 2010 |
| CVE-2010-2963 | drivers/media/video/v4l2-compat-ioctl32.c in the Video4Linux (V4L) implementation in the Linux kernel before 2.6.36 on 64-bit platforms does not validate the destination of a memory copy operation, which allows local users to write to arbitrary kernel… | EXPLOIT ✓MEDIUM 6.2EPSS 0.82% | 26 November 2010 |
| CVE-2010-4165 | The do_tcp_setsockopt function in net/ipv4/tcp.c in the Linux kernel before 2.6.37-rc2 does not properly restrict TCP_MAXSEG (aka MSS) values, which allows local users to cause a denial of service (OOPS) via a setsockopt call that specifies a small… | EXPLOIT ×2 ✓MEDIUM 4.9EPSS 1.48% | 22 November 2010 |
| CVE-2010-3804 | The JavaScript implementation in WebKit in Apple Safari before 5.0.3 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.3 on Mac OS X 10.4, uses a weak algorithm for generating values of random numbers, which makes it easier for remote attackers… | EXPLOIT ×2 ✓MEDIUM 5.0EPSS 9.13% | 22 November 2010 |
| CVE-2010-4210 | The pfs_getextattr function in FreeBSD 7.x before 7.3-RELEASE and 8.x before 8.0-RC1 unlocks a mutex that was not previously locked, which allows local users to cause a denial of service (kernel panic), overwrite arbitrary memory locations, and possibly… | EXPLOIT ✓HIGH 7.8EPSS 1.13% | 22 November 2010 |
| CVE-2010-4107 | The default configuration of the PJL Access value in the File System External Access settings on HP LaserJet MFP printers, Color LaserJet MFP printers, and LaserJet 4100, 4200, 4300, 5100, 8150, and 9000 printers enables PJL commands that use the… | EXPLOIT ×4 ✓HIGH 7.8EPSS 13.2% | 17 November 2010 |
| CVE-2010-4273 | SQL injection vulnerability in imoveis.php in DescargarVista ACC IMoveis 1.1 allows remote attackers to execute arbitrary SQL commands via the id parameter. | EXPLOIT ✓HIGH 7.5EPSS 1.10% | 17 November 2010 |
| CVE-2010-4272 | SQL injection vulnerability in the Pulse Infotech Sponsor Wall (com_sponsorwall) component 1.1 for Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter to index.php. | EXPLOIT ✓HIGH 7.5EPSS 1.18% | 17 November 2010 |
| CVE-2010-4269 | SQL injection vulnerability in managechat.php in Collabtive 0.65 allows remote attackers to execute arbitrary SQL commands via the chatstart[USERTOID] cookie in a pull action. | EXPLOITHIGH 7.5EPSS 1.10% | 17 November 2010 |
| CVE-2010-4268 | SQL injection vulnerability in the Pulse Infotech Flip Wall (com_flipwall) component 1.1 for Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter to index.php. | EXPLOIT ✓HIGH 7.5EPSS 1.18% | 17 November 2010 |
| CVE-2010-4234 | The web server on the Camtron CMNC-200 Full HD IP Camera and TecVoz CMNC-200 Megapixel IP Camera with firmware 1.102A-008 allows remote attackers to cause a denial of service (device reboot) via a large number of requests in a short time interval. | EXPLOIT ✓HIGH 7.8EPSS 2.98% | 17 November 2010 |
| CVE-2010-4233 | The Linux installation on the Camtron CMNC-200 Full HD IP Camera and TecVoz CMNC-200 Megapixel IP Camera with firmware 1.102A-008 has a default password of m for the root account, and a default password of merlin for the mg3500 account, which makes it… | EXPLOIT ✓HIGH 10.0EPSS 9.44% | 17 November 2010 |
| CVE-2010-4232 | The web-based administration interface on the Camtron CMNC-200 Full HD IP Camera and TecVoz CMNC-200 Megapixel IP Camera with firmware 1.102A-008 allows remote attackers to bypass authentication via a // (slash slash) at the beginning of a URI, as… | EXPLOIT ✓HIGH 10.0EPSS 4.18% | 17 November 2010 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.