Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
The year’s CVE activity with KEV, EPSS and exploit data as a PDF: heatmaps, a vendor treemap, and the lists worth checking against your estate.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
396,587 CVEs1,721 in CISA KEV17,395 with EPSS ≥ 10%25,049 with a public exploitUpdated 23 September 2026
25,049 results · page 185 of 501
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2010-3324 | The toStaticHTML function in Microsoft Internet Explorer 8, and the SafeHTML function in Microsoft Windows SharePoint Services 3.0 SP2, SharePoint Foundation 2010, Office SharePoint Server 2007 SP2, Groove Server 2010, and Office Web Apps, allows remote… | EXPLOIT ✓MEDIUM 4.3EPSS 25.0% | 17 September 2010 |
| CVE-2010-3073 | SSL_Cipher.cpp in EncFS before 1.7.0 does not properly handle integer data sizes when constructing headers intended for randomization of initialization vectors, which makes it easier for local users to obtain sensitive information by defeating… | EXPLOIT ✓LOW 2.1EPSS 0.71% | 17 September 2010 |
| CVE-2010-3428 | SQL injection vulnerability in modules/notes/json.php in Intermesh Group-Office 3.5.9 allows remote attackers to execute arbitrary SQL commands via the category_id parameter in a category action. | EXPLOIT ✓HIGH 7.5EPSS 0.96% | 16 September 2010 |
| CVE-2010-3426 | Directory traversal vulnerability in jphone.php in the JPhone (com_jphone) component 1.0 Alpha 3 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. | EXPLOIT ✓HIGH 7.5EPSS 13.9% | 16 September 2010 |
| CVE-2010-3425 | Cross-site scripting (XSS) vulnerability in UserControls/Popups/frmHelp.aspx in SmarterStats 5.3, 5.3.3819, and possibly other 5.3 versions, allows remote attackers to inject arbitrary web script or HTML via the url parameter. | EXPLOIT ✓MEDIUM 4.3EPSS 1.45% | 16 September 2010 |
| CVE-2010-3422 | SQL injection vulnerability in the JGen (com_jgen) component 0.9.33 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a view action to index.php. | EXPLOIT ✓HIGH 7.5EPSS 0.91% | 16 September 2010 |
| CVE-2010-3419 | Multiple PHP remote file inclusion vulnerabilities in Haudenschilt Family Connections CMS (FCMS) 2.2.3 allow remote attackers to execute arbitrary PHP code via a URL in the current_user_id parameter to (1) familynews.php and (2) settings.php. | EXPLOITHIGH 7.5EPSS 2.29% | 16 September 2010 |
| CVE-2010-3407 | Stack-based buffer overflow in the MailCheck821Address function in nnotes.dll in the nrouter.exe service in the server in IBM Lotus Domino 8.0.x before 8.0.2 FP5 and 8.5.x before 8.5.1 FP2 allows remote attackers to execute arbitrary code via a long… | EXPLOIT ×2 ✓HIGH 9.3EPSS 41.5% | 16 September 2010 |
| CVE-2010-3404 | Multiple SQL injection vulnerabilities in eshtery CMS (aka eshtery.com) allow remote attackers to execute arbitrary SQL commands via the (1) Criteria field in an unspecified form related to catlgsearch.aspx or (2) user name to an unspecified form… | EXPLOIT ✓HIGH 7.5EPSS 0.96% | 16 September 2010 |
| CVE-2010-3171 | The Math.random function in the JavaScript implementation in Mozilla Firefox 3.5.10 through 3.5.11, 3.6.4 through 3.6.8, and 4.0 Beta1 uses a random number generator that is seeded only once per document object, which makes it easier for remote… | EXPLOIT ✓MEDIUM 5.8EPSS 4.50% | 15 September 2010 |
| CVE-2010-2738 | The Uniscribe (aka new Unicode Script Processor) implementation in USP10.DLL in Microsoft Windows XP SP2 and SP3, Server 2003 SP2, Vista SP1 and SP2, and Server 2008 Gold and SP2, and Microsoft Office XP SP3, 2003 SP3, and 2007 SP2, does not properly… | EXPLOIT ✓HIGH 9.3EPSS 18.5% | 15 September 2010 |
| CVE-2010-2731 | Unspecified vulnerability in Microsoft Internet Information Services (IIS) 5.1 on Windows XP SP3, when directory-based Basic Authentication is enabled, allows remote attackers to bypass intended access restrictions and execute ASP files via a crafted… | EXPLOIT ✓MEDIUM 6.8EPSS 31.1% | 15 September 2010 |
| CVE-2010-2729 | The Print Spooler service in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7, when printer sharing is enabled, does not properly validate spooler access… | EXPLOIT ✓HIGH 9.3EPSS 75.6% | 15 September 2010 |
| CVE-2010-1899 | Stack consumption vulnerability in the ASP implementation in Microsoft Internet Information Services (IIS) 5.1, 6.0, 7.0, and 7.5 allows remote attackers to cause a denial of service (daemon outage) via a crafted request, related to asp.dll, aka "IIS… | EXPLOIT ✓MEDIUM 4.3EPSS 57.2% | 15 September 2010 |
| CVE-2010-3396 | Buffer overflow in kavfm.sys in Kingsoft Antivirus 2010.04.26.648 and earlier allows local users to execute arbitrary code via a long argument to IOCTL 0x80030004. | EXPLOIT ✓HIGH 7.2EPSS 1.12% | 15 September 2010 |
| CVE-2010-2961 | mountall.c in mountall before 2.15.2 uses 0666 permissions for the root.rules file, which allows local users to gain privileges by modifying this file. | EXPLOIT ✓MEDIUM 6.9EPSS 0.47% | 14 September 2010 |
| CVE-2010-3202 | Cross-site scripting (XSS) vulnerability in Flock Browser 3.0.0.3989 allows remote attackers to inject arbitrary web script or HTML via a crafted bookmark. | EXPLOIT ✓MEDIUM 4.3EPSS 1.44% | 13 September 2010 |
| CVE-2010-1807 | WebKit in Apple Safari 4.x before 4.1.2 and 5.x before 5.0.2; Android before 2.2; and webkitgtk before 1.2.6; does not properly validate floating-point data, which allows remote attackers to execute arbitrary code or cause a denial of service… | EXPLOIT ×2 ✓HIGH 9.3EPSS 61.3% | 10 September 2010 |
| CVE-2010-3003 | Cross-site scripting (XSS) vulnerability in HP Insight Diagnostics Online Edition before 8.5.0-11 on Linux allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. | EXPLOIT ×5 ✓MEDIUM 4.3EPSS 4.79% | 10 September 2010 |
| CVE-2010-3007 | Unspecified vulnerability in HP Data Protector Express, and Data Protector Express Single Server Edition (SSE), 3.x before build 56936 and 4.x before build 56906 allows local users to gain privileges or cause a denial of service via unknown vectors. | EXPLOIT ✓HIGH 7.2EPSS 5.52% | 9 September 2010 |
| CVE-2010-2883 | Adobe Acrobat and Reader Stack-Based Buffer Overflow Vulnerability | KEVEXPLOIT ×2 ✓HIGH 7.3EPSS 82.4% | 9 September 2010 |
| CVE-2010-1813 | WebKit in Apple iOS before 4.1 on the iPhone and iPod touch allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors involving HTML object outlines. | EXPLOIT ✓MEDIUM 6.8EPSS 9.69% | 9 September 2010 |
| CVE-2010-2959 | Integer overflow in net/can/bcm.c in the Controller Area Network (CAN) implementation in the Linux kernel before 2.6.27.53, 2.6.32.x before 2.6.32.21, 2.6.34.x before 2.6.34.6, and 2.6.35.x before 2.6.35.4 allows attackers to execute arbitrary code or… | EXPLOIT ✓HIGH 7.2EPSS 3.75% | 8 September 2010 |
| CVE-2010-3213 | Cross-site request forgery (CSRF) vulnerability in Microsoft Outlook Web Access (owa/ev.owa) 2007 through SP2 allows remote attackers to hijack the authentication of e-mail users for requests that perform Outlook requests, as demonstrated by setting the… | EXPLOIT ✓MEDIUM 6.8EPSS 8.38% | 7 September 2010 |
| CVE-2010-2739 | Buffer overflow in the CreateDIBPalette function in win32k.sys in Microsoft Windows XP SP3, Server 2003 R2 Enterprise SP2, Vista Business SP1, Windows 7, and Server 2008 SP2 allows local users to cause a denial of service (crash) and possibly execute… | EXPLOIT ✓HIGH 7.2EPSS 3.74% | 7 September 2010 |
| CVE-2010-3212 | SQL injection vulnerability in index.php in Seagull 0.6.7 and earlier allows remote attackers to execute arbitrary SQL commands via the frmQuestion parameter in a retrieve action, in conjunction with a user/password PATH_INFO. | EXPLOIT ✓HIGH 7.5EPSS 1.00% | 3 September 2010 |
| CVE-2010-3211 | Multiple SQL injection vulnerabilities in the JE FAQ Pro (com_jefaqpro) component 1.5.0 for Joomla! allow remote attackers to execute arbitrary SQL commands via category categorylist operations with (1) the catid parameter or (2) the catid parameter in… | EXPLOIT ✓HIGH 7.5EPSS 0.96% | 3 September 2010 |
| CVE-2010-3210 | Multiple PHP remote file inclusion vulnerabilities in Multi-lingual E-Commerce System 0.2 allow remote attackers to execute arbitrary PHP code via a URL in the include_path parameter to (1) checkout2-CYM.php, (2) checkout2-EN.php, (3) checkout2-FR.php,… | EXPLOITHIGH 7.5EPSS 2.29% | 3 September 2010 |
| CVE-2010-3209 | Multiple PHP remote file inclusion vulnerabilities in Seagull 0.6.7 allow remote attackers to execute arbitrary PHP code via a URL in the includeFile parameter to (1) Config/Container.php and (2) HTML/QuickForm.php in fog/lib/pear/, the (3) driverpath… | EXPLOITHIGH 7.5EPSS 2.29% | 3 September 2010 |
| CVE-2010-3207 | SQL injection vulnerability in index.php in GaleriaSHQIP 1.0, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the album_id parameter. | EXPLOIT ✓MEDIUM 6.8EPSS 1.08% | 3 September 2010 |
| CVE-2010-3206 | Multiple PHP remote file inclusion vulnerabilities in DiY-CMS 1.0 allow remote attackers to execute arbitrary PHP code via a URL in the (1) lang parameter to modules/guestbook/blocks/control.block.php, (2) main_module parameter to index.php, and (3)… | EXPLOITHIGH 7.5EPSS 2.29% | 3 September 2010 |
| CVE-2010-3205 | PHP remote file inclusion vulnerability in index.php in Textpattern CMS 4.2.0 allows remote attackers to execute arbitrary PHP code via a URL in the inc parameter. | EXPLOITHIGH 7.5EPSS 2.87% | 3 September 2010 |
| CVE-2010-3204 | Multiple PHP remote file inclusion vulnerabilities in Pecio CMS 2.0.5 allow remote attackers to execute arbitrary PHP code via a URL in the template parameter to (1) post.php, (2) article.php, (3) blog.php, or (4) home.php in pec_templates/nova-blue/. | EXPLOITHIGH 7.5EPSS 2.29% | 3 September 2010 |
| CVE-2010-3203 | Directory traversal vulnerability in the PicSell (com_picsell) component 1.0 for Joomla! allows remote attackers to read arbitrary files via a .. | EXPLOIT ✓MEDIUM 5.0EPSS 8.52% | 3 September 2010 |
| CVE-2010-3189 | The extSetOwner function in the UfProxyBrowserCtrl ActiveX control (UfPBCtrl.dll) in Trend Micro Internet Security Pro 2010 allows remote attackers to execute arbitrary code via an invalid address that is dereferenced as a pointer. | EXPLOIT ✓HIGH 9.3EPSS 39.2% | 31 August 2010 |
| CVE-2010-1818 | The IPersistPropertyBag2::Read function in QTPlugin.ocx in Apple QuickTime 6.x, 7.x before 7.6.8, and other versions allows remote attackers to execute arbitrary code via the _Marshaled_pUnk attribute, which triggers unmarshalling of an untrusted pointer. | EXPLOIT ×2 ✓HIGH 9.3EPSS 42.7% | 31 August 2010 |
| CVE-2010-3187 | Buffer overflow in ftpd in IBM AIX 5.3 and earlier allows remote attackers to execute arbitrary code via a long NLST command. | EXPLOIT ×2 ✓HIGH 10.0EPSS 20.0% | 30 August 2010 |
| CVE-2010-3000 | Multiple integer overflows in the ParseKnownType function in RealNetworks RealPlayer 11.0 through 11.1 and RealPlayer SP 1.0 through 1.1.4 on Windows allow remote attackers to execute arbitrary code via crafted (1) HX_FLV_META_AMF_TYPE_MIXEDARRAY or (2)… | EXPLOIT ✓HIGH 9.3EPSS 7.50% | 30 August 2010 |
| CVE-2010-3155 | Untrusted search path vulnerability in Adobe ExtendScript Toolkit (ESTK) CS5 3.5.0.52 allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse dwmapi.dll that is located in the… | EXPLOIT ✓HIGH 9.3EPSS 12.2% | 27 August 2010 |
| CVE-2010-3154 | Untrusted search path vulnerability in Adobe Extension Manager CS5 5.0.298 allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse dwmapi.dll that is located in the same folder as… | EXPLOIT ✓HIGH 9.3EPSS 11.3% | 27 August 2010 |
| CVE-2010-3153 | Untrusted search path vulnerability in Adobe InDesign CS4 6.0, InDesign CS5 7.0.2 and earlier, Adobe InDesign Server CS5 7.0.2 and earlier, and Adobe InCopy CS5 7.0.2 and earlier allows local users, and possibly remote attackers, to execute arbitrary… | EXPLOITHIGH 9.3EPSS 13.6% | 27 August 2010 |
| CVE-2010-3152 | Untrusted search path vulnerability in Adobe Illustrator CS4 14.0.0, CS5 15.0.1 and earlier, and possibly other versions allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse… | EXPLOITHIGH 9.3EPSS 16.8% | 27 August 2010 |
| CVE-2010-3151 | Untrusted search path vulnerability in Adobe On Location CS4 Build 315 allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse ibfs32.dll that is located in the same folder as an… | EXPLOITHIGH 9.3EPSS 15.1% | 27 August 2010 |
| CVE-2010-3150 | Untrusted search path vulnerability in Adobe Premier Pro CS4 4.0.0 (314 (MC: 160820)) allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse ibfs32.dll that is located in the… | EXPLOITHIGH 9.3EPSS 15.1% | 27 August 2010 |
| CVE-2010-3149 | Untrusted search path vulnerability in Adobe Device Central CS5 3.0.0(376), 3.0.1.0 (3027), and probably other versions allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse… | EXPLOITHIGH 9.3EPSS 13.6% | 27 August 2010 |
| CVE-2010-3148 | Untrusted search path vulnerability in Microsoft Visio 2003 SP3 allows local users to gain privileges via a Trojan horse mfc71enu.dll file in the current working directory, as demonstrated by a directory that contains a .vsd, .vdx, .vst, or .vtx file,… | EXPLOITHIGH 9.3EPSS 13.6% | 27 August 2010 |
| CVE-2010-3147 | Untrusted search path vulnerability in wab.exe 6.00.2900.5512 in Windows Address Book in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 allows local users to… | EXPLOIT ×3 ✓HIGH 9.3EPSS 18.7% | 27 August 2010 |
| CVE-2010-3146 | Multiple untrusted search path vulnerabilities in Microsoft Groove 2007 SP2 allow local users to gain privileges via a Trojan horse (1) mso.dll or (2) GroovePerfmon.dll file in the current working directory, as demonstrated by a directory that contains… | EXPLOITHIGH 9.3EPSS 13.7% | 27 August 2010 |
| CVE-2010-3145 | Untrusted search path vulnerability in the BitLocker Drive Encryption API, as used in sdclt.exe in Backup Manager in Microsoft Windows Vista SP1 and SP2, allows local users to gain privileges via a Trojan horse fveapi.dll file in the current working… | EXPLOITHIGH 9.3EPSS 10.9% | 27 August 2010 |
| CVE-2010-3144 | Untrusted search path vulnerability in the Internet Connection Signup Wizard in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 allows local users to gain privileges via a Trojan horse smmscrpt.dll file in the current working directory, as… | EXPLOIT ✓HIGH 9.3EPSS 13.6% | 27 August 2010 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.