Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
The year’s CVE activity with KEV, EPSS and exploit data as a PDF: heatmaps, a vendor treemap, and the lists worth checking against your estate.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
396,587 CVEs1,721 in CISA KEV17,395 with EPSS ≥ 10%25,049 with a public exploitUpdated 23 September 2026
25,049 results · page 186 of 501
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2010-3143 | Untrusted search path vulnerability in Microsoft Windows Contacts allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse wab32res.dll that is located in the same folder as a… | EXPLOIT ×3 ✓HIGH 9.3EPSS 20.8% | 27 August 2010 |
| CVE-2010-3142 | Untrusted search path vulnerability in Microsoft Office PowerPoint 2007 allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse rpawinet.dll that is located in the same folder as… | EXPLOIT ×2HIGH 9.3EPSS 16.3% | 27 August 2010 |
| CVE-2010-3141 | Untrusted search path vulnerability in Microsoft PowerPoint 2010 allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse pptimpconv.dll that is located in the same folder as a… | EXPLOIT ×2HIGH 9.3EPSS 15.4% | 27 August 2010 |
| CVE-2010-3140 | Untrusted search path vulnerability in Microsoft Windows Internet Communication Settings on Windows XP SP3 allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse schannel.dll… | EXPLOIT ✓HIGH 9.3EPSS 15.1% | 27 August 2010 |
| CVE-2010-3139 | Untrusted search path vulnerability in Microsoft Windows Progman Group Converter (grpconv.exe) allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse imm.dll that is located in… | EXPLOIT ✓HIGH 9.3EPSS 23.5% | 27 August 2010 |
| CVE-2010-3138 | Untrusted search path vulnerability in the Indeo Codec in iac25_32.ax in Microsoft Windows XP SP3 allows local users to gain privileges via a Trojan horse iacenc.dll file in the current working directory, as demonstrated by access through BS.Player or… | EXPLOIT ×2 ✓HIGH 9.3EPSS 27.3% | 27 August 2010 |
| CVE-2010-2866 | Integer signedness error in the DIRAPI module in Adobe Shockwave Player before 11.5.8.612 allows remote attackers to cause a denial of service (memory corruption) or execute arbitrary code via a count value associated with an "undocumented structure"… | EXPLOIT ✓HIGH 9.3EPSS 13.0% | 26 August 2010 |
| CVE-2010-3137 | Untrusted search path vulnerability in Nullsoft Winamp 5.581, and probably other versions, allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse wnaspi32.dll that is located in… | EXPLOIT ✓HIGH 9.3EPSS 7.83% | 26 August 2010 |
| CVE-2010-3136 | Untrusted search path vulnerability in Skype 4.2.0.169 and earlier allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse wab32.dll that is located in the same folder as a .skype… | EXPLOIT ✓HIGH 9.3EPSS 6.91% | 26 August 2010 |
| CVE-2010-3135 | Untrusted search path vulnerability in Cisco Packet Tracer 5.2 allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse wintab32.dll that is located in the same folder as a .pkt or… | EXPLOITHIGH 9.3EPSS 8.24% | 26 August 2010 |
| CVE-2010-3134 | Untrusted search path vulnerability in Google Earth 5.1.3535.3218 allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse quserex.dll that is located in the same folder as a .kmz… | EXPLOIT ✓HIGH 9.3EPSS 3.79% | 26 August 2010 |
| CVE-2010-3133 | Untrusted search path vulnerability in Wireshark 0.8.4 through 1.0.15 and 1.2.0 through 1.2.10 allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse airpcap.dll, and possibly… | EXPLOIT ✓HIGH 9.3EPSS 8.62% | 26 August 2010 |
| CVE-2010-3132 | Untrusted search path vulnerability in Adobe Dreamweaver CS5 11.0 build 4916, build 4909, and probably other versions, allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse (1)… | EXPLOIT ×2HIGH 9.3EPSS 14.0% | 26 August 2010 |
| CVE-2010-3131 | Untrusted search path vulnerability in Mozilla Firefox before 3.5.12 and 3.6.x before 3.6.9, Thunderbird before 3.0.7 and 3.1.x before 3.1.3, and SeaMonkey before 2.0.7 on Windows XP allows local users, and possibly remote attackers, to execute… | EXPLOIT ×2 ✓HIGH 9.3EPSS 22.9% | 26 August 2010 |
| CVE-2010-3130 | Untrusted search path vulnerability in TechSmith Snagit all versions 10.x and 11.x allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse dwmapi.dll that is located in the same… | EXPLOIT ✓HIGH 9.3EPSS 7.83% | 26 August 2010 |
| CVE-2010-3129 | Untrusted search path vulnerability in uTorrent 2.0.3 and earlier allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse plugin_dll.dll, userenv.dll, shfolder.dll, dnsapi.dll,… | EXPLOIT ×2 ✓HIGH 9.3EPSS 7.26% | 26 August 2010 |
| CVE-2010-3128 | Untrusted search path vulnerability in TeamViewer 5.0.8703 and earlier allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse dwmapi.dll that is located in the same folder as a… | EXPLOITHIGH 9.3EPSS 8.36% | 26 August 2010 |
| CVE-2010-3127 | Untrusted search path vulnerability in Adobe PhotoShop CS2 through CS5 allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse dwmapi.dll or Wintab32.dll that is located in the… | EXPLOITHIGH 9.3EPSS 13.9% | 26 August 2010 |
| CVE-2010-3126 | Untrusted search path vulnerability in avast! | EXPLOITHIGH 9.3EPSS 7.83% | 26 August 2010 |
| CVE-2010-3125 | Untrusted search path vulnerability in TeamMate Audit Management Software Suite 8.0 patch 2 allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse mfc71enu.dll that is located in… | EXPLOITHIGH 9.3EPSS 5.81% | 26 August 2010 |
| CVE-2010-3124 | Untrusted search path vulnerability in bin/winvlc.c in VLC Media Player 1.1.3 and earlier allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse wintab32.dll that is located in… | EXPLOITHIGH 9.3EPSS 12.5% | 26 August 2010 |
| CVE-2009-4993 | PHP remote file inclusion vulnerability in home.php in LM Starmail Paidmail 2.0 allows remote attackers to execute arbitrary PHP code via a URL in the page parameter. | EXPLOIT ✓HIGH 7.5EPSS 2.14% | 25 August 2010 |
| CVE-2009-4992 | SQL injection vulnerability in paidbanner.php in LM Starmail Paidmail 2.0 allows remote attackers to execute arbitrary SQL commands via the ID parameter. | EXPLOIT ✓HIGH 7.5EPSS 0.95% | 25 August 2010 |
| CVE-2009-4991 | Cross-site scripting (XSS) vulnerability in users/resume_register.php in Omnistar Recruiting allows remote attackers to inject arbitrary web script or HTML via the job2 parameter. | EXPLOIT ✓MEDIUM 4.3EPSS 1.27% | 25 August 2010 |
| CVE-2009-4989 | Cross-site scripting (XSS) vulnerability in index.php in AJ Auction Pro OOPD 3.0 allows remote attackers to inject arbitrary web script or HTML via the txtkeyword parameter in a search action. | EXPLOIT ✓MEDIUM 4.3EPSS 1.48% | 25 August 2010 |
| CVE-2009-4988 | Stack-based buffer overflow in NT_Naming_Service.exe in SAP Business One 2005 A 6.80.123 and 6.80.320 allows remote attackers to execute arbitrary code via a long GIOP request to TCP port 30000. | EXPLOIT ×2 ✓HIGH 10.0EPSS 65.5% | 25 August 2010 |
| CVE-2009-4987 | admin/header.php in Scripteen Free Image Hosting Script 2.3 allows remote attackers to bypass authentication and gain administrative access by setting the cookgid cookie value to 1, a different vector than CVE-2008-3211. | EXPLOIT ✓HIGH 7.5EPSS 6.43% | 25 August 2010 |
| CVE-2009-4986 | Directory traversal vulnerability in index.php in In-Portal 4.3.1, when magic_quotes_gpc is disabled, allows remote attackers to read arbitrary files via a .. | EXPLOIT ✓MEDIUM 6.8EPSS 2.04% | 25 August 2010 |
| CVE-2009-4985 | SQL injection vulnerability in browse.php in Accessories Me PHP Affiliate Script 1.4 allows remote attackers to execute arbitrary SQL commands via the Go parameter. | EXPLOIT ✓HIGH 7.5EPSS 0.95% | 25 August 2010 |
| CVE-2009-4984 | Multiple cross-site scripting (XSS) vulnerabilities in Accessories Me PHP Affiliate Script 1.4 allow remote attackers to inject arbitrary web script or HTML via the (1) Keywords parameter to search.php and (2) SearchIndex parameter to browse.php. | EXPLOIT ✓MEDIUM 4.3EPSS 1.27% | 25 August 2010 |
| CVE-2009-4983 | Multiple cross-site scripting (XSS) vulnerabilities in Silurus Classifieds 1.0 allow remote attackers to inject arbitrary web script or HTML via the ID parameter to (1) category.php and (2) wcategory.php, and the (3) keywords parameter to search.php. | EXPLOIT ×3 ✓MEDIUM 4.3EPSS 1.29% | 25 August 2010 |
| CVE-2009-4982 | SQL injection vulnerability in the select function in Irokez CMS 0.7.1, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the PATH_INFO to the default URI. | EXPLOIT ✓MEDIUM 6.8EPSS 0.91% | 25 August 2010 |
| CVE-2009-4978 | Directory traversal vulnerability in down.php in MyBackup 1.4.0 allows remote attackers to read arbitrary files via a .. | EXPLOIT ✓MEDIUM 5.0EPSS 2.92% | 25 August 2010 |
| CVE-2009-4977 | PHP remote file inclusion vulnerability in index.php in MyBackup 1.4.0 allows remote authenticated users to execute arbitrary PHP code via a URL in the main_content parameter. | EXPLOIT ✓MEDIUM 6.5EPSS 2.09% | 25 August 2010 |
| CVE-2010-3106 | The ienipp.ocx ActiveX control in the browser plugin in Novell iPrint Client before 5.42 does not properly validate the debug parameter, which allows remote attackers to execute arbitrary code or cause a denial of service (stack memory corruption) via a… | EXPLOIT ×2 ✓HIGH 9.3EPSS 37.3% | 23 August 2010 |
| CVE-2010-2544 | Cross-site scripting (XSS) vulnerability in utilities.php in Cacti before 0.8.7g, as used in Red Hat High Performance Computing (HPC) Solution and other products, allows remote attackers to inject arbitrary web script or HTML via the filter parameter. | EXPLOIT ✓MEDIUM 4.3EPSS 4.31% | 23 August 2010 |
| CVE-2010-2543 | Cross-site scripting (XSS) vulnerability in include/top_graph_header.php in Cacti before 0.8.7g allows remote attackers to inject arbitrary web script or HTML via the graph_start parameter to graph.php. | EXPLOIT ✓MEDIUM 4.3EPSS 3.87% | 23 August 2010 |
| CVE-2010-1527 | Stack-based buffer overflow in Novell iPrint Client before 5.44 allows remote attackers to execute arbitrary code via a long call-back-url parameter in an op-client-interface-version action. | EXPLOIT ×2 ✓HIGH 9.3EPSS 36.0% | 23 August 2010 |
| CVE-2008-7258 | The standardise function in Anibal Monsalve Salazar sSMTP 2.61 and 2.62 allows local users to cause a denial of service (application exit) via an e-mail message containing a long line that begins with a . | EXPLOIT ✓LOW 2.1EPSS 1.05% | 20 August 2010 |
| CVE-2010-2809 | The default configuration of the <Button2> binding in Uzbl before 2010.08.05 does not properly use the @SELECTED_URI feature, which allows user-assisted remote attackers to execute arbitrary commands via a crafted HREF attribute of an A element in an… | EXPLOIT ✓MEDIUM 6.8EPSS 7.34% | 19 August 2010 |
| CVE-2010-3030 | Cross-site request forgery (CSRF) vulnerability in Tomaz Muraus Open Blog 1.2.1, and possibly earlier, allows remote attackers to hijack the authentication of administrators for requests that change the administrative password. | EXPLOITMEDIUM 6.8EPSS 0.83% | 17 August 2010 |
| CVE-2010-2939 | Double free vulnerability in the ssl3_get_key_exchange function in the OpenSSL client (ssl/s3_clnt.c) in OpenSSL 1.0.0a, 0.9.8, 0.9.7, and possibly other versions, when using ECDH, allows context-dependent attackers to cause a denial of service (crash)… | EXPLOIT ✓MEDIUM 4.3EPSS 9.98% | 17 August 2010 |
| CVE-2010-1870 | The OGNL extensive expression evaluation capability in XWork in Struts 2.0.0 through 2.1.8.1, as used in Atlassian Fisheye, Crucible, and possibly other products, uses a permissive whitelist, which allows remote attackers to modify server-side context… | EXPLOIT ×2 ✓MEDIUM 5.0EPSS 92.0% | 17 August 2010 |
| CVE-2010-3029 | SQL injection vulnerability in statistics.php in PHPKick 0.8 allows remote attackers to execute arbitrary SQL commands via the gameday parameter in an overview action. | EXPLOIT ✓HIGH 7.5EPSS 0.92% | 16 August 2010 |
| CVE-2010-3027 | SQL injection vulnerability in index.php in Tycoon Baseball Script 1.0.9 allows remote attackers to execute arbitrary SQL commands via the game_id parameter in a game_player action. | EXPLOIT ✓HIGH 7.5EPSS 1.00% | 16 August 2010 |
| CVE-2010-3026 | Cross-site request forgery (CSRF) vulnerability in application/modules/admin/controllers/users.php in Tomaz Muraus Open Blog 1.2.1, and possibly earlier, allows remote attackers to hijack the authentication of administrators for requests to… | EXPLOITMEDIUM 4.3EPSS 2.20% | 16 August 2010 |
| CVE-2010-3024 | Multiple cross-site request forgery (CSRF) vulnerabilities in user/main/update_user in DiamondList 0.1.6, and possibly earlier, allow remote attackers to hijack the authentication of administrators for requests that (1) change the administrative… | EXPLOIT ✓MEDIUM 6.8EPSS 1.44% | 16 August 2010 |
| CVE-2010-3023 | Multiple cross-site scripting (XSS) vulnerabilities in DiamondList 0.1.6, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via the (1) category[description] parameter to user/main/update_category, which is not properly… | EXPLOIT ×2 ✓MEDIUM 4.3EPSS 2.57% | 16 August 2010 |
| CVE-2010-1799 | Stack-based buffer overflow in the error-logging functionality in Apple QuickTime before 7.6.7 on Windows allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted movie file. | EXPLOIT ✓HIGH 9.3EPSS 33.7% | 16 August 2010 |
| CVE-2010-1797 | Multiple stack-based buffer overflows in the cff_decoder_parse_charstrings function in the CFF Type2 CharStrings interpreter in cff/cffgload.c in FreeType before 2.4.2, as used in Apple iOS before 4.0.2 on the iPhone and iPod touch and before 3.2.2 on… | EXPLOIT ×2 ✓HIGH 9.3EPSS 30.7% | 16 August 2010 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.