Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
The year’s CVE activity with KEV, EPSS and exploit data as a PDF: heatmaps, a vendor treemap, and the lists worth checking against your estate.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
396,633 CVEs1,721 in CISA KEV17,395 with EPSS ≥ 10%25,049 with a public exploitUpdated 23 September 2026
25,049 results · page 188 of 501
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2010-2703 | Stack-based buffer overflow in the execvp_nc function in the ov.dll module in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53, when running on Windows, allows remote attackers to execute arbitrary code via a long HTTP request to webappmon.exe. | EXPLOIT ×2 ✓HIGH 10.0EPSS 71.4% | 28 July 2010 |
| CVE-2010-0211 | The slap_modrdn2mods function in modrdn.c in OpenLDAP 2.4.22 does not check the return value of a call to the smr_normalize function, which allows remote attackers to cause a denial of service (segmentation fault) and possibly execute arbitrary code via… | EXPLOIT ✓CRITICAL 9.8EPSS 28.5% | 28 July 2010 |
| CVE-2010-2858 | Multiple cross-site scripting (XSS) vulnerabilities in news.php in SimpNews 2.47.03 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) layout and (2) sortorder parameters. | EXPLOIT ✓MEDIUM 4.3EPSS 1.72% | 25 July 2010 |
| CVE-2010-2857 | Directory traversal vulnerability in the Music Manager component for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. | EXPLOIT ✓MEDIUM 6.8EPSS 4.85% | 25 July 2010 |
| CVE-2010-2856 | Cross-site scripting (XSS) vulnerability in admin/currencies.php in osCSS 1.2.2, and probably earlier versions, allows remote attackers to inject arbitrary web script or HTML via the page parameter. | EXPLOIT ✓MEDIUM 4.3EPSS 3.35% | 25 July 2010 |
| CVE-2010-2853 | SQL injection vulnerability in flashPlayer/playVideo.php in iScripts VisualCaster allows remote attackers to execute arbitrary SQL commands via the product_id parameter. | EXPLOIT ✓HIGH 7.5EPSS 1.19% | 25 July 2010 |
| CVE-2010-2850 | Directory traversal vulnerability in productionnu2/fileuploader.php in nuBuilder 10.04.20, and possibly other versions before 10.07.12, allows remote attackers to include and execute arbitrary local files via a .. | EXPLOIT ✓MEDIUM 6.8EPSS 2.71% | 25 July 2010 |
| CVE-2010-2848 | Directory traversal vulnerability in assets/captcha/includes/alikon/playcode.php in the InterJoomla ArtForms (com_artforms) component 2.1b7.2 RC2 for Joomla! allows remote attackers to read arbitrary files via a .. | EXPLOIT ✓MEDIUM 5.0EPSS 2.76% | 25 July 2010 |
| CVE-2010-2847 | Multiple SQL injection vulnerabilities in the InterJoomla ArtForms (com_artforms) component 2.1b7.2 RC2 for Joomla! allow remote attackers to execute arbitrary SQL commands via the viewform parameter in a (1) ferforms or (2) tferforms action to… | EXPLOIT ✓HIGH 7.5EPSS 1.99% | 25 July 2010 |
| CVE-2010-2846 | Cross-site scripting (XSS) vulnerability in the InterJoomla ArtForms (com_artforms) component 2.1b7.2 RC2 for Joomla! allows remote attackers to inject arbitrary web script or HTML via the afmsg parameter to index.php. | EXPLOIT ✓MEDIUM 4.3EPSS 1.49% | 25 July 2010 |
| CVE-2010-2845 | SQL injection vulnerability in the QuickFAQ (com_quickfaq) component 1.0.3 for Joomla! allows remote attackers to execute arbitrary SQL commands via the Itemid parameter in a category action to index.php. | EXPLOITHIGH 7.5EPSS 0.97% | 25 July 2010 |
| CVE-2010-2844 | Cross-site scripting (XSS) vulnerability in news_show.php in Newanz NewsOffice 2.0.18 allows remote attackers to inject arbitrary web script or HTML via the n-cat parameter. | EXPLOIT ✓MEDIUM 4.3EPSS 1.50% | 25 July 2010 |
| CVE-2009-4957 | Directory traversal vulnerability in loadpanel.php in Interspire ActiveKB allows remote attackers to read arbitrary files and possibly have unspecified other impact via directory traversal sequences in the Panel parameter. | EXPLOIT ✓HIGH 7.5EPSS 2.36% | 22 July 2010 |
| CVE-2010-2568 | Microsoft Windows Remote Code Execution Vulnerability | KEVEXPLOIT ×2 ✓HIGH 7.8EPSS 91.3% | 22 July 2010 |
| CVE-2009-4940 | SQL injection vulnerability in index.php in Zeus Cart 2.3 and earlier allows remote attackers to execute arbitrary SQL commands via the maincatid parameter in a showmaincatlanding action. | EXPLOIT ✓HIGH 7.5EPSS 0.92% | 22 July 2010 |
| CVE-2009-4939 | Multiple cross-site scripting (XSS) vulnerabilities in index.php in AdPeeps 8.5d1 allow remote attackers to inject arbitrary web script or HTML via the (1) uid parameter, (2) uid parameter in a login_lookup action, (3) uid parameter in an adminlogin… | EXPLOIT ×2 ✓MEDIUM 4.3EPSS 1.93% | 22 July 2010 |
| CVE-2009-4936 | Multiple SQL injection vulnerabilities in Small Pirate (SPirate) 2.1 allow remote attackers to execute arbitrary SQL commands via (1) the id parameter to the default URI in an rss .xml action, or the id parameter to (2) pag1.php, (3) pag1-guest.php, (4)… | EXPLOIT ✓HIGH 7.5EPSS 1.83% | 22 July 2010 |
| CVE-2010-0266 | Microsoft Office Outlook 2002 SP3, 2003 SP3, and 2007 SP1 and SP2 does not properly verify e-mail attachments with a PR_ATTACH_METHOD property value of ATTACH_BY_REFERENCE, which allows user-assisted remote attackers to execute arbitrary code via a… | EXPLOIT ×2 ✓HIGH 9.3EPSS 55.3% | 15 July 2010 |
| CVE-2010-2384 | Unspecified vulnerability in Oracle Solaris 9 and 10 allows local users to affect confidentiality and integrity via unknown vectors related to Solaris Management Console. | EXPLOIT ✓LOW 3.2EPSS 0.64% | 13 July 2010 |
| CVE-2010-2383 | Unspecified vulnerability in Oracle Solaris 8, 9, and 10, and OpenSolaris, allows local users to affect confidentiality and integrity, related to NFS. | EXPLOIT ✓LOW 3.2EPSS 0.68% | 13 July 2010 |
| CVE-2010-2382 | Unspecified vulnerability in Oracle Solaris 8, 9, and 10 allows local users to affect confidentiality and integrity via unknown vectors. | EXPLOIT ✓LOW 3.2EPSS 0.68% | 13 July 2010 |
| CVE-2010-2375 | Package/Privilege: Plugins for Apache, Sun and IIS web servers Unspecified vulnerability in the WebLogic Server component in Oracle Fusion Middleware 7.0 SP7, 8.1 SP6, 9.0, 9.1, 9.2 MP3, 10.0 MP2, 10.3.2, and 10.3.3 allows remote attackers to affect… | EXPLOIT ✓MEDIUM 6.4EPSS 6.51% | 13 July 2010 |
| CVE-2010-2370 | Unspecified vulnerability in the Oracle Business Process Management component in Oracle Fusion Middleware 5.7 MP3, 6.0 MP5, and 10.3 MP2 allows remote attackers to affect integrity, related to BPM. | EXPLOIT ✓MEDIUM 4.3EPSS 3.93% | 13 July 2010 |
| CVE-2010-0916 | Unspecified vulnerability in Oracle OpenSolaris 10 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to rdist. | EXPLOIT ✓MEDIUM 6.2EPSS 0.65% | 13 July 2010 |
| CVE-2010-0904 | Unspecified vulnerability in Oracle Secure Backup 10.3.0.1 allows remote attackers to affect integrity via unknown vectors. | EXPLOIT ✓MEDIUM 5.0EPSS 50.6% | 13 July 2010 |
| CVE-2010-2693 | FreeBSD 7.1 through 8.1-PRERELEASE does not copy the read-only flag when creating a duplicate mbuf buffer reference, which allows local users to cause a denial of service (system file corruption) and gain privileges via the sendfile system call. | EXPLOIT ✓HIGH 7.2EPSS 0.70% | 13 July 2010 |
| CVE-2010-2008 | MySQL before 5.1.48 allows remote authenticated users with alter database privileges to cause a denial of service (server crash and database loss) via an ALTER DATABASE command with a #mysql50# string followed by a . | EXPLOIT ✓LOW 3.5EPSS 9.01% | 13 July 2010 |
| CVE-2010-2721 | SQL injection vulnerability in index.php in RightInPoint Lyrics Script 3.0 allows remote attackers to execute arbitrary SQL commands via the artist_id parameter in an addalbum action. | EXPLOIT ✓HIGH 7.5EPSS 1.19% | 13 July 2010 |
| CVE-2010-2720 | SQL injection vulnerability in list.php in phpaaCms 0.3.1 UTF-8, and possibly other versions, allows remote attackers to execute arbitrary SQL commands via the id parameter. | EXPLOITHIGH 7.5EPSS 1.15% | 13 July 2010 |
| CVE-2010-2719 | SQL injection vulnerability in show.php in phpaaCms 0.3.1 UTF-8, and possibly other versions, allows remote attackers to execute arbitrary SQL commands via the id parameter. | EXPLOITHIGH 7.5EPSS 1.15% | 13 July 2010 |
| CVE-2010-2716 | Multiple SQL injection vulnerabilities in PsNews 1.3 allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) ndetail.php and (2) print.php. | EXPLOITHIGH 7.5EPSS 0.97% | 13 July 2010 |
| CVE-2010-2715 | Cross-site scripting (XSS) vulnerability in photos/index.php in TCW PHP Album 1.0 allows remote attackers to inject arbitrary web script or HTML via the album parameter. | EXPLOIT ✓MEDIUM 4.3EPSS 1.47% | 13 July 2010 |
| CVE-2010-2714 | SQL injection vulnerability in photos/index.php in TCW PHP Album 1.0 allows remote attackers to execute arbitrary SQL commands via the album parameter. | EXPLOIT ✓HIGH 7.5EPSS 0.97% | 13 July 2010 |
| CVE-2010-2701 | Multiple buffer overflows in the FathFTP ActiveX control 1.7 allow remote attackers to execute arbitrary code via (1) the GetFromURL member or (2) a long argument to the RasIsConnected method. | EXPLOIT ×2 ✓HIGH 9.3EPSS 5.06% | 12 July 2010 |
| CVE-2010-2700 | Cross-site scripting (XSS) vulnerability in index.php in Edge PHP Clickbank Affiliate Marketplace Script (CBQuick) allows remote attackers to inject arbitrary web script or HTML via the search parameter. | EXPLOIT ✓MEDIUM 4.3EPSS 1.18% | 12 July 2010 |
| CVE-2010-2699 | SQL injection vulnerability in index.php in Edge PHP Clickbank Affiliate Marketplace Script (CBQuick) allows remote attackers to execute arbitrary SQL commands via the search parameter. | EXPLOIT ✓HIGH 7.5EPSS 0.96% | 12 July 2010 |
| CVE-2010-2698 | Multiple cross-site scripting (XSS) vulnerabilities in Sijio Community Software allow remote authenticated users to inject arbitrary web script or HTML via the title parameter when (1) editing a new blog, (2) adding an album, or (3) editing an album. | EXPLOIT ✓LOW 3.5EPSS 1.24% | 12 July 2010 |
| CVE-2010-2697 | Cross-site scripting (XSS) vulnerability in Sijio Community Software allows remote authenticated users to inject arbitrary web script or HTML via the title parameter when adding a new blog, related to edit_blog/index.php. | EXPLOIT ✓LOW 3.5EPSS 1.33% | 12 July 2010 |
| CVE-2010-2696 | SQL injection vulnerability in gallery/index.php in Sijio Community Software allows remote attackers to execute arbitrary SQL commands via the parent parameter. | EXPLOIT ✓HIGH 7.5EPSS 0.97% | 12 July 2010 |
| CVE-2010-2694 | SQL injection vulnerability in the redSHOP Component (com_redshop) 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the pid parameter to index.php. | EXPLOIT ×2HIGH 7.5EPSS 0.98% | 12 July 2010 |
| CVE-2010-0832 | pam_motd (aka the MOTD module) in libpam-modules before 1.1.0-2ubuntu1.1 in PAM on Ubuntu 9.10 and libpam-modules before 1.1.1-2ubuntu5 in PAM on Ubuntu 10.04 LTS allows local users to change the ownership of arbitrary files via a symlink attack on… | EXPLOIT ×2 ✓MEDIUM 6.9EPSS 0.95% | 12 July 2010 |
| CVE-2010-2691 | Multiple SQL injection vulnerabilities in 2daybiz Custom T-Shirt Design Script allow remote attackers to execute arbitrary SQL commands via the (1) sbid parameter to products_details.php, (2) pid parameter to products/products.php, and (3) designid… | EXPLOIT ✓HIGH 7.5EPSS 1.79% | 12 July 2010 |
| CVE-2010-2690 | SQL injection vulnerability in the JOOFORGE Gamesbox (com_gamesbox) component 1.0.2, and possibly earlier, for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a consoles action to index.php. | EXPLOITHIGH 7.5EPSS 0.93% | 12 July 2010 |
| CVE-2010-2689 | SQL injection vulnerability in cont_form.php in Internet DM WebDM CMS allows remote attackers to execute arbitrary SQL commands via the cf_id parameter. | EXPLOIT ✓HIGH 7.5EPSS 0.97% | 12 July 2010 |
| CVE-2010-2688 | SQL injection vulnerability in detail.asp in Site2Nite Boat Classifieds allows remote attackers to execute arbitrary SQL commands via the ID parameter. | EXPLOIT ✓HIGH 7.5EPSS 1.19% | 12 July 2010 |
| CVE-2010-2687 | SQL injection vulnerability in printdetail.asp in Site2Nite Boat Classifieds allows remote attackers to execute arbitrary SQL commands via the Id parameter. | EXPLOIT ×2 ✓HIGH 7.5EPSS 1.16% | 12 July 2010 |
| CVE-2010-2685 | siteadmin/adduser.php in Customer Paradigm PageDirector CMS does not properly restrict access, which allows remote attackers to bypass intended restrictions and add administrative users via a direct request. | EXPLOIT ✓HIGH 7.5EPSS 2.40% | 12 July 2010 |
| CVE-2010-2684 | SQL injection vulnerability in index.php in Customer Paradigm PageDirector CMS allows remote attackers to execute arbitrary SQL commands via the id parameter. | EXPLOIT ✓HIGH 7.5EPSS 1.19% | 12 July 2010 |
| CVE-2010-2683 | SQL injection vulnerability in result.php in Customer Paradigm PageDirector CMS allows remote attackers to execute arbitrary SQL commands via the sub_catid parameter. | EXPLOIT ✓HIGH 7.5EPSS 1.00% | 12 July 2010 |
| CVE-2010-2682 | Directory traversal vulnerability in the Realtyna Translator (com_realtyna) component 1.0.15 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. | EXPLOITHIGH 7.5EPSS 14.3% | 12 July 2010 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.