Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
The year’s CVE activity with KEV, EPSS and exploit data as a PDF: heatmaps, a vendor treemap, and the lists worth checking against your estate.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
397,434 CVEs1,723 in CISA KEV17,397 with EPSS ≥ 10%25,049 with a public exploitUpdated 24 September 2026
25,049 results · page 200 of 501
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2010-1130 | session.c in the session extension in PHP before 5.2.13, and 5.3.1, does not properly interpret ; (semicolon) characters in the argument to the session_save_path function, which allows context-dependent attackers to bypass open_basedir and safe_mode… | EXPLOIT ✓MEDIUM 5.0EPSS 9.37% | 26 March 2010 |
| CVE-2010-1128 | The Linear Congruential Generator (LCG) in PHP before 5.2.13 does not provide the expected entropy, which makes it easier for context-dependent attackers to guess values that were intended to be unpredictable, as demonstrated by session cookies… | EXPLOIT ✓MEDIUM 6.4EPSS 7.94% | 26 March 2010 |
| CVE-2009-4752 | PHP remote file inclusion vulnerability in anzeiger/start.php in Swinger Club Portal allows remote attackers to execute arbitrary PHP code via a URL in the go parameter. | EXPLOIT ✓HIGH 7.5EPSS 3.14% | 26 March 2010 |
| CVE-2009-4751 | SQL injection vulnerability in anzeiger/start.php in Swinger Club Portal allows remote attackers to execute arbitrary SQL commands via the id parameter in a rubrik action. | EXPLOIT ✓HIGH 7.5EPSS 1.00% | 26 March 2010 |
| CVE-2009-4750 | PHP remote file inclusion vulnerability in home.php in Top Paidmailer allows remote attackers to execute arbitrary PHP code via a URL in the page parameter. | EXPLOIT ✓MEDIUM 6.8EPSS 2.28% | 26 March 2010 |
| CVE-2009-4749 | Multiple SQL injection vulnerabilities in PHP Live! | EXPLOIT ✓HIGH 7.5EPSS 1.00% | 26 March 2010 |
| CVE-2009-4748 | SQL injection vulnerability in mycategoryorder.php in the My Category Order plugin 2.8 and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the parentID parameter in an act_OrderCategories action to… | EXPLOIT ✓HIGH 7.5EPSS 2.74% | 26 March 2010 |
| CVE-2009-4747 | PHP remote file inclusion vulnerability in public/code/cp_html2xhtmlbasic.php in All In One Control Panel (AIOCP) 1.4.001 allows remote attackers to execute arbitrary PHP code via a URL in the page parameter, a different vector than CVE-2009-3220. | EXPLOIT ✓HIGH 7.5EPSS 3.04% | 26 March 2010 |
| CVE-2009-4746 | Cross-site scripting (XSS) vulnerability in index.php in Dreamlevels DreamPoll 3.1 allows remote attackers to inject arbitrary web script or HTML via the recordsPerPage parameter in a poll_default login action. | EXPLOIT ✓MEDIUM 4.3EPSS 1.21% | 26 March 2010 |
| CVE-2009-4745 | Multiple SQL injection vulnerabilities in index.php in Dreamlevels DreamPoll 3.1 allow remote attackers to execute arbitrary SQL commands via the (1) sortField, (2) sortDesc, or (3) pageNumber parameter in a login action. | EXPLOIT ×2 ✓HIGH 7.5EPSS 0.91% | 26 March 2010 |
| CVE-2009-4743 | Multiple cross-site scripting (XSS) vulnerabilities in history-storage.aspx in AfterLogic WebMail Pro 4.7.10 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) HistoryStorageObjectName and (2) HistoryKey parameters. | EXPLOIT ×2 ✓MEDIUM 4.3EPSS 1.54% | 26 March 2010 |
| CVE-2009-4742 | Multiple SQL injection vulnerabilities in Docebo 3.6.0.3 allow remote attackers to execute arbitrary SQL commands via (1) the word parameter in a play help action to the faq module, reachable through index.php; (2) the word parameter in a play keyw… | EXPLOIT ✓HIGH 7.5EPSS 0.60% | 26 March 2010 |
| CVE-2009-4739 | PHP remote file inclusion vulnerability in index.php in SkaDate Dating allows remote attackers to execute arbitrary PHP code via a URL in the language_id parameter. | EXPLOIT ✓MEDIUM 6.8EPSS 2.31% | 26 March 2010 |
| CVE-2010-0740 | The ssl3_get_record function in ssl/s3_pkt.c in OpenSSL 0.9.8f through 0.9.8m allows remote attackers to cause a denial of service (crash) via a malformed record in a TLS connection that triggers a NULL pointer dereference, related to the minor version… | EXPLOIT ✓MEDIUM 5.0EPSS 20.3% | 26 March 2010 |
| CVE-2010-1119 | Use-after-free vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, Safari before 4.1 on Mac OS X 10.4, and Safari on Apple iPhone OS allows remote attackers to execute arbitrary code or cause a denial of service… | EXPLOIT ✓HIGH 10.0EPSS 19.0% | 25 March 2010 |
| CVE-2010-0168 | The nsDocument::MaybePreLoadImage function in content/base/src/nsDocument.cpp in the image-preloading implementation in Mozilla Firefox 3.6 before 3.6.2 does not apply scheme restrictions and policy restrictions to the image's URL, which might allow… | EXPLOIT ✓HIGH 7.6EPSS 12.4% | 25 March 2010 |
| CVE-2010-0167 | The browser engine in Mozilla Firefox 3.0.x before 3.0.18, 3.5.x before 3.5.8, and 3.6.x before 3.6.2; Thunderbird before 3.0.2; and SeaMonkey before 2.0.3 allows remote attackers to cause a denial of service (memory corruption and application crash)… | EXPLOIT ✓HIGH 9.3EPSS 10.5% | 25 March 2010 |
| CVE-2010-0166 | The gfxTextRun::SanitizeGlyphRuns function in gfx/thebes/src/gfxFont.cpp in the browser engine in Mozilla Firefox 3.6 before 3.6.2 on Mac OS X, when the Core Text API is used, does not properly perform certain deletions, which allows remote attackers to… | EXPLOIT ✓MEDIUM 5.1EPSS 6.76% | 25 March 2010 |
| CVE-2010-1114 | Multiple PHP remote file inclusion vulnerabilities in Web Server Creator - Web Portal 0.1 allow remote attackers to execute arbitrary PHP code via a URL in the (1) pg parameter to index.php and the (2) path parameter to news/form.php. | EXPLOIT ✓HIGH 7.5EPSS 2.99% | 25 March 2010 |
| CVE-2010-1113 | Cross-site scripting (XSS) vulnerability in the forum page in Web Server Creator - Web Portal 0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors to index.php. | EXPLOIT ✓MEDIUM 4.3EPSS 1.46% | 25 March 2010 |
| CVE-2010-1112 | Cross-site scripting (XSS) vulnerability in cat.php in KloNews 2.0 allows remote attackers to inject arbitrary web script or HTML via the cat parameter. | EXPLOIT ✓MEDIUM 4.3EPSS 1.28% | 25 March 2010 |
| CVE-2010-1111 | Multiple cross-site scripting (XSS) vulnerabilities in Jokes Complete Website allow remote attackers to inject arbitrary web script or HTML via the (1) id parameter to joke.php and the (2) searchingred parameter to results.php. | EXPLOIT ×2 ✓MEDIUM 4.3EPSS 1.48% | 25 March 2010 |
| CVE-2010-1109 | Multiple SQL injection vulnerabilities in index.php in phpMySport 1.4, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) v2 parameter in a member view action, (2) v1 parameter in a news action, (3)… | EXPLOIT ✓MEDIUM 6.8EPSS 0.95% | 25 March 2010 |
| CVE-2010-1106 | PHP remote file inclusion vulnerability in cgi/index.php in AdvertisementManager 3.1.0 allows remote attackers to execute arbitrary PHP code via a URL in the req parameter. | EXPLOIT ✓HIGH 7.5EPSS 2.10% | 25 March 2010 |
| CVE-2010-0619 | Stack-based buffer overflow in the base, IPDS DLE, Forms DLE, Barcode DLE, Prescribe DLE, and Printcryption DLE components on certain Lexmark laser printers and multi-function printers allows remote attackers to execute arbitrary code or cause a denial… | EXPLOIT ✓HIGH 7.3EPSS 4.57% | 24 March 2010 |
| CVE-2009-2907 | Multiple cross-site scripting (XSS) vulnerabilities in SpringSource tc Server 6.0.20.B and earlier, Application Management Suite (AMS) before 2.0.0.SR4, Hyperic HQ Open Source before 4.2.x, Hyperic HQ 4.0 Enterprise before 4.0.3.2, and Hyperic HQ 4.1… | EXPLOIT ✓MEDIUM 4.3EPSS 1.20% | 24 March 2010 |
| CVE-2010-1095 | Cross-site scripting (XSS) vulnerability in login_reset_password_page.php in Tracking Requirements & Use Cases (TRUC) 0.11.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the error parameter. | EXPLOIT ✓MEDIUM 4.3EPSS 2.33% | 24 March 2010 |
| CVE-2010-1094 | SQL injection vulnerability in news.php in DZ EROTIK Auktionshaus V4rgo allows remote attackers to execute arbitrary SQL commands via the id parameter. | EXPLOIT ✓HIGH 7.5EPSS 1.01% | 24 March 2010 |
| CVE-2010-1093 | SQL injection vulnerability in rss.php in 1024 CMS 2.1.1, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the id parameter in a vp action. | EXPLOIT ✓MEDIUM 6.8EPSS 0.88% | 24 March 2010 |
| CVE-2010-1092 | Multiple SQL injection vulnerabilities in login.php in ScriptsFeed Business Directory Software allow remote attackers to execute arbitrary SQL commands via the (1) us and (2) ps parameters. | EXPLOITHIGH 7.5EPSS 1.16% | 24 March 2010 |
| CVE-2010-1091 | Multiple cross-site scripting (XSS) vulnerabilities in contact.php in phpMySite allow remote attackers to inject arbitrary web script or HTML via the (1) name, (2) city, (3) email, (4) state, and (5) message parameters. | EXPLOITMEDIUM 4.3EPSS 1.47% | 24 March 2010 |
| CVE-2010-1090 | SQL injection vulnerability in index.php in phpMySite allows remote attackers to execute arbitrary SQL commands via the action parameter. | EXPLOITHIGH 7.5EPSS 0.98% | 24 March 2010 |
| CVE-2010-1089 | SQL injection vulnerability in vedi_faq.php in PHP Trouble Ticket 2.2 allows remote attackers to execute arbitrary SQL commands via the id parameter. | EXPLOIT ✓HIGH 7.5EPSS 0.96% | 24 March 2010 |
| CVE-2010-0437 | The ip6_dst_lookup_tail function in net/ipv6/ip6_output.c in the Linux kernel before 2.6.27 does not properly handle certain circumstances involving an IPv6 TUN network interface and a large number of neighbors, which allows attackers to cause a denial… | EXPLOIT ✓HIGH 7.8EPSS 12.4% | 24 March 2010 |
| CVE-2010-1081 | Directory traversal vulnerability in the Community Polls (com_communitypolls) component 1.5.2, and possibly earlier, for Core Joomla! allows remote attackers to read arbitrary files via a .. | EXPLOIT ✓MEDIUM 5.0EPSS 14.6% | 23 March 2010 |
| CVE-2010-1078 | SQL injection vulnerability in archive.php in XlentProjects SphereCMS 1.1 alpha allows remote attackers to execute arbitrary SQL commands via encoded null bytes ("%00") in the view parameter, which bypasses a protection mechanism. | EXPLOIT ✓HIGH 7.5EPSS 1.03% | 23 March 2010 |
| CVE-2010-1077 | Directory traversal vulnerability in vbseo.php in Crawlability vBSEO plugin 3.1.0 for vBulletin allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the vbseourl parameter. | EXPLOIT ✓MEDIUM 6.8EPSS 1.86% | 23 March 2010 |
| CVE-2010-1073 | SQL injection vulnerability in the jEmbed-Embed Anything (com_jembed) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter in a summary action to index.php. | EXPLOITHIGH 7.5EPSS 1.00% | 23 March 2010 |
| CVE-2010-1071 | SQL injection vulnerability in profil.php in phpMDJ 1.0.3 allows remote attackers to execute arbitrary SQL commands via the id parameter. | EXPLOITHIGH 7.5EPSS 1.02% | 23 March 2010 |
| CVE-2010-1070 | SQL injection vulnerability in index.php in ImagoScripts Deviant Art Clone allows remote attackers to execute arbitrary SQL commands via the seid parameter in a forums viewcat action. | EXPLOIT ✓HIGH 7.5EPSS 1.15% | 23 March 2010 |
| CVE-2010-1069 | SQL injection vulnerability in games/game.php in ProArcadeScript allows remote attackers to execute arbitrary SQL commands via the id parameter. | EXPLOITHIGH 7.5EPSS 0.97% | 23 March 2010 |
| CVE-2010-1067 | E-membres 1.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for db/bdEMembres.mdb. | EXPLOIT ✓MEDIUM 5.0EPSS 2.49% | 23 March 2010 |
| CVE-2010-1066 | AR Web Content Manager (AWCM) 2.1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for control/db_backup.php. | EXPLOIT ✓MEDIUM 5.0EPSS 2.46% | 23 March 2010 |
| CVE-2010-1065 | Lebisoft Ziyaretci Defteri 7.4 and 7.5 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for db/lebisoft.mdb. | EXPLOIT ✓MEDIUM 5.0EPSS 2.49% | 23 March 2010 |
| CVE-2010-1064 | Erolife AjxGaleri VT stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for db/ajxgaleri.mdb. | EXPLOIT ✓MEDIUM 5.0EPSS 2.46% | 23 March 2010 |
| CVE-2010-1062 | Directory traversal vulnerability in codelib/sys/common.inc.php in Phpkobo Free Real Estate Contact Form 1.09, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. | EXPLOITMEDIUM 6.8EPSS 1.86% | 23 March 2010 |
| CVE-2010-1060 | Directory traversal vulnerability in staff/app/common.inc.php in Phpkobo Short URL 1.01, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. | EXPLOIT ✓MEDIUM 6.8EPSS 1.86% | 23 March 2010 |
| CVE-2010-1058 | Directory traversal vulnerability in codelib/cfg/common.inc.php in Phpkobo Address Book Script 1.09, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. | EXPLOIT ✓MEDIUM 6.8EPSS 2.30% | 23 March 2010 |
| CVE-2010-1057 | Multiple directory traversal vulnerabilities in Phpkobo AdFreely (aka Ad Board Script) 1.01, when magic_quotes_gpc is disabled, allow remote attackers to include and execute arbitrary local files via a ..// (dot dot slash slash) in the LANG_CODE… | EXPLOIT ✓MEDIUM 6.8EPSS 2.44% | 23 March 2010 |
| CVE-2010-1056 | Directory traversal vulnerability in the RokDownloads (com_rokdownloads) component before 1.0.1 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. | EXPLOIT ✓MEDIUM 6.8EPSS 11.4% | 23 March 2010 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.