Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
The year’s CVE activity with KEV, EPSS and exploit data as a PDF: heatmaps, a vendor treemap, and the lists worth checking against your estate.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
397,453 CVEs1,723 in CISA KEV17,397 with EPSS ≥ 10%25,049 with a public exploitUpdated 25 September 2026
25,049 results · page 209 of 501
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2009-4421 | Directory traversal vulnerability in languages_cgi.php in Simple PHP Blog 0.5.1 and earlier allows remote authenticated users to include and execute arbitrary local files via a .. | EXPLOITMEDIUM 6.5EPSS 2.00% | 24 December 2009 |
| CVE-2009-4413 | The httpClientDiscardBody function in client.c in Polipo 0.9.8, 0.9.12, 1.0.4, and possibly other versions, allows remote attackers to cause a denial of service (crash) via a request with a large Content-Length value, which triggers an integer overflow,… | EXPLOIT ✓MEDIUM 5.0EPSS 8.66% | 24 December 2009 |
| CVE-2009-3305 | Polipo 1.0.4, and possibly other versions, allows remote attackers to cause a denial of service (crash) via a request with a Cache-Control header that lacks a value for the max-age field, which triggers a segmentation fault in the httpParseHeaders… | EXPLOIT ✓MEDIUM 5.0EPSS 10.1% | 24 December 2009 |
| CVE-2009-4403 | Cross-site scripting (XSS) vulnerability in index.php in Rumba XML 1.8 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO. | EXPLOIT ✓MEDIUM 4.3EPSS 1.54% | 23 December 2009 |
| CVE-2009-4386 | SQL injection vulnerability in hotel_tiempolibre_ext.php in Venalsur Booking Centre Booking System for Hotels Group, when magic_quotes_gpc is enabled, allows remote attackers to execute arbitrary SQL commands via the NoticiaID parameter and other… | EXPLOIT ✓HIGH 7.5EPSS 1.02% | 22 December 2009 |
| CVE-2009-4385 | Multiple cross-site request forgery (CSRF) vulnerabilities in Scriptsez.net Ez Poll Hoster (EPH) allow remote attackers to (1) hijack the authentication of arbitrary users for requests that delete polls via the delete_poll action to index.php; and… | EXPLOIT ✓MEDIUM 6.8EPSS 0.97% | 22 December 2009 |
| CVE-2009-4384 | Multiple cross-site scripting (XSS) vulnerabilities in Scriptsez.net Ez Poll Hoster (EPH) allow remote attackers to inject arbitrary web script or HTML via the (1) pid parameter in a code action to index.php and the (2) uid parameter in a view action to… | EXPLOIT ✓MEDIUM 4.3EPSS 1.48% | 22 December 2009 |
| CVE-2009-4382 | Cross-site scripting (XSS) vulnerability in module.php in PHPFABER CMS, possibly 1.3.36, allows remote attackers to inject arbitrary web script or HTML via the mod parameter. | EXPLOIT ✓MEDIUM 4.3EPSS 1.45% | 22 December 2009 |
| CVE-2009-4381 | Cross-site scripting (XSS) vulnerability in index.php in texmedia Million Pixel Script 3 allows remote attackers to inject arbitrary web script or HTML via the pa parameter. | EXPLOIT ✓MEDIUM 4.3EPSS 1.76% | 22 December 2009 |
| CVE-2009-4140 | Unrestricted file upload vulnerability in ofc_upload_image.php in Open Flash Chart v2 Beta 1 through v2 Lug Wyrm Charmer, as used in Piwik 0.2.35 through 0.4.3, Woopra Analytics Plugin before 1.4.3.2, and possibly other products, when register_globals… | EXPLOIT ×6 ✓HIGH 7.5EPSS 75.8% | 22 December 2009 |
| CVE-2009-3702 | Multiple absolute path traversal vulnerabilities in PHP-Calendar 1.1 allow remote attackers to include and execute arbitrary local files via a full pathname in the configfile parameter to (1) update08.php or (2) update10.php. | EXPLOIT ×2 ✓HIGH 7.5EPSS 2.45% | 22 December 2009 |
| CVE-2009-4375 | SQL injection vulnerability in repository/repository_attachment.php in AlienVault Open Source Security Information Management (OSSIM) 2.1.5, and possibly other versions before 2.1.5-4, allows remote attackers to execute arbitrary SQL commands via the… | EXPLOIT ✓HIGH 7.5EPSS 0.97% | 21 December 2009 |
| CVE-2009-4372 | AlienVault Open Source Security Information Management (OSSIM) 2.1.5, and possibly other versions before 2.1.5-4, allows remote attackers to execute arbitrary commands via shell metacharacters in the uniqueid parameter to (1) wcl.php, (2)… | EXPLOIT ✓HIGH 7.5EPSS 4.82% | 21 December 2009 |
| CVE-2009-4367 | The Staging Webservice ("sitecore modules/staging/service/api.asmx") in Sitecore Staging Module 5.4.0 rev.080625 and earlier allows remote attackers to bypass authentication and (1) upload files, (2) download files, (3) list directories, and (4) clear… | EXPLOIT ✓MEDIUM 6.8EPSS 6.09% | 21 December 2009 |
| CVE-2009-4366 | Cross-site scripting (XSS) vulnerability in index.php in ScriptsEz Ez Blog 1.0 allows remote attackers to inject arbitrary web script or HTML via the yr parameter in a bmonth action. | EXPLOIT ×2 ✓MEDIUM 4.3EPSS 1.52% | 21 December 2009 |
| CVE-2009-4365 | Multiple cross-site request forgery (CSRF) vulnerabilities in admin.php in ScriptsEz Ez Blog 1.0 allow remote attackers to hijack the authentication of administrators for requests that (1) add a blog via the add_blog action, (2) approve a comment via… | EXPLOIT ×2 ✓MEDIUM 4.3EPSS 0.92% | 21 December 2009 |
| CVE-2009-4364 | Cross-site scripting (XSS) vulnerability in index.php in ScriptsEz Ez Blog allows remote attackers to inject arbitrary web script or HTML via the cname parameter, related to the act and id parameters. | EXPLOIT ×2 ✓MEDIUM 4.3EPSS 1.47% | 21 December 2009 |
| CVE-2009-4142 | The htmlspecialchars function in PHP before 5.2.12 does not properly handle (1) overlong UTF-8 sequences, (2) invalid Shift_JIS sequences, and (3) invalid EUC-JP sequences, which allows remote attackers to conduct cross-site scripting (XSS) attacks by… | EXPLOIT ×2 ✓MEDIUM 4.3EPSS 6.50% | 21 December 2009 |
| CVE-2009-3701 | Multiple cross-site scripting (XSS) vulnerabilities in the administration interface in Horde Application Framework before 3.3.6, Horde Groupware before 1.2.5, and Horde Groupware Webmail Edition before 1.2.5 allow remote attackers to inject arbitrary… | EXPLOIT ×4 ✓MEDIUM 4.3EPSS 4.83% | 21 December 2009 |
| CVE-2009-4360 | SQL injection vulnerability in modules/content/index.php in the Content module 0.5 for XOOPS allows remote attackers to inject arbitrary web script or HTML via the id parameter. | EXPLOIT ✓HIGH 7.5EPSS 0.99% | 20 December 2009 |
| CVE-2009-4359 | Cross-site scripting (XSS) vulnerability in folder.php in the SmartMedia 0.85 Beta module for XOOPS allows remote attackers to inject arbitrary web script or HTML via the categoryid parameter. | EXPLOIT ✓MEDIUM 4.3EPSS 1.49% | 20 December 2009 |
| CVE-2009-3703 | Multiple SQL injection vulnerabilities in the WP-Forum plugin before 2.4 for WordPress allow remote attackers to execute arbitrary SQL commands via (1) the search_max parameter in a search action to the default URI, related to wpf.class.php; (2) the… | EXPLOIT ✓HIGH 7.5EPSS 2.63% | 18 December 2009 |
| CVE-2007-2280 | Stack-based buffer overflow in OmniInet.exe (aka the backup client service daemon) in the Application Recovery Manager component in HP OpenView Storage Data Protector 5.50 and 6.0 allows remote attackers to execute arbitrary code via an MSG_PROTOCOL… | EXPLOIT ✓HIGH 10.0EPSS 60.3% | 18 December 2009 |
| CVE-2009-4351 | SQL injection vulnerability in ADMIN/loginaction.php in WSCreator 1.1, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the Email (aka username) parameter. | EXPLOIT ✓MEDIUM 6.8EPSS 1.08% | 17 December 2009 |
| CVE-2009-4349 | Cross-site request forgery (CSRF) vulnerability in administration/administrators.php in Link Up Gold 5.0 allows remote attackers to hijack the authentication of administrators for requests that create administrative accounts. | EXPLOIT ✓MEDIUM 6.8EPSS 1.17% | 17 December 2009 |
| CVE-2008-7248 | Ruby on Rails 2.1 before 2.1.3 and 2.2.x before 2.2.2 does not verify tokens for requests with certain content types, which allows remote attackers to bypass cross-site request forgery (CSRF) protection for requests to applications that rely on this… | EXPLOIT ✓MEDIUM 6.8EPSS 8.08% | 16 December 2009 |
| CVE-2009-4324 | Adobe Acrobat and Reader Use-After-Free Vulnerability | KEVEXPLOIT ×3 ✓HIGH 7.8EPSS 81.9% | 15 December 2009 |
| CVE-2009-4319 | PHP remote file inclusion vulnerability in js/bbcodepress/bbcode-form.php in eoCMS 0.9.03 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the BBCODE_path parameter. | EXPLOIT ✓MEDIUM 6.8EPSS 1.65% | 14 December 2009 |
| CVE-2009-4315 | Directory traversal vulnerability in admin/ajaxsave.php in Nuggetz CMS 1.0, when magic_quotes_gpc is disabled, allows remote attackers to create or modify arbitrary files via a .. | EXPLOIT ✓MEDIUM 6.8EPSS 2.02% | 14 December 2009 |
| CVE-2009-4131 | The EXT4_IOC_MOVE_EXT (aka move extents) ioctl implementation in the ext4 filesystem in the Linux kernel before 2.6.32-git6 allows local users to overwrite arbitrary files via a crafted request, related to insufficient checks for file permissions. | EXPLOIT ✓HIGH 7.2EPSS 0.79% | 13 December 2009 |
| CVE-2009-4238 | Multiple SQL injection vulnerabilities in TestLink before 1.8.5 allow remote authenticated users to execute arbitrary SQL commands via (1) the Test Case ID field to lib/general/navBar.php or (2) the logLevel parameter to lib/events/eventviewer.php. | EXPLOIT ✓MEDIUM 6.5EPSS 1.08% | 10 December 2009 |
| CVE-2009-4237 | Multiple cross-site scripting (XSS) vulnerabilities in TestLink before 1.8.5 allow remote attackers to inject arbitrary web script or HTML via (1) the req parameter to login.php, and allow remote authenticated users to inject arbitrary web script or… | EXPLOIT ✓LOW 3.5EPSS 3.31% | 10 December 2009 |
| CVE-2009-4179 | Stack-based buffer overflow in ovalarm.exe in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allows remote attackers to execute arbitrary code via a long HTTP Accept-Language header in an OVABverbose action. | EXPLOIT ×2 ✓HIGH 10.0EPSS 67.0% | 10 December 2009 |
| CVE-2009-4178 | Heap-based buffer overflow in OvWebHelp.exe in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allows remote attackers to execute arbitrary code via a long Topic parameter. | EXPLOIT ×2 ✓HIGH 10.0EPSS 74.0% | 10 December 2009 |
| CVE-2009-3849 | Multiple stack-based buffer overflows in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allow remote attackers to execute arbitrary code via (1) a long Template parameter to nnmRptConfig.exe, related to the strcat function; or (2) a long… | EXPLOIT ✓HIGH 10.0EPSS 73.7% | 10 December 2009 |
| CVE-2009-4266 | Cross-site scripting (XSS) vulnerability in search.php in YABSoft Advanced Image Hosting (AIH) Script 2.2, and possibly 2.3, allows remote attackers to inject arbitrary web script or HTML via the text parameter. | EXPLOITMEDIUM 4.3EPSS 1.45% | 10 December 2009 |
| CVE-2009-4265 | Stack-based buffer overflow in Ideal Administration 2009 9.7.1, and possibly other versions, allows remote attackers to execute arbitrary code via a long Computer value in an .ipj project file. | EXPLOIT ×3 ✓HIGH 9.3EPSS 31.4% | 10 December 2009 |
| CVE-2009-4264 | PHP remote file inclusion vulnerability in components/core/connect.php in AROUNDMe 1.1 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the language_path parameter. | EXPLOIT ✓MEDIUM 6.8EPSS 1.73% | 10 December 2009 |
| CVE-2009-4263 | SQL injection vulnerability in main_forum.php in PTCPay GeN3 forum 1.3 allows remote attackers to execute arbitrary SQL commands via the cat parameter. | EXPLOIT ✓HIGH 7.5EPSS 0.91% | 10 December 2009 |
| CVE-2009-4256 | Multiple SQL injection vulnerabilities in cource.php in AlefMentor 2.0 and 2.2 allow remote attackers to execute arbitrary SQL commands via the (1) cont_id and (2) courc_id parameters in a pregled action. | EXPLOIT ✓HIGH 7.5EPSS 0.96% | 10 December 2009 |
| CVE-2009-4253 | Cross-site scripting (XSS) vulnerability in dspStats.php in PowerPhlogger 2.2.5 allows remote attackers to inject arbitrary web script or HTML via the edit parameter. | EXPLOIT ✓MEDIUM 4.3EPSS 1.45% | 10 December 2009 |
| CVE-2009-4251 | Stack-based buffer overflow in Jasc Paint Shop Pro 8.10 (aka Corel Paint Shop Pro) allows user-assisted remote attackers to execute arbitrary code via a crafted PNG file. | EXPLOIT ✓HIGH 9.3EPSS 8.22% | 10 December 2009 |
| CVE-2009-4250 | Multiple cross-site scripting (XSS) vulnerabilities in CutePHP CuteNews 1.4.6 and UTF-8 CuteNews before 8b allow remote attackers to inject arbitrary web script or HTML via (1) the result parameter to register.php; (2) the user parameter to search.php;… | EXPLOIT ×2 ✓MEDIUM 4.3EPSS 1.98% | 10 December 2009 |
| CVE-2009-4249 | Multiple cross-site scripting (XSS) vulnerabilities in CutePHP CuteNews 1.4.6, when register_globals is enabled and magic_quotes_gpc is disabled, allow remote attackers to inject arbitrary web script or HTML via the (1) lastusername and (2) mod… | EXPLOIT ×2 ✓LOW 2.6EPSS 1.89% | 10 December 2009 |
| CVE-2009-3844 | Stack-based buffer overflow in the OmniInet process in HP OpenView Data Protector Application Recovery Manager 5.50 and 6.0 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted MSG_PROTOCOL packet. | EXPLOIT ×2 ✓HIGH 10.0EPSS 74.1% | 8 December 2009 |
| CVE-2009-1569 | Multiple stack-based buffer overflows in Novell iPrint Client 4.38, 5.30, and possibly other versions before 5.32 allow remote attackers to execute arbitrary code via vectors related to (1) Date and (2) Time. | EXPLOIT ✓HIGH 9.3EPSS 37.5% | 8 December 2009 |
| CVE-2009-1568 | Stack-based buffer overflow in ienipp.ocx in Novell iPrint Client 5.30, and possibly other versions before 5.32, allows remote attackers to execute arbitrary code via a long target-frame parameter. | EXPLOIT ✓HIGH 9.3EPSS 32.2% | 8 December 2009 |
| CVE-2009-4234 | Cross-site scripting (XSS) vulnerability in loginpages/error_user.shtml on the Micronet Network Access Controller SP1910 allows remote attackers to inject arbitrary web script or HTML via the msg parameter. | EXPLOIT ✓MEDIUM 4.3EPSS 1.27% | 8 December 2009 |
| CVE-2009-4231 | Directory traversal vulnerability in as/lib/plugins.php in SweetRice 0.5.3 and earlier allows remote attackers to include and execute arbitrary local files via .. | EXPLOIT ✓HIGH 7.5EPSS 2.32% | 8 December 2009 |
| CVE-2009-4229 | Multiple SQL injection vulnerabilities in ActiveWebSoftwares Active Bids allow remote attackers to execute arbitrary SQL commands via (1) the catid parameter in the PATH_INFO to the default URI or (2) the catid parameter to default.asp. | EXPLOIT ✓HIGH 7.5EPSS 0.91% | 8 December 2009 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.