Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
The year’s CVE activity with KEV, EPSS and exploit data as a PDF: heatmaps, a vendor treemap, and the lists worth checking against your estate.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
397,453 CVEs1,723 in CISA KEV17,253 with EPSS ≥ 10%25,049 with a public exploitUpdated 25 September 2026
25,049 results · page 211 of 501
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2009-4114 | kl1.sys in Kaspersky Anti-Virus 2010 9.0.0.463, and possibly other versions before 9.0.0.736, does not properly validate input to IOCTL 0x0022c008, which allows local users to cause a denial of service (system crash) via IOCTL requests using crafted… | EXPLOIT ✓MEDIUM 4.9EPSS 0.83% | 30 November 2009 |
| CVE-2009-4112 | Cacti 0.8.7e and earlier allows remote authenticated administrators to gain privileges by modifying the "Data Input Method" for the "Linux - Get Memory Usage" setting to contain arbitrary commands. | EXPLOIT ✓HIGH 9.0EPSS 11.5% | 30 November 2009 |
| CVE-2009-4019 | mysqld in MySQL 5.0.x before 5.0.88 and 5.1.x before 5.1.41 does not (1) properly handle errors during execution of certain SELECT statements with subqueries, and does not (2) preserve certain null_value flags during execution of statements that use the… | EXPLOIT ×2 ✓MEDIUM 4.0EPSS 16.3% | 30 November 2009 |
| CVE-2009-4108 | XM Easy Personal FTP Server 5.8.0 allows remote authenticated users to cause a denial of service (crash) by uploading or creating a large number of files or directories, then performing a LIST command. | EXPLOIT ×2 ✓MEDIUM 4.0EPSS 2.43% | 29 November 2009 |
| CVE-2009-4107 | Buffer overflow in Invisible Browsing 5.0.52 allows user-assisted remote attackers to execute arbitrary code via a crafted .ibkey file containing a long string. | EXPLOIT ✓HIGH 9.3EPSS 4.83% | 29 November 2009 |
| CVE-2009-4106 | Unrestricted file upload vulnerability in admintools/editpage-2.php in Agoko CMS 0.4 and earlier allows remote attackers to inject and execute arbitrary PHP code via the filename and text parameters. | EXPLOIT ✓HIGH 7.5EPSS 2.42% | 29 November 2009 |
| CVE-2009-4105 | TYPSoft FTP Server 1.10 allows remote authenticated users to cause a denial of service (crash) by sending an APPE (append) command immediately followed by a DELE (delete) command without sending file data in between these two commands. | EXPLOIT ✓LOW 3.5EPSS 3.52% | 29 November 2009 |
| CVE-2009-4104 | SQL injection vulnerability in Lyften Designs LyftenBloggie (com_lyftenbloggie) component 1.0.4 for Joomla! allows remote attackers to execute arbitrary SQL commands via the author parameter to index.php. | EXPLOIT ✓HIGH 7.5EPSS 2.10% | 29 November 2009 |
| CVE-2009-4099 | SQL injection vulnerability in the Google Calendar GCalendar (com_gcalendar) component 1.1.2, 2.1.4, and possibly earlier versions for Joomla! allows remote attackers to execute arbitrary SQL commands via the gcid parameter. | EXPLOIT ✓HIGH 7.5EPSS 2.31% | 29 November 2009 |
| CVE-2009-4098 | Unrestricted file upload vulnerability in banner-edit.php in OpenX adserver 2.8.1 and earlier allows remote authenticated users with banner / file upload permissions to execute arbitrary code by uploading a file with an executable extension, then… | EXPLOIT ✓MEDIUM 6.0EPSS 18.7% | 29 November 2009 |
| CVE-2009-4097 | Stack-based buffer overflow in the MplayInputFile function in Serenity Audio Player 3.2.3 and earlier allows remote attackers to execute arbitrary code via a long URL in an M3U file. | EXPLOIT ✓HIGH 9.3EPSS 5.76% | 29 November 2009 |
| CVE-2009-4096 | RADIO istek scripti 2.5 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain user credentials via a direct request for estafresgaftesantusyan.inc. | EXPLOIT ✓HIGH 7.5EPSS 2.35% | 29 November 2009 |
| CVE-2009-4094 | PHP remote file inclusion vulnerability in class/php/d4m_ajax_pagenav.php in the D4J eZine (com_ezine) component 2.1 for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[mosConfig_absolute_path parameter. | EXPLOIT ✓HIGH 7.5EPSS 2.28% | 29 November 2009 |
| CVE-2009-4093 | Multiple cross-site scripting (XSS) vulnerabilities in comments.php in Simplog 0.9.3.2, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via the (1) cname (Name) or (2) email parameters. | EXPLOIT ✓MEDIUM 4.3EPSS 3.92% | 29 November 2009 |
| CVE-2009-4092 | Cross-site request forgery (CSRF) vulnerability in user.php in Simplog 0.9.3.2, and possibly earlier, allows remote attackers to hijack the authentication of administrators and users for requests that change passwords. | EXPLOIT ✓MEDIUM 6.8EPSS 5.37% | 29 November 2009 |
| CVE-2009-4091 | comments.php in Simplog 0.9.3.2, and possibly earlier, does not properly restrict access, which allows remote attackers to edit or delete comments via the (1) edit or (2) del action. | EXPLOIT ✓MEDIUM 5.0EPSS 6.53% | 29 November 2009 |
| CVE-2009-4089 | telepark.wiki 2.4.23 and earlier allows remote attackers to bypass authorization and (1) delete arbitrary pages via a modified pageID parameter to ajax/deletePage.php or (2) delete arbitrary comments via a modified pageID parameter to… | EXPLOIT ×2 ✓MEDIUM 5.0EPSS 6.59% | 29 November 2009 |
| CVE-2009-4088 | Multiple directory traversal vulnerabilities in telepark.wiki 2.4.23 and earlier allow remote attackers to read arbitrary files via directory traversal sequences in the css parameter to (1) getjs.php and (2) getcsslocal.php; and include and execute… | EXPLOIT ×2 ✓MEDIUM 6.8EPSS 2.80% | 29 November 2009 |
| CVE-2009-4086 | CRLF injection vulnerability in Xerver HTTP Server 4.31 and 4.32 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via certain byte sequences at the end of a URL. | EXPLOIT ✓MEDIUM 5.0EPSS 4.76% | 29 November 2009 |
| CVE-2009-4085 | PHP remote file inclusion vulnerability in assets/plugins/mp3_id/mp3_id.php in PHP Traverser 0.8.0 allows remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[BASE] parameter. | EXPLOIT ✓HIGH 7.5EPSS 2.27% | 29 November 2009 |
| CVE-2009-4082 | PHP remote file inclusion vulnerability in forums/Forum_Include/index.php in Outreach Project Tool (OPT) 1.2.7 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the CRM_path parameter. | EXPLOIT ✓HIGH 7.5EPSS 2.99% | 29 November 2009 |
| CVE-2009-4032 | Multiple cross-site scripting (XSS) vulnerabilities in Cacti 0.8.7e allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) graph.php, (2) include/top_graph_header.php, (3) lib/html_form.php, and (4)… | EXPLOIT ×2 ✓MEDIUM 4.3EPSS 5.74% | 29 November 2009 |
| CVE-2009-4018 | The proc_open function in ext/standard/proc_open.c in PHP before 5.2.11 and 5.3.x before 5.3.1 does not enforce the (1) safe_mode_allowed_env_vars and (2) safe_mode_protected_env_vars directives, which allows context-dependent attackers to execute… | EXPLOITHIGH 7.5EPSS 11.3% | 29 November 2009 |
| CVE-2009-3033 | Buffer overflow in the RunCmd method in the Altiris eXpress NS Console Utilities ActiveX control in AeXNSConsoleUtilities.dll in the web console in Symantec Altiris Deployment Solution 6.9.x, Altiris Notification Server 6.0.x, and Management Platform… | EXPLOIT ✓HIGH 9.3EPSS 40.0% | 25 November 2009 |
| CVE-2009-3898 | Directory traversal vulnerability in src/http/modules/ngx_http_dav_module.c in nginx (aka Engine X) before 0.7.63, and 0.8.x before 0.8.17, allows remote authenticated users to create or overwrite arbitrary files via a .. | EXPLOIT ✓MEDIUM 4.9EPSS 15.9% | 24 November 2009 |
| CVE-2009-3578 | Autodesk Maya 8.0, 8.5, 2008, 2009, and 2010 and Alias Wavefront Maya 6.5 and 7.0 allow remote attackers to execute arbitrary code via a (1) .ma or (2) .mb file that uses the Maya Embedded Language (MEL) python command or unspecified other MEL commands,… | EXPLOIT ✓HIGH 9.3EPSS 4.42% | 24 November 2009 |
| CVE-2009-3577 | Autodesk 3D Studio Max (3DSMax) 6 through 9 and 2008 through 2010 allows remote attackers to execute arbitrary code via a .max file with a MAXScript statement that calls the DOSCommand method, related to "application callbacks." | EXPLOIT ✓HIGH 9.3EPSS 5.09% | 24 November 2009 |
| CVE-2009-3576 | Autodesk Softimage 7.x and Softimage XSI 6.x allow remote attackers to execute arbitrary JavaScript code via a scene package containing a Scene Table of Contents (aka .scntoc) file with a Script_Content element, as demonstrated by code that loads the… | EXPLOIT ×2 ✓HIGH 9.3EPSS 3.16% | 24 November 2009 |
| CVE-2009-4060 | SQL injection vulnerability in includes/content/viewProd.inc.php in CubeCart before 4.3.7 remote attackers to execute arbitrary SQL commands via the productId parameter. | EXPLOIT ✓HIGH 7.5EPSS 2.24% | 24 November 2009 |
| CVE-2009-4059 | SQL injection vulnerability in the JoomClip (com_joomclip) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the cat parameter in a thumbs action to index.php. | EXPLOIT ✓MEDIUM 6.8EPSS 0.96% | 24 November 2009 |
| CVE-2009-4058 | SQL injection vulnerability in allauctions.php in Telebid Auction Script allows remote attackers to execute arbitrary SQL commands via the aid parameter. | EXPLOIT ✓HIGH 7.5EPSS 0.97% | 24 November 2009 |
| CVE-2009-4057 | SQL injection vulnerability in the inertialFATE iF Portfolio Nexus (com_if_nexus) component 1.1 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in an item action to index.php. | EXPLOIT ✓HIGH 7.5EPSS 1.02% | 24 November 2009 |
| CVE-2009-4056 | Directory traversal vulnerability in admin/popup.php in Betsy CMS 3.5 allows remote attackers to include and execute arbitrary local files via a .. | EXPLOIT ✓HIGH 7.5EPSS 2.46% | 24 November 2009 |
| CVE-2009-4017 | PHP before 5.2.12 and 5.3.x before 5.3.1 does not restrict the number of temporary files created when handling a multipart/form-data POST request, which allows remote attackers to cause a denial of service (resource exhaustion), and makes it easier for… | EXPLOIT ✓MEDIUM 5.0EPSS 12.0% | 24 November 2009 |
| CVE-2009-3843 | HP Operations Manager 8.10 on Windows contains a "hidden account" in the XML file that specifies Tomcat users, which allows remote attackers to conduct unrestricted file upload attacks, and thereby execute arbitrary code, by using the… | EXPLOIT ✓HIGH 10.0EPSS 79.0% | 24 November 2009 |
| CVE-2009-4053 | Multiple directory traversal vulnerabilities in Home FTP Server 1.10.1.139 allow remote authenticated users to (1) create arbitrary directories via directory traversal sequences in an MKD command or (2) create files with any contents in arbitrary… | EXPLOIT ✓MEDIUM 6.5EPSS 3.54% | 23 November 2009 |
| CVE-2009-4051 | Home FTP Server 1.10.1.139 allows remote attackers to cause a denial of service (daemon outage) via multiple invalid SITE INDEX commands. | EXPLOIT ✓MEDIUM 5.0EPSS 6.21% | 23 November 2009 |
| CVE-2009-4050 | Directory traversal vulnerability in get_file.php in phpMyBackupPro 2.1 allows remote attackers to read arbitrary files via directory traversal sequences in the view parameter. | EXPLOIT ✓MEDIUM 5.0EPSS 8.11% | 23 November 2009 |
| CVE-2009-4049 | Heap-based buffer overflow in aswRdr.sys (aka the TDI RDR driver) in avast! | EXPLOIT ✓HIGH 7.2EPSS 1.10% | 23 November 2009 |
| CVE-2009-4048 | Dxmsoft XM Easy Personal FTP Server 5.8.0 allows remote authenticated users to cause a denial of service (daemon outage) via an APPE command to one socket in conjunction with a DELE command to a second socket. | EXPLOIT ×2 ✓MEDIUM 4.0EPSS 2.41% | 23 November 2009 |
| CVE-2009-4047 | Multiple cross-site scripting (XSS) vulnerabilities in PHD Help Desk 1.43 allow remote attackers to inject arbitrary web script or HTML via (1) the PATH_INFO to area.php; the (2) pagina, (3) sentido, (4) q_registros, and (5) orden parameters to… | EXPLOIT ×6 ✓MEDIUM 4.3EPSS 1.94% | 23 November 2009 |
| CVE-2009-4039 | Cross-site scripting (XSS) vulnerability in Piwigo before 2.0.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. | EXPLOIT ✓MEDIUM 4.3EPSS 1.91% | 20 November 2009 |
| CVE-2009-4006 | Stack-based buffer overflow in the TEA decoding algorithm in RhinoSoft Serv-U FTP server 7.0.0.1, 9.0.0.5, and other versions before 9.1.0.0 allows remote attackers to execute arbitrary code via a long hexadecimal string. | EXPLOIT ✓HIGH 10.0EPSS 82.9% | 20 November 2009 |
| CVE-2009-3840 | The embedded database engine service (aka ovdbrun.exe) in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53 allows remote attackers to cause a denial of service (daemon crash) via an invalid Error Code field in a packet. | EXPLOIT ×2 ✓MEDIUM 5.0EPSS 9.34% | 19 November 2009 |
| CVE-2009-3976 | Buffer overflow in Labtam ProFTP 2.9 allows remote FTP servers to cause a denial of service (application crash) or execute arbitrary code via a long 220 reply (aka connection greeting or welcome message). | EXPLOIT ×2 ✓HIGH 9.3EPSS 28.3% | 18 November 2009 |
| CVE-2009-3975 | SQL injection vulnerability in index.php in Moa Gallery 1.1.0 and 1.2.0 allows remote attackers to execute arbitrary SQL commands via the gallery_id parameter in a gallery_view action. | EXPLOIT ✓MEDIUM 6.8EPSS 0.95% | 18 November 2009 |
| CVE-2009-3973 | SQL injection vulnerability in index.php in Turnkey Arcade Script allows remote attackers to execute arbitrary SQL commands via the id parameter in a browse action, a different vector than CVE-2008-5629. | EXPLOIT ×2 ✓HIGH 7.5EPSS 0.97% | 18 November 2009 |
| CVE-2009-3972 | SQL injection vulnerability in the Q-Proje Siirler Bileseni (com_siirler) component 1.2 RC for Joomla! allows remote attackers to execute arbitrary SQL commands via the sid parameter in an sdetay action to index.php. | EXPLOIT ✓HIGH 7.5EPSS 0.96% | 18 November 2009 |
| CVE-2009-3971 | SQL injection vulnerability in the jTips (com_jtips) component 1.0.7 and 1.0.9 for Joomla! allows remote attackers to execute arbitrary SQL commands via the season parameter in a ladder action to index.php. | EXPLOIT ✓HIGH 7.5EPSS 0.96% | 18 November 2009 |
| CVE-2009-3970 | SQL injection vulnerability in index.php in PHP Dir Submit (aka WebsiteSubmitter or Submitter Script) allows remote authenticated users to execute arbitrary SQL commands via the aid parameter in a showarticle action. | EXPLOIT ✓MEDIUM 6.5EPSS 0.89% | 18 November 2009 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.