Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
The year’s CVE activity with KEV, EPSS and exploit data as a PDF: heatmaps, a vendor treemap, and the lists worth checking against your estate.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
398,020 CVEs1,725 in CISA KEV17,253 with EPSS ≥ 10%25,049 with a public exploitUpdated 25 September 2026
25,049 results · page 244 of 501
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2009-0920 | Stack-based buffer overflow in OvCgi/Toolbar.exe in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allows remote attackers to execute arbitrary code via a long OvOSLocale cookie, a variant of CVE-2008-0067. | EXPLOIT ✓HIGH 7.5EPSS 74.9% | 25 March 2009 |
| CVE-2009-1059 | Stack-based buffer overflow in Trident PowerZip 7.2 might allow remote attackers to execute arbitrary code via a crafted .zip file. | EXPLOIT ✓HIGH 9.3EPSS 4.81% | 24 March 2009 |
| CVE-2009-1058 | Stack-based buffer overflow in ZipGenius might allow remote attackers to execute arbitrary code via a crafted .zip file that triggers an SEH overwrite. | EXPLOIT ✓HIGH 10.0EPSS 5.95% | 24 March 2009 |
| CVE-2009-1057 | 3.0 allows remote attackers to execute arbitrary code via a crafted .zip file that triggers memory corruption, related to a "format string buffer overflow." NOTE: CVE has not investigated whether the specified file.zip file can be used for exploitation… | EXPLOIT ✓HIGH 10.0EPSS 7.08% | 24 March 2009 |
| CVE-2009-1050 | Bloginator 1A allows remote attackers to bypass authentication and gain administrative access by setting the identifyYourself cookie. | EXPLOIT ✓HIGH 7.5EPSS 2.87% | 24 March 2009 |
| CVE-2009-1049 | SQL injection vulnerability in articleCall.php in Bloginator 1A allows remote attackers to execute arbitrary SQL commands via the id parameter. | EXPLOIT ×2 ✓HIGH 7.5EPSS 1.38% | 24 March 2009 |
| CVE-2008-6515 | Cross-site scripting (XSS) vulnerability in Fritz Berger yet another php photo album - next generation (yappa-ng) allows remote attackers to inject arbitrary web script or HTML via the query string to the default URI. | EXPLOIT ✓MEDIUM 4.3EPSS 1.46% | 24 March 2009 |
| CVE-2008-6513 | Unrestricted file upload vulnerability in saa.php in Andy's PHP Knowledgebase (aphpkb) 0.92.9 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a link that is listed by authors.php. | EXPLOIT ✓MEDIUM 6.8EPSS 3.91% | 24 March 2009 |
| CVE-2008-6511 | Open redirect vulnerability in login.jsp in Openfire 3.6.0a and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the url parameter. | EXPLOIT ✓MEDIUM 5.8EPSS 1.83% | 23 March 2009 |
| CVE-2008-6510 | Cross-site scripting (XSS) vulnerability in login.jsp in the Admin Console in Openfire 3.6.0a and earlier allows remote attackers to inject arbitrary web script or HTML via the url parameter. | EXPLOIT ✓MEDIUM 4.3EPSS 1.78% | 23 March 2009 |
| CVE-2008-6509 | SQL injection vulnerability in CallLogDAO in SIP Plugin in Openfire 3.6.0a and earlier allows remote attackers to execute arbitrary SQL commands via the type parameter to sipark-log-summary.jsp. | EXPLOIT ✓HIGH 7.5EPSS 2.01% | 23 March 2009 |
| CVE-2008-6508 | Directory traversal vulnerability in the AuthCheck filter in the Admin Console in Openfire 3.6.0a and earlier allows remote attackers to bypass authentication and access the admin interface via a .. | EXPLOIT ×2 ✓HIGH 7.5EPSS 83.7% | 23 March 2009 |
| CVE-2009-1046 | The console selection feature in the Linux kernel 2.6.28 before 2.6.28.4, 2.6.25, and possibly earlier versions, when the UTF-8 console is used, allows physically proximate attackers to cause a denial of service (memory corruption) by selecting a small… | EXPLOIT ✓MEDIUM 4.7EPSS 0.78% | 23 March 2009 |
| CVE-2009-1045 | requests/status.xml in VLC 0.9.8a allows remote attackers to cause a denial of service (stack consumption and crash) via a long input argument in an in_play action. | EXPLOIT ✓MEDIUM 5.0EPSS 9.22% | 23 March 2009 |
| CVE-2008-6505 | Multiple directory traversal vulnerabilities in Apache Struts 2.0.x before 2.0.12 and 2.1.x before 2.1.3 allow remote attackers to read arbitrary files via a ..%252f (encoded dot dot slash) in a URI with a /struts/ path, related to (1) FilterDispatcher… | EXPLOIT ✓MEDIUM 5.0EPSS 72.7% | 23 March 2009 |
| CVE-2008-6504 | ParametersInterceptor in OpenSymphony XWork 2.0.x before 2.0.6 and 2.1.x before 2.1.2, as used in Apache Struts and other products, does not properly restrict # (pound sign) references to context objects, which allows remote attackers to execute… | EXPLOIT ✓MEDIUM 5.0EPSS 36.6% | 23 March 2009 |
| CVE-2009-1040 | Buffer overflow in WinAsm Studio 5.1.5.0 allows user-assisted remote attackers to execute arbitrary code via a crafted project (.wap) file. | EXPLOIT ✓HIGH 9.3EPSS 5.76% | 20 March 2009 |
| CVE-2009-1039 | Buffer overflow in CDex 1.70b2 allows remote attackers to execute arbitrary code via a crafted Info header in an Ogg Vorbis (.ogg) file. | EXPLOIT ✓HIGH 7.5EPSS 5.33% | 20 March 2009 |
| CVE-2009-1038 | Multiple SQL injection vulnerabilities in YAP Blog 1.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) image_id parameter to comments.php, and remote authenticated administrators to execute arbitrary SQL commands via the (2) user… | EXPLOIT ×2 ✓MEDIUM 6.5EPSS 0.88% | 20 March 2009 |
| CVE-2009-1033 | SQL injection vulnerability in misc.php in DeluxeBB 1.3 and earlier allows remote attackers to execute arbitrary SQL commands via the qorder parameter, a different vector than CVE-2005-2989 and CVE-2006-2503. | EXPLOIT ✓HIGH 7.5EPSS 1.02% | 20 March 2009 |
| CVE-2009-1032 | SQL injection vulnerability in gallery_list.php in YABSoft Advanced Image Hosting (AIH) Script 2.3 allows remote attackers to execute arbitrary SQL commands via the gal parameter. | EXPLOIT ✓HIGH 7.5EPSS 1.02% | 20 March 2009 |
| CVE-2008-6503 | Multiple cross-site scripting (XSS) vulnerabilities in PrestaShop 1.1.0.3 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) admin/login.php and (2) order.php. | EXPLOIT ×2 ✓MEDIUM 4.3EPSS 1.52% | 20 March 2009 |
| CVE-2008-6502 | Directory traversal vulnerability in Pro Chat Rooms 3.0.2 allows remote authenticated users to select an arbitrary local PHP script as an avatar via a .. | EXPLOIT ✓MEDIUM 4.6EPSS 1.50% | 20 March 2009 |
| CVE-2008-6501 | Cross-site scripting (XSS) vulnerability in profiles/index.php in Pro Chat Rooms 3.0.2 allows remote attackers to inject arbitrary web script or HTML via the gud parameter. | EXPLOIT ✓MEDIUM 4.3EPSS 1.50% | 20 March 2009 |
| CVE-2008-6500 | Cross-site scripting (XSS) vulnerability in CodeToad ASP Shopping Cart Script allows remote attackers to inject arbitrary web script or HTML via the query string to the default URI. | EXPLOIT ✓MEDIUM 4.3EPSS 1.44% | 20 March 2009 |
| CVE-2009-1031 | Directory traversal vulnerability in the FTP server in Rhino Software Serv-U File Server 7.0.0.1 through 7.4.0.1 allows remote attackers to create arbitrary directories via a \.. | EXPLOIT ✓HIGH 7.8EPSS 11.2% | 20 March 2009 |
| CVE-2009-1030 | Cross-site scripting (XSS) vulnerability in the choose_primary_blog function in wp-includes/wpmu-functions.php in WordPress MU (WPMU) before 2.7 allows remote attackers to inject arbitrary web script or HTML via the HTTP Host header. | EXPLOIT ✓MEDIUM 4.3EPSS 4.66% | 20 March 2009 |
| CVE-2009-1029 | Stack-based buffer overflow in POP Peeper 3.4.0.0 and earlier allows remote POP3 servers to execute arbitrary code via a long Date header, related to Imap.dll. | EXPLOIT ×3 ✓HIGH 9.3EPSS 31.8% | 20 March 2009 |
| CVE-2009-1028 | Stack-based buffer overflow in ediSys eZip Wizard 3.0 allows remote attackers to execute arbitrary code via a crafted .zip file. | EXPLOIT ×3 ✓HIGH 9.3EPSS 33.0% | 20 March 2009 |
| CVE-2009-1026 | Multiple SQL injection vulnerabilities in login.php in Kim Websites 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters. | EXPLOIT ✓HIGH 7.5EPSS 0.99% | 20 March 2009 |
| CVE-2009-1025 | PHP remote file inclusion vulnerability in linkadmin.php in Beerwin PHPLinkAdmin 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the page parameter. | EXPLOIT ✓HIGH 7.5EPSS 40.1% | 20 March 2009 |
| CVE-2009-1024 | Multiple SQL injection vulnerabilities in Beerwin PHPLinkAdmin 1.0 allow remote attackers to execute arbitrary SQL commands via the linkid parameter to edlink.php, and unspecified other vectors. | EXPLOIT ✓HIGH 7.5EPSS 1.34% | 20 March 2009 |
| CVE-2009-1023 | SQL injection vulnerability in index.php in phpComasy 0.9.1 allows remote attackers to execute arbitrary SQL commands via the entry_id parameter. | EXPLOIT ✓HIGH 7.5EPSS 1.16% | 20 March 2009 |
| CVE-2009-1022 | Heap-based buffer overflow in the Preview/ Set Segment function in Gretech GOMlab GOM Encoder 1.0.0.11 and earlier allows user-assisted remote attackers to cause a denial of service (memory corruption and application crash) or execute arbitrary code via… | EXPLOIT ✓HIGH 9.3EPSS 7.42% | 20 March 2009 |
| CVE-2008-6499 | security/xamppsecurity.php in XAMPP 1.6.8 performs an extract operation on the SERVER superglobal array, which allows remote attackers to spoof critical variables, as demonstrated by setting the REMOTE_ADDR variable to 127.0.0.1. | EXPLOIT ✓MEDIUM 5.5EPSS 1.56% | 20 March 2009 |
| CVE-2008-6498 | Cross-site request forgery (CSRF) vulnerability in security/xamppsecurity.php in XAMPP 1.6.8 allows remote attackers to hijack the authentication of users for requests that change a certain .htaccess password via the xampppasswd parameter. | EXPLOIT ×2 ✓MEDIUM 6.8EPSS 1.05% | 20 March 2009 |
| CVE-2008-6497 | The Neostrada Livebox ADSL Router allows remote attackers to cause a denial of service (network outage) via multiple HTTP requests for the /- URI. | EXPLOIT ✓HIGH 7.8EPSS 9.68% | 20 March 2009 |
| CVE-2008-6496 | Insecure method vulnerability in the VSPDFEditorX.VSPDFEdit ActiveX control in VSPDFEditorX.ocx 1.0.200.0 in VISAGESOFT eXPert PDF EditorX allows remote attackers to create or overwrite arbitrary files via the first argument to the extractPagesToFile… | EXPLOIT ✓HIGH 8.8EPSS 2.69% | 20 March 2009 |
| CVE-2008-6495 | Cross-site scripting (XSS) vulnerability in index.php in Fritz Berger yet another php photo album - next generation (yappa-ng) 2.3.2 allows remote attackers to inject arbitrary web script or HTML via the album parameter. | EXPLOIT ✓MEDIUM 4.3EPSS 3.72% | 20 March 2009 |
| CVE-2008-6494 | ASP User Engine.NET stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for users.mdb. | EXPLOIT ✓MEDIUM 5.0EPSS 2.23% | 20 March 2009 |
| CVE-2008-6493 | Easy Content Management Publishing stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for Database/News.mdb. | EXPLOIT ✓MEDIUM 5.0EPSS 2.23% | 20 March 2009 |
| CVE-2008-6492 | Unrestricted file upload vulnerability in process.php in Tizag Countdown Creator 3 allows remote attackers to execute arbitrary code by uploading a file with an executable extension via index.php, then accessing the uploaded file via a direct request to… | EXPLOIT ✓MEDIUM 6.8EPSS 3.61% | 20 March 2009 |
| CVE-2009-0968 | SQL injection vulnerability in fmoblog.php in the fMoblog plugin 2.1 for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter to index.php. | EXPLOIT ✓HIGH 7.5EPSS 3.58% | 19 March 2009 |
| CVE-2009-0967 | The FTP server in Serv-U 7.0.0.1 through 7.4.0.1 allows remote authenticated users to cause a denial of service (service hang) via a large number of SMNT commands without an argument. | EXPLOIT ✓MEDIUM 4.0EPSS 7.03% | 19 March 2009 |
| CVE-2009-0966 | PHP remote file inclusion vulnerability in cross.php in YABSoft Mega File Hosting 1.2 allows remote attackers to execute arbitrary PHP code via a URL in the url parameter. | EXPLOIT ✓HIGH 7.5EPSS 2.54% | 19 March 2009 |
| CVE-2009-0965 | SQL injection vulnerability in functions/browse.php in Ganesha Digital Library (GDL) 4.0 and 4.2 allows remote attackers to execute arbitrary SQL commands via the node parameter in a browse action to gdl.php. | EXPLOIT ✓HIGH 7.5EPSS 1.02% | 19 March 2009 |
| CVE-2009-0964 | UserView_list.php in PHPRunner 4.2, and possibly earlier, stores passwords in cleartext in the database, which allows attackers to gain privileges. | EXPLOIT ✓HIGH 7.5EPSS 1.92% | 19 March 2009 |
| CVE-2009-0963 | Multiple SQL injection vulnerabilities in PHPRunner 4.2, and possibly earlier, allow remote attackers to execute arbitrary SQL commands via the SearchField parameter to (1) UserView_list.php, (2) orders_list.php, (3) users_list.php, and (4)… | EXPLOIT ✓HIGH 7.5EPSS 2.05% | 19 March 2009 |
| CVE-2009-0927 | Adobe Reader and Adobe Acrobat Stack-Based Buffer Overflow Vulnerability | KEVEXPLOIT ×4 ✓HIGH 8.8EPSS 96.6% | 19 March 2009 |
| CVE-2008-6491 | PHP remote file inclusion vulnerability in connexion.php in PHPGKit 0.9 allows remote attackers to execute arbitrary PHP code via a URL in the DOCUMENT_ROOT parameter. | EXPLOIT ✓HIGH 7.5EPSS 2.28% | 19 March 2009 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.