Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
395,699 CVEs1,716 in CISA KEV17,392 with EPSS ≥ 10%25,049 with a public exploitUpdated 21 September 2026
25,049 results · page 54 of 501
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2018-18419 | Stored XSS has been discovered in the upload section of ARDAWAN.COM User Management 1.1, as demonstrated by a .jpg filename to the /account URI. | EXPLOITMEDIUM 5.4EPSS 1.64% | 19 October 2018 |
| CVE-2018-18417 | In the 3.1 version of Ekushey Project Manager CRM, Stored XSS has been discovered in the input and upload sections, as demonstrated by the name parameter to the index.php/admin/client/create URI. | EXPLOITMEDIUM 5.4EPSS 1.64% | 19 October 2018 |
| CVE-2018-18416 | LANGO Codeigniter Multilingual Script 1.0 has XSS in the input and upload sections, as demonstrated by the site_name parameter to the admin/settings/update URI. | EXPLOITMEDIUM 4.8EPSS 1.65% | 19 October 2018 |
| CVE-2015-4633 | Multiple SQL injection vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and 3.20.x before 3.20.1 allow (1) remote attackers to execute arbitrary SQL commands via the number parameter to opac-tags_subject.pl in… | EXPLOITCRITICAL 9.8EPSS 6.07% | 18 October 2018 |
| CVE-2015-4632 | Multiple directory traversal vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and 3.20.x before 3.20.1 allow remote attackers to read arbitrary files via a ..%2f (dot dot encoded slash) in the template_path… | EXPLOITHIGH 7.5EPSS 51.8% | 18 October 2018 |
| CVE-2015-4631 | Multiple cross-site scripting (XSS) vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and 3.20.x before 3.20.1 allow remote attackers to inject arbitrary web script or HTML via the (1) tag parameter to… | EXPLOITMEDIUM 5.4EPSS 3.71% | 18 October 2018 |
| CVE-2015-4630 | Multiple cross-site request forgery (CSRF) vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and 3.20.x before 3.20.1 allow remote attackers to (1) hijack the authentication of administrators for requests that… | EXPLOITHIGH 8.0EPSS 2.97% | 18 October 2018 |
| CVE-2018-10824 | An attacker having a directory traversal (or LFI) can easily get full router access. | EXPLOITCRITICAL 9.8EPSS 12.5% | 17 October 2018 |
| CVE-2018-10823 | An authenticated attacker may execute arbitrary code by injecting the shell command into the chkisg.htm page Sip parameter. | EXPLOITHIGH 8.8EPSS 77.7% | 17 October 2018 |
| CVE-2018-10822 | Directory traversal vulnerability in the web interface on D-Link DWR-116 through 1.06, DIR-140L through 1.02, DIR-640L through 1.02, DWR-512 through 2.02, DWR-712 through 2.02, DWR-912 through 2.02, DWR-921 through 2.02, and DWR-111 through 1.01 devices… | EXPLOITHIGH 7.5EPSS 39.3% | 17 October 2018 |
| CVE-2018-10933 | A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4. | EXPLOIT ×2 ✓CRITICAL 9.1EPSS 91.8% | 17 October 2018 |
| CVE-2018-3245 | Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). | EXPLOITCRITICAL 9.8EPSS 94.3% | 17 October 2018 |
| CVE-2018-18308 | In the 4.2.23 version of BigTree, a Stored XSS vulnerability has been discovered in /admin/ajax/file-browser/upload/ (aka the image upload area). | EXPLOITMEDIUM 6.1EPSS 3.65% | 16 October 2018 |
| CVE-2018-17980 | NoMachine before 5.3.27 and 6.x before 6.3.6 allows attackers to gain privileges via a Trojan horse wintab32.dll file located in the same directory as a .nxs file, as demonstrated by a scenario where the .nxs file and the DLL are in the current working… | EXPLOITHIGH 7.8EPSS 4.55% | 15 October 2018 |
| CVE-2018-17961 | Artifex Ghostscript 9.25 and earlier allows attackers to bypass a sandbox protection mechanism via vectors involving errorhandler setup. | EXPLOIT ✓HIGH 8.6EPSS 9.98% | 15 October 2018 |
| CVE-2018-18324 | CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.480 has XSS via the admin/fileManager2.php fm_current_dir parameter, or the admin/index.php module, service_start, service_fullstatus, service_restart, service_stop, or file (within the file_editor)… | EXPLOITMEDIUM 6.1EPSS 3.21% | 15 October 2018 |
| CVE-2018-18323 | CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.480 has Local File Inclusion via directory traversal with an admin/index.php?module=file_editor&file=/../ URI. | EXPLOITHIGH 7.5EPSS 70.7% | 15 October 2018 |
| CVE-2018-18322 | CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.480 has Command Injection via shell metacharacters in the admin/index.php service_start, service_restart, service_fullstatus, or service_stop parameter. | EXPLOITCRITICAL 9.8EPSS 15.1% | 15 October 2018 |
| CVE-2018-9206 | Unauthenticated arbitrary file upload vulnerability in Blueimp jQuery-File-Upload <= v9.22.0 | EXPLOIT ×3 ✓CRITICAL 9.8EPSS 97.3% | 11 October 2018 |
| CVE-2018-17784 | Multiple vulnerabilities in YUI and FlashCanvas embedded in SugarCRM Community Edition 6.5.26 could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack on a targeted system. | EXPLOITMEDIUM 6.1EPSS 4.35% | 10 October 2018 |
| CVE-2018-12596 | Episerver Ektron CMS before 9.0 SP3 Site CU 31, 9.1 before SP3 Site CU 45, or 9.2 before SP2 Site CU 22 allows remote attackers to call aspx pages via the "activateuser.aspx" page, even if a page is located under the /WorkArea/ path, which is forbidden… | EXPLOITCRITICAL 9.8EPSS 22.4% | 10 October 2018 |
| CVE-2018-8533 | An information disclosure vulnerability exists in Microsoft SQL Server Management Studio (SSMS) when parsing malicious XML content containing a reference to an external entity, aka "SQL Server Management Studio Information Disclosure Vulnerability."… | EXPLOIT ✓MEDIUM 5.5EPSS 23.4% | 10 October 2018 |
| CVE-2018-8532 | An information disclosure vulnerability exists in Microsoft SQL Server Management Studio (SSMS) when parsing a malicious XMLA file containing a reference to an external entity, aka "SQL Server Management Studio Information Disclosure Vulnerability."… | EXPLOIT ✓MEDIUM 5.5EPSS 23.4% | 10 October 2018 |
| CVE-2018-8527 | An information disclosure vulnerability exists in Microsoft SQL Server Management Studio (SSMS) when parsing a malicious XEL file containing a reference to an external entity, aka "SQL Server Management Studio Information Disclosure Vulnerability." This… | EXPLOIT ✓MEDIUM 5.5EPSS 23.4% | 10 October 2018 |
| CVE-2018-8453 | Microsoft Win32k Privilege Escalation Vulnerability | KEVEXPLOIT ✓HIGH 7.8EPSS 70.0% | 10 October 2018 |
| CVE-2018-8413 | A remote code execution vulnerability exists when "Windows Theme API" does not properly decompress files, aka "Windows Theme API Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2019,… | EXPLOITHIGH 7.8EPSS 46.3% | 10 October 2018 |
| CVE-2018-8411 | An elevation of privilege vulnerability exists when NTFS improperly checks access, aka "NTFS Elevation of Privilege Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server… | EXPLOIT ✓HIGH 7.8EPSS 3.07% | 10 October 2018 |
| CVE-2018-18065 | _set_key in agent/helpers/table_container.c in Net-SNMP before 5.8 has a NULL Pointer Exception bug that can be used by an authenticated attacker to remotely cause the instance to crash via a crafted UDP packet, resulting in Denial of Service. | EXPLOITMEDIUM 6.5EPSS 17.2% | 8 October 2018 |
| CVE-2018-17775 | Seqrite End Point Security v7.4 has "Everyone: (F)" permission for %PROGRAMFILES%\Seqrite\Seqrite, which allows local users to gain privileges by replacing an executable file with a Trojan horse. | EXPLOITHIGH 7.8EPSS 1.03% | 8 October 2018 |
| CVE-2018-17443 | The 'sitename' parameter of the UpdateSite endpoint is vulnerable to stored XSS. | EXPLOIT ✓MEDIUM 6.1EPSS 5.66% | 8 October 2018 |
| CVE-2018-17442 | An unrestricted file upload vulnerability in the onUploadLogPic endpoint allows remote authenticated users to execute arbitrary PHP code. | EXPLOIT ✓HIGH 8.8EPSS 14.2% | 8 October 2018 |
| CVE-2018-17441 | The 'username' parameter of the addUser endpoint is vulnerable to stored XSS. | EXPLOIT ✓MEDIUM 6.1EPSS 5.66% | 8 October 2018 |
| CVE-2018-17440 | They expose an FTP server that serves by default on port 9000 and has hardcoded credentials (admin, admin). | EXPLOIT ✓CRITICAL 9.8EPSS 38.5% | 8 October 2018 |
| CVE-2018-17456 | Git before 2.14.5, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2.17.x before 2.17.2, 2.18.x before 2.18.1, and 2.19.x before 2.19.1 allows remote code execution during processing of a recursive "git clone" of a superproject if a .gitmodules file has a… | EXPLOIT ×2CRITICAL 9.8EPSS 97.4% | 6 October 2018 |
| CVE-2018-13042 | The 1Password application 6.8 for Android is affected by a Denial Of Service vulnerability. | EXPLOITMEDIUM 5.9EPSS 7.89% | 5 October 2018 |
| CVE-2018-15379 | A vulnerability in which the HTTP web server for Cisco Prime Infrastructure (PI) has unrestricted directory permissions could allow an unauthenticated, remote attacker to upload an arbitrary file. | EXPLOITCRITICAL 9.8EPSS 86.2% | 5 October 2018 |
| CVE-2018-0438 | A vulnerability in the Cisco Umbrella Enterprise Roaming Client (ERC) could allow an authenticated, local attacker to elevate privileges to Administrator. | EXPLOITHIGH 7.8EPSS 1.37% | 5 October 2018 |
| CVE-2018-0437 | A vulnerability in the Cisco Umbrella Enterprise Roaming Client (ERC) could allow an authenticated, local attacker to elevate privileges to Administrator. | EXPLOITHIGH 7.8EPSS 1.52% | 5 October 2018 |
| CVE-2018-11784 | When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g. redirecting to '/foo/' when the user requested '/foo') a specially crafted URL could be used to cause… | EXPLOITMEDIUM 4.3EPSS 94.5% | 4 October 2018 |
| CVE-2018-17553 | An "Unrestricted Upload of File with Dangerous Type" issue with directory traversal in navigate_upload.php in Naviwebs Navigate CMS 2.8 allows authenticated attackers to achieve remote code execution via a POST request with engine=picnik and… | EXPLOIT ✓HIGH 8.8EPSS 79.0% | 3 October 2018 |
| CVE-2018-17552 | SQL Injection in login.php in Naviwebs Navigate CMS 2.8 allows remote attackers to bypass authentication via the navigate-user cookie. | EXPLOIT ✓CRITICAL 9.8EPSS 84.1% | 3 October 2018 |
| CVE-2018-17428 | There is SQL injection via the w2001/index.php?scelta=campi biblio parameter. | EXPLOITCRITICAL 9.8EPSS 2.84% | 3 October 2018 |
| CVE-2018-17408 | Stack-based buffer overflows in Zahir Accounting Enterprise Plus 6 through build 10b allow remote attackers to execute arbitrary code via a crafted CSV file that is accessed through the Import CSV File menu. | EXPLOIT ×2 ✓HIGH 7.8EPSS 19.0% | 3 October 2018 |
| CVE-2018-9515 | In sdcardfs_create and sdcardfs_mkdir of inode.c, there is a possible memory corruption due to improper locking. | EXPLOIT ✓HIGH 7.8EPSS 0.71% | 2 October 2018 |
| CVE-2018-17593 | AirTies Air 5453 devices with software 1.0.0.18 have XSS via the top.html productboardtype parameter. | EXPLOITMEDIUM 6.1EPSS 2.30% | 2 October 2018 |
| CVE-2018-17591 | AirTies Air 5343v2 devices with software 1.0.0.18 have XSS via the top.html productboardtype parameter. | EXPLOITMEDIUM 6.1EPSS 2.30% | 2 October 2018 |
| CVE-2018-17590 | AirTies Air 5442 devices with software 1.0.0.18 have XSS via the top.html productboardtype parameter. | EXPLOITMEDIUM 6.1EPSS 2.30% | 2 October 2018 |
| CVE-2018-17588 | AirTies Air 5021 devices with software 1.0.0.18 have XSS via the top.html productboardtype parameter. | EXPLOITMEDIUM 6.1EPSS 2.32% | 2 October 2018 |
| CVE-2018-17587 | AirTies Air 5750 devices with software 1.0.0.18 have XSS via the top.html productboardtype parameter. | EXPLOITMEDIUM 6.1EPSS 2.32% | 2 October 2018 |
| CVE-2018-17832 | XSS exists in WUZHI CMS 2.0 via the index.php v or f parameter. | EXPLOITMEDIUM 6.1EPSS 2.27% | 1 October 2018 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.