Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
395,699 CVEs1,716 in CISA KEV17,392 with EPSS ≥ 10%25,049 with a public exploitUpdated 21 September 2026
25,049 results · page 58 of 501
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2018-13859 | MusicCenter / Trivum Multiroom Setup Tool V8.76 - SNR 8604.26 - C4 Professional before V9.34 build 13381 - 12.07.18, allow unauthorized remote attackers to reset the authentication via the "/xml/system/setAttribute.xml" URL, using the GET request… | EXPLOITCRITICAL 9.8EPSS 17.9% | 17 July 2018 |
| CVE-2018-0710 | Command injection vulnerability in SSH of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated users to run arbitrary commands. | EXPLOIT ✓HIGH 8.8EPSS 14.1% | 17 July 2018 |
| CVE-2018-0709 | Command injection vulnerability in date of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated users to run arbitrary commands. | EXPLOIT ✓HIGH 8.8EPSS 13.4% | 17 July 2018 |
| CVE-2018-0708 | Command injection vulnerability in networking of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated users to run arbitrary commands. | EXPLOIT ✓HIGH 8.8EPSS 26.0% | 17 July 2018 |
| CVE-2018-0707 | Command injection vulnerability in change password of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated users to run arbitrary commands. | EXPLOIT ×2 ✓HIGH 7.2EPSS 58.8% | 17 July 2018 |
| CVE-2018-0706 | Exposure of Private Information in QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated users to access sensitive information. | EXPLOIT ×2 ✓HIGH 8.8EPSS 48.3% | 17 July 2018 |
| CVE-2018-13832 | Multiple Persistent cross-site scripting (XSS) issues in the Techotronic all-in-one-favicon (aka All In One Favicon) plugin 4.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via Apple-Text, GIF-Text, ICO-Text, PNG-Text, or… | EXPLOITMEDIUM 4.8EPSS 2.00% | 16 July 2018 |
| CVE-2018-12584 | The ConnectionBase::preparseNewBytes function in resip/stack/ConnectionBase.cxx in reSIProcate through 1.10.2 allows remote attackers to cause a denial of service (buffer overflow) or possibly execute arbitrary code when TLS communication is enabled. | EXPLOITCRITICAL 9.8EPSS 24.3% | 16 July 2018 |
| CVE-2018-13981 | The websites that were built from Zeta Producer Desktop CMS before 14.2.1 are vulnerable to unauthenticated remote code execution due to a default component that permits arbitrary upload of PHP files, because the formmailer widget blocks .php files but… | EXPLOITCRITICAL 9.8EPSS 17.1% | 16 July 2018 |
| CVE-2018-13980 | The websites that were built from Zeta Producer Desktop CMS before 14.2.1 are vulnerable to unauthenticated file disclosure if the plugin "filebrowser" is installed, because of assets/php/filebrowser/filebrowser.main.php?file=../ directory traversal. | EXPLOITMEDIUM 5.5EPSS 6.90% | 16 July 2018 |
| CVE-2018-14064 | The uc-http service 1.0.0 on VelotiSmart WiFi B-380 camera devices allows Directory Traversal, as demonstrated by /../../etc/passwd on TCP port 80. | EXPLOITCRITICAL 9.8EPSS 37.2% | 15 July 2018 |
| CVE-2016-6566 | An unauthenticated remote attacker may be able to modify the POST request and insert a SQL query which may then be executed by the backend server. eTRAKiT 3.2.1.17 was tested, but other versions may also be vulnerable. | EXPLOITCRITICAL 9.8EPSS 11.6% | 13 July 2018 |
| CVE-2016-6563 | Processing malformed SOAP messages when performing the HNAP Login action causes a buffer overflow in the stack in some D-Link DIR routers. | EXPLOIT ✓CRITICAL 9.8EPSS 79.7% | 13 July 2018 |
| CVE-2018-10018 | The GDASPAMLib.AntiSpam ActiveX control ASK\GDASpam.dll in G DATA Total Security 25.4.0.3 has a buffer overflow via a long IsBlackListed argument. | EXPLOITHIGH 8.8EPSS 6.19% | 13 July 2018 |
| CVE-2018-14029 | CSRF vulnerability in admin/user/edit in Creatiwity wityCMS 0.6.2 allows an attacker to take over a user account, as demonstrated by modifying the account's email field. | EXPLOITHIGH 8.8EPSS 2.48% | 13 July 2018 |
| CVE-2018-13458 | qh_core in Nagios Core 4.4.1 and earlier is prone to a NULL pointer dereference vulnerability, which allows attackers to cause a local denial-of-service condition by sending a crafted payload to the listening UNIX socket. | EXPLOITMEDIUM 5.5EPSS 4.45% | 12 July 2018 |
| CVE-2018-13457 | qh_echo in Nagios Core 4.4.1 and earlier is prone to a NULL pointer dereference vulnerability, which allows attackers to cause a local denial-of-service condition by sending a crafted payload to the listening UNIX socket. | EXPLOITMEDIUM 5.5EPSS 4.45% | 12 July 2018 |
| CVE-2018-13441 | qh_help in Nagios Core version 4.4.1 and earlier is prone to a NULL pointer dereference vulnerability, which allows attacker to cause a local denial-of-service condition by sending a crafted payload to the listening UNIX socket. | EXPLOITMEDIUM 5.5EPSS 1.34% | 12 July 2018 |
| CVE-2018-12981 | The vulnerability can be exploited by authenticated and unauthenticated users by sending special crafted requests to the web server allowing injecting code within the WBM. | EXPLOIT ✓MEDIUM 5.4EPSS 5.17% | 12 July 2018 |
| CVE-2018-12980 | The vulnerability allows an authenticated user to upload arbitrary files to the file system with the permissions of the web server. | EXPLOIT ✓HIGH 8.8EPSS 29.8% | 12 July 2018 |
| CVE-2018-12979 | Weak permissions allow an authenticated user to overwrite critical files by abusing the unrestricted file upload in the WBM. | EXPLOIT ✓MEDIUM 6.5EPSS 7.78% | 12 July 2018 |
| CVE-2018-14009 | Codiad through 2.8.4 allows Remote Code Execution, a different vulnerability than CVE-2017-11366 and CVE-2017-15689. | EXPLOIT ✓CRITICAL 9.8EPSS 38.0% | 12 July 2018 |
| CVE-2018-12463 | An XML external entity (XXE) vulnerability in Fortify Software Security Center (SSC), version 17.1, 17.2, 18.1 allows remote unauthenticated users to read arbitrary files or conduct server-side request forgery (SSRF) attacks via a crafted DTD in an XML… | EXPLOIT ✓CRITICAL 9.8EPSS 13.8% | 12 July 2018 |
| CVE-2018-13989 | Grundig Smart Inter@ctive TV 3.0 devices allow CSRF attacks via a POST request to TCP port 8085 containing a predictable ID value, as demonstrated by a /sendrcpackage?keyid=-2544&keysymbol=-4081 request to shut off the device. | EXPLOITHIGH 8.8EPSS 2.03% | 11 July 2018 |
| CVE-2018-11529 | VideoLAN VLC media player 2.2.x is prone to a use after free vulnerability which an attacker can leverage to execute arbitrary code via crafted MKV files. | EXPLOIT ✓HIGH 8.0EPSS 37.0% | 11 July 2018 |
| CVE-2017-16709 | Crestron Airmedia AM-100 devices with firmware before 1.6.0 and AM-101 devices with firmware before 2.7.0 allows remote authenticated administrators to execute arbitrary code via unspecified vectors. | EXPLOIT ✓HIGH 7.2EPSS 72.0% | 11 July 2018 |
| CVE-2018-8298 | ChakraCore Scripting Engine Type Confusion Vulnerability | KEVEXPLOIT ✓HIGH 7.5EPSS 74.5% | 11 July 2018 |
| CVE-2018-8291 | A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka "Scripting Engine Memory Corruption Vulnerability." This affects ChakraCore, Internet Explorer 11, Microsoft Edge. | EXPLOIT ✓HIGH 7.5EPSS 69.0% | 11 July 2018 |
| CVE-2018-8288 | A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka "Scripting Engine Memory Corruption Vulnerability." This affects ChakraCore, Internet Explorer 11, Microsoft Edge. | EXPLOIT ✓HIGH 7.5EPSS 69.0% | 11 July 2018 |
| CVE-2018-8279 | A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. | EXPLOIT ✓HIGH 7.5EPSS 70.7% | 11 July 2018 |
| CVE-2018-13849 | edit_requests.php in yTakkar Instagram-clone through 2018-04-23 has XSS via an onmouseover payload because of an inadequate XSS protection mechanism based on preg_replace. | EXPLOITMEDIUM 6.1EPSS 2.27% | 10 July 2018 |
| CVE-2018-13784 | PrestaShop before 1.6.1.20 and 1.7.x before 1.7.3.4 mishandles cookie encryption in Cookie.php, Rinjdael.php, and Blowfish.php. | EXPLOIT ×2CRITICAL 9.1EPSS 16.5% | 9 July 2018 |
| CVE-2018-13405 | The inode_init_owner function in fs/inode.c in the Linux kernel through 3.16 allows local users to create files with an unintended group ownership, in a scenario where a directory is SGID to a certain group and is writable by a user who is not a member… | EXPLOIT ✓HIGH 7.8EPSS 1.01% | 6 July 2018 |
| CVE-2018-13110 | All ADB broadband gateways / routers based on the Epicentro platform are affected by a privilege escalation vulnerability where attackers can gain access to the command line interface (CLI) if previously disabled by the ISP, escalate their privileges,… | EXPLOITHIGH 7.5EPSS 6.41% | 6 July 2018 |
| CVE-2018-13109 | All ADB broadband gateways / routers based on the Epicentro platform are affected by an authorization bypass vulnerability where attackers are able to access and manipulate settings within the web interface that are forbidden to end users (e.g., by the… | EXPLOITHIGH 7.5EPSS 35.5% | 6 July 2018 |
| CVE-2018-13108 | All ADB broadband gateways / routers based on the Epicentro platform are affected by a local root jailbreak vulnerability where attackers are able to gain root access on the device, and extract further information such as sensitive configuration data of… | EXPLOITHIGH 7.8EPSS 1.58% | 6 July 2018 |
| CVE-2018-11124 | Cross-site scripting (XSS) vulnerability in Attributes functionality in Open-AudIT Community edition before 2.2.2 allows remote attackers to inject arbitrary web script or HTML via a crafted attribute name of an Attribute. | EXPLOITMEDIUM 5.4EPSS 1.87% | 6 July 2018 |
| CVE-2018-8738 | Airties 5444 1.0.0.18 and 5444TT 1.0.0.18 devices allow XSS. | EXPLOITMEDIUM 6.1EPSS 2.27% | 5 July 2018 |
| CVE-2018-12739 | In BEESCMS 4.0, CSRF allows administrators to be added arbitrarily, a related issue to CVE-2018-10266. | EXPLOITHIGH 8.8EPSS 2.35% | 5 July 2018 |
| CVE-2018-12520 | An attacker with foreknowledge of the operating system and standard library in use by the host running the service and the username of the user whose session they're targeting can abuse the deterministic random number generation in order to hijack the… | EXPLOITHIGH 8.1EPSS 10.5% | 5 July 2018 |
| CVE-2018-13134 | TP-Link Archer C1200 1.13 Build 2018/01/24 rel.52299 EU devices have XSS via the PATH_INFO to the /webpages/data URI. | EXPLOITMEDIUM 6.1EPSS 2.33% | 4 July 2018 |
| CVE-2018-7777 | The vulnerability is due to insufficient handling of update_file request parameter on update_module.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. | EXPLOITHIGH 8.8EPSS 31.8% | 3 July 2018 |
| CVE-2018-9276 | Paessler PRTG Network Monitor OS Command Injection Vulnerability | KEVEXPLOITHIGH 7.2EPSS 87.0% | 2 July 2018 |
| CVE-2018-13032 | ECESSA ShieldLink SL175EHQ 10.7.4 devices have CSRF to add superuser accounts via the cgi-bin/pl_web.cgi/util_configlogin_act URI. | EXPLOITHIGH 8.8EPSS 2.25% | 1 July 2018 |
| CVE-2018-12465 | An OS command injection vulnerability in the web administration component of Micro Focus Secure Messaging Gateway (SMG) allows a remote attacker authenticated as a privileged user to execute arbitrary OS commands on the SMG server. | EXPLOITHIGH 7.2EPSS 80.0% | 29 June 2018 |
| CVE-2018-12464 | A SQL injection vulnerability in the web administration and quarantine components of Micro Focus Secure Messaging Gateway allows an unauthenticated remote attacker to execute arbitrary SQL statements against the database. | EXPLOITCRITICAL 9.8EPSS 80.7% | 29 June 2018 |
| CVE-2018-12938 | Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. | EXPLOITUnscoredEPSS — | 28 June 2018 |
| CVE-2018-12589 | Polaris Office 2017 8.1 allows attackers to execute arbitrary code via a Trojan horse puiframeworkproresenu.dll file in the current working directory. | EXPLOITHIGH 7.8EPSS 20.1% | 28 June 2018 |
| CVE-2018-11510 | The ASUSTOR ADM 3.1.0.RFQ3 NAS portal suffers from an unauthenticated remote code execution vulnerability in the portal/apis/aggrecate_js.cgi file by embedding OS commands in the 'script' parameter. | EXPLOIT ×2CRITICAL 9.8EPSS 44.3% | 28 June 2018 |
| CVE-2018-1306 | The PortletV3AnnotatedDemo Multipart Portlet war file code provided in Apache Pluto version 3.0.0 could allow a remote attacker to obtain sensitive information, caused by the failure to restrict path information provided during a file upload. | EXPLOITHIGH 7.5EPSS 43.5% | 27 June 2018 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.