Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
395,841 CVEs1,716 in CISA KEV17,392 with EPSS ≥ 10%25,049 with a public exploitUpdated 21 September 2026
25,049 results · page 81 of 501
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2017-14680 | ZKTeco ZKTime Web 2.0.1.12280 allows remote attackers to obtain sensitive employee metadata via a direct request for a PDF document. | EXPLOITHIGH 7.5EPSS 4.33% | 21 September 2017 |
| CVE-2017-12930 | SQL Injection in the admin interface in TecnoVISION DLX Spot Player4 version >1.5.10 allows remote unauthenticated users to access the web interface as administrator via a crafted password. | EXPLOIT ×2CRITICAL 9.8EPSS 3.10% | 21 September 2017 |
| CVE-2017-12929 | Arbitrary File Upload in resource.php of TecnoVISION DLX Spot Player4 version >1.5.10 allows remote authenticated users to upload arbitrary files leading to Remote Command Execution. | EXPLOIT ×2HIGH 8.8EPSS 10.1% | 21 September 2017 |
| CVE-2015-1187 | D-Link and TRENDnet Multiple Devices Remote Code Execution Vulnerability | KEVEXPLOIT ✓CRITICAL 9.8EPSS 82.9% | 21 September 2017 |
| CVE-2017-14619 | Cross-site scripting (XSS) vulnerability in phpMyFAQ through 2.9.8 allows remote attackers to inject arbitrary web script or HTML via the "Title of your FAQ" field in the Configuration Module. | EXPLOITMEDIUM 6.1EPSS 2.17% | 20 September 2017 |
| CVE-2017-14618 | Cross-site scripting (XSS) vulnerability in inc/PMF/Faq.php in phpMyFAQ through 2.9.8 allows remote attackers to inject arbitrary web script or HTML via the Questions field in an "Add New FAQ" action. | EXPLOITMEDIUM 4.8EPSS 2.43% | 20 September 2017 |
| CVE-2015-7347 | Cross-site scripting (XSS) vulnerability in ZCMS JavaServer Pages Content Management System 1.1. | EXPLOIT ✓MEDIUM 4.8EPSS 1.11% | 20 September 2017 |
| CVE-2015-2826 | WordPress Simple Ads Manager plugin 2.5.94 and 2.5.96 allows remote attackers to obtain sensitive information. | EXPLOITMEDIUM 5.3EPSS 12.8% | 20 September 2017 |
| CVE-2017-12611 | In Apache Struts 2.0.0 through 2.3.33 and 2.5 through 2.5.10.1, using an unintentional expression in a Freemarker tag instead of string literals can lead to a RCE attack. | EXPLOIT ✓CRITICAL 9.8EPSS 87.1% | 20 September 2017 |
| CVE-2015-4075 | The Helpdesk Pro plugin before 1.4.0 for Joomla! allows remote attackers to write to arbitrary .ini files via a crafted language.save task. | EXPLOITHIGH 8.1EPSS 7.38% | 20 September 2017 |
| CVE-2015-4074 | Directory traversal vulnerability in the Helpdesk Pro plugin before 1.4.0 for Joomla! allows remote attackers to read arbitrary files via a .. | EXPLOITHIGH 7.5EPSS 56.5% | 20 September 2017 |
| CVE-2015-4073 | Multiple SQL injection vulnerabilities in the Helpdesk Pro plugin before 1.4.0 for Joomla! allow remote attackers to execute arbitrary SQL commands via the (1) ticket_code or (2) email parameter or (3) remote authenticated users to execute arbitrary SQL… | EXPLOITCRITICAL 9.8EPSS 4.21% | 20 September 2017 |
| CVE-2015-4072 | Multiple cross-site scripting (XSS) vulnerabilities in the Helpdesk Pro plugin before 1.4.0 for Joomla! allow remote attackers to inject arbitrary web script or HTML via vectors related to name and message. | EXPLOITMEDIUM 5.4EPSS 2.92% | 20 September 2017 |
| CVE-2017-8770 | There is LFD (local file disclosure) on BE126 WIFI repeater 1.0 devices that allows attackers to read the entire filesystem on the device via a crafted getpage parameter. | EXPLOITHIGH 7.5EPSS 10.3% | 20 September 2017 |
| CVE-2015-4685 | Polycom RealPresence Resource Manager (aka RPRM) before 8.4 allows local users with access to the plcm account to gain privileges via a script in /var/polycom/cma/upgrade/scripts, related to a sudo misconfiguration. | EXPLOITHIGH 7.0EPSS 1.20% | 19 September 2017 |
| CVE-2015-4684 | Multiple directory traversal vulnerabilities in Polycom RealPresence Resource Manager (aka RPRM) before 8.4 allow (1) remote authenticated users to read arbitrary files via a .. | EXPLOITMEDIUM 6.5EPSS 4.93% | 19 September 2017 |
| CVE-2015-4683 | Polycom RealPresence Resource Manager (aka RPRM) before 8.4 allows attackers to obtain sensitive information and potentially gain privileges by leveraging use of session identifiers as parameters with HTTP GET requests. | EXPLOITCRITICAL 9.8EPSS 6.87% | 19 September 2017 |
| CVE-2015-4682 | Polycom RealPresence Resource Manager (aka RPRM) before 8.4 allows remote authenticated users to obtain the installation path via an HTTP POST request to PlcmRmWeb/JConfigManager. | EXPLOITMEDIUM 6.5EPSS 5.23% | 19 September 2017 |
| CVE-2015-4681 | Polycom RealPresence Resource Manager (aka RPRM) before 8.4 allows local users to have unspecified impact via vectors related to weak passwords. | EXPLOITHIGH 7.8EPSS 1.70% | 19 September 2017 |
| CVE-2014-8686 | CodeIgniter before 2.2.0 makes it easier for attackers to decode session cookies by leveraging fallback to a custom XOR-based encryption scheme when the Mcrypt extension for PHP is not available. | EXPLOIT ✓CRITICAL 9.8EPSS 37.2% | 19 September 2017 |
| CVE-2014-8684 | CodeIgniter before 3.0 and Kohana 3.2.3 and earlier and 3.3.x through 3.3.2 make it easier for remote attackers to spoof session cookies and consequently conduct PHP object injection attacks by leveraging use of standard string comparison operators to… | EXPLOIT ✓CRITICAL 9.8EPSS 71.7% | 19 September 2017 |
| CVE-2017-6315 | Astaro Security Gateway (aka ASG) 7 allows remote attackers to execute arbitrary code via a crafted request to index.plx. | EXPLOITCRITICAL 9.8EPSS 16.6% | 19 September 2017 |
| CVE-2017-14311 | The Winring0x32.sys driver in NetMechanica NetDecision 5.8.2 allows local users to gain privileges via a crafted 0x9C402088 IOCTL call. | EXPLOITHIGH 7.8EPSS 1.02% | 19 September 2017 |
| CVE-2017-14143 | The getUserzoneCookie function in Kaltura before 13.2.0 uses a hardcoded cookie secret to validate cookie signatures, which allows remote attackers to bypass an intended protection mechanism and consequently conduct PHP object injection attacks and… | EXPLOIT ×2 ✓CRITICAL 9.8EPSS 77.4% | 19 September 2017 |
| CVE-2014-9619 | Unrestricted file upload vulnerability in webadmin/ajaxfilemanager/ajaxfilemanager.php in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote authenticated users with admin privileges on the Cloud Manager web console to… | EXPLOITHIGH 7.2EPSS 7.35% | 19 September 2017 |
| CVE-2014-9618 | The Client Filter Admin portal in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to bypass authentication and subsequently create arbitrary profiles via a showdeny action to the default URL. | EXPLOITCRITICAL 9.8EPSS 72.7% | 19 September 2017 |
| CVE-2014-9611 | Netsweeper before 4.0.5 allows remote attackers to bypass authentication and create arbitrary accounts and policies via a request to webadmin/nslam/index.php. | EXPLOITCRITICAL 9.8EPSS 12.7% | 19 September 2017 |
| CVE-2014-9610 | Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to bypass authentication and remove IP addresses from the quarantine via the ip parameter to webadmin/user/quarantine_disable.php. | EXPLOITMEDIUM 5.3EPSS 3.73% | 19 September 2017 |
| CVE-2017-12615 | Apache Tomcat on Windows Remote Code Execution Vulnerability | KEVEXPLOITHIGH 8.1EPSS 99.6% | 19 September 2017 |
| CVE-2017-9798 | Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, or if httpd.conf has certain misconfigurations, aka Optionsbleed. | EXPLOITHIGH 7.5EPSS 95.0% | 18 September 2017 |
| CVE-2017-14244 | An authentication bypass vulnerability on iBall Baton ADSL2+ Home Router FW_iB-LR7011A_1.0.2 devices potentially allows attackers to directly access administrative router settings by crafting URLs with a .cgi extension, as demonstrated by /info.cgi and… | EXPLOITCRITICAL 9.8EPSS 17.1% | 17 September 2017 |
| CVE-2017-14243 | An authentication bypass vulnerability on UTStar WA3002G4 ADSL Broadband Modem WA3002G4-0021.01 devices allows attackers to directly access administrative settings and obtain cleartext credentials from HTML source, as demonstrated by info.cgi,… | EXPLOITCRITICAL 9.8EPSS 14.8% | 17 September 2017 |
| CVE-2014-9463 | functions_vbseo_hook.php in the VBSEO module for vBulletin allows remote authenticated users to execute arbitrary code via the HTTP Referer header to visitormessage.php. | EXPLOIT ✓HIGH 8.8EPSS 14.8% | 15 September 2017 |
| CVE-2017-9805 | Apache Struts Deserialization of Untrusted Data Vulnerability | KEVEXPLOITHIGH 8.1EPSS 99.4% | 15 September 2017 |
| CVE-2017-14489 | The iscsi_if_rx function in drivers/scsi/scsi_transport_iscsi.c in the Linux kernel through 4.13.2 allows local users to cause a denial of service (panic) by leveraging incorrect length validation. | EXPLOITMEDIUM 5.5EPSS 1.16% | 15 September 2017 |
| CVE-2017-0785 | A information disclosure vulnerability in the Android system (bluetooth). | EXPLOITMEDIUM 6.5EPSS 12.4% | 14 September 2017 |
| CVE-2017-0781 | A remote code execution vulnerability in the Android system (bluetooth). | EXPLOIT ×2HIGH 8.8EPSS 22.9% | 14 September 2017 |
| CVE-2017-1002008 | Vulnerability in wordpress plugin membership-simplified-for-oap-members-only v1.58, The file download code located membership-simplified-for-oap-members-only/download.php does not check whether a user is logged in and has download privileges. | EXPLOITCRITICAL 9.8EPSS 16.9% | 14 September 2017 |
| CVE-2017-1002003 | Vulnerability in wordpress plugin wp2android-turn-wp-site-into-android-app v1.1.4, The plugin includes unlicensed vulnerable CMS software from http://www.invedion.com. | EXPLOITCRITICAL 9.8EPSS 12.3% | 14 September 2017 |
| CVE-2017-1002002 | Vulnerability in wordpress plugin webapp-builder v2.0, The plugin includes unlicensed vulnerable CMS software from http://www.invedion.com/ | EXPLOITCRITICAL 9.8EPSS 12.6% | 14 September 2017 |
| CVE-2017-1002001 | Vulnerability in wordpress plugin mobile-app-builder-by-wappress v1.05, The plugin includes unlicensed vulnerable CMS software from http://www.invedion.com. | EXPLOITCRITICAL 9.8EPSS 11.1% | 14 September 2017 |
| CVE-2017-1002000 | Vulnerability in wordpress plugin mobile-friendly-app-builder-by-easytouch v3.0, The code in file ./mobile-friendly-app-builder-by-easytouch/server/images.php doesn't require authentication or check that the user is allowed to upload content. | EXPLOITCRITICAL 9.8EPSS 27.4% | 14 September 2017 |
| CVE-2017-6008 | A kernel pool overflow in the driver hitmanpro37.sys in Sophos SurfRight HitmanPro before 3.7.20 Build 286 (included in the HitmanPro.Alert solution and Sophos Clean) allows local users to escalate privileges via a malformed IOCTL call. | EXPLOITHIGH 7.8EPSS 1.90% | 13 September 2017 |
| CVE-2017-8759 | Microsoft .NET Framework Remote Code Execution Vulnerability | KEVEXPLOITHIGH 7.8EPSS 88.7% | 13 September 2017 |
| CVE-2017-8755 | Microsoft Edge in Microsoft Windows 10 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user, due to the way that the scripting engine handles objects in memory in Microsoft Edge, aka… | EXPLOIT ✓HIGH 7.5EPSS 71.3% | 13 September 2017 |
| CVE-2017-8751 | Microsoft Edge in Microsoft Windows 1703 allows an attacker to execute arbitrary code in the context of the current user, due to the way that Microsoft Edge accesses objects in memory, aka "Microsoft Edge Memory Corruption Vulnerability". | EXPLOIT ✓HIGH 7.5EPSS 50.4% | 13 September 2017 |
| CVE-2017-8740 | Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to execute arbitrary code in the context of the current user, due to the way that the Microsoft Edge scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption… | EXPLOIT ✓HIGH 7.5EPSS 72.2% | 13 September 2017 |
| CVE-2017-8734 | Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user, due to the way that Microsoft Edge accesses objects in memory, aka "Microsoft Edge… | EXPLOIT ✓HIGH 7.5EPSS 52.5% | 13 September 2017 |
| CVE-2017-8731 | Microsoft Edge in Microsoft Windows 10 1607 and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user, due to the way that Microsoft Edge accesses objects in memory, aka "Microsoft Edge Memory Corruption… | EXPLOIT ✓HIGH 7.5EPSS 51.6% | 13 September 2017 |
| CVE-2017-8729 | Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to execute arbitrary code in the context of the current user, due to the way that the Microsoft Edge scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption… | EXPLOIT ✓HIGH 7.5EPSS 72.2% | 13 September 2017 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.