Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
395,914 CVEs1,717 in CISA KEV17,392 with EPSS ≥ 10%25,049 with a public exploitUpdated 21 September 2026
25,049 results · page 85 of 501
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2017-9412 | The unpack_read_samples function in frontend/get_audio.c in LAME 3.99.5 allows remote attackers to cause a denial of service (invalid memory read and application crash) via a crafted wav file. | EXPLOITMEDIUM 5.5EPSS 3.97% | 27 July 2017 |
| CVE-2017-9411 | Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. | EXPLOITUnscoredEPSS — | 27 July 2017 |
| CVE-2017-9410 | Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. | EXPLOITUnscoredEPSS — | 27 July 2017 |
| CVE-2017-9260 | The TDStretchSSE::calcCrossCorr function in source/SoundTouch/sse_optimized.cpp in SoundTouch 1.9.2 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted wav file. | EXPLOITMEDIUM 5.5EPSS 3.92% | 27 July 2017 |
| CVE-2017-9259 | The TDStretch::acceptNewOverlapLength function in source/SoundTouch/TDStretch.cpp in SoundTouch 1.9.2 allows remote attackers to cause a denial of service (memory allocation error and application crash) via a crafted wav file. | EXPLOITMEDIUM 5.5EPSS 6.15% | 27 July 2017 |
| CVE-2017-9258 | The TDStretch::processSamples function in source/SoundTouch/TDStretch.cpp in SoundTouch 1.9.2 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted wav file. | EXPLOITMEDIUM 5.5EPSS 4.24% | 27 July 2017 |
| CVE-2017-9413 | Multiple cross-site request forgery (CSRF) vulnerabilities in the Podcast feature in Subsonic 6.1.1 allow remote attackers to hijack the authentication of users for requests that (1) subscribe to a podcast via the add parameter to… | EXPLOITHIGH 8.8EPSS 1.78% | 25 July 2017 |
| CVE-2016-10401 | ZyXEL PK5001Z devices have zyad5001 as the su password, which makes it easier for remote attackers to obtain root access if a non-root account password is known (or a non-root default account exists within an ISP's deployment of these devices). | EXPLOITHIGH 8.8EPSS 12.1% | 25 July 2017 |
| CVE-2015-5594 | The sanitize_string function in ZenPhoto before 1.4.9 utilized the html_entity_decode function after input sanitation, which might allow remote attackers to perform a cross-site scripting (XSS) via a crafted string. | EXPLOITMEDIUM 6.1EPSS 1.87% | 25 July 2017 |
| CVE-2015-2798 | SQL injection vulnerability in Joomla! | EXPLOITCRITICAL 9.8EPSS 3.26% | 25 July 2017 |
| CVE-2015-2280 | snwrite.cgi in AirLink101 SkyIPCam1620W Wireless N MPEG4 3GPP network camera with firmware FW_AIC1620W_1.1.0-12_20120709_r1192.pck allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the mac parameter. | EXPLOIT ✓HIGH 8.8EPSS 17.0% | 25 July 2017 |
| CVE-2015-2279 | cgi_test.cgi in AirLive BU-2015 with firmware 1.03.18, BU-3026 with firmware 1.43, and MD-3025 with firmware 1.81 allows remote attackers to execute arbitrary OS commands via shell metacharacters after an "&" (ampersand) in the write_mac write_pid,… | EXPLOIT ✓CRITICAL 9.8EPSS 17.6% | 25 July 2017 |
| CVE-2017-9554 | An information exposure vulnerability in forget_passwd.cgi in Synology DiskStation Manager (DSM) before 6.1.3-15152 allows remote attackers to enumerate valid usernames via unspecified vectors. | EXPLOITMEDIUM 5.3EPSS 76.7% | 24 July 2017 |
| CVE-2017-11517 | Stack-based buffer overflow in GCoreServer.exe in the server in Geutebrueck Gcore 1.3.8.42 and 1.4.2.37 allows remote attackers to execute arbitrary code via a long URI in a GET request. | EXPLOITCRITICAL 9.8EPSS 29.1% | 21 July 2017 |
| CVE-2017-9415 | Cross-site request forgery (CSRF) vulnerability in subsonic 6.1.1 allows remote attackers with knowledge of the target username to hijack the authentication of users for requests that change passwords via a crafted request to userSettings.view. | EXPLOITHIGH 7.5EPSS 2.48% | 21 July 2017 |
| CVE-2017-11502 | Technicolor DPC3928AD DOCSIS devices allow remote attackers to read arbitrary files via a request starting with "GET /../" on TCP port 4321. | EXPLOITCRITICAL 9.8EPSS 7.12% | 20 July 2017 |
| CVE-2017-7064 | It allows attackers to bypass intended memory-read restrictions via a crafted app. | EXPLOIT ✓MEDIUM 5.5EPSS 4.12% | 20 July 2017 |
| CVE-2017-7061 | It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site. | EXPLOIT ✓HIGH 8.8EPSS 7.95% | 20 July 2017 |
| CVE-2017-7056 | It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site. | EXPLOIT ✓HIGH 8.8EPSS 8.06% | 20 July 2017 |
| CVE-2017-7049 | It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site. | EXPLOIT ✓HIGH 8.8EPSS 6.22% | 20 July 2017 |
| CVE-2017-7048 | It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site. | EXPLOIT ✓HIGH 8.8EPSS 7.25% | 20 July 2017 |
| CVE-2017-7047 | It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app. | EXPLOIT ✓HIGH 8.8EPSS 6.73% | 20 July 2017 |
| CVE-2017-7046 | It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site. | EXPLOIT ✓HIGH 8.8EPSS 7.21% | 20 July 2017 |
| CVE-2017-7043 | It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site. | EXPLOIT ✓HIGH 8.8EPSS 6.31% | 20 July 2017 |
| CVE-2017-7042 | It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site. | EXPLOIT ✓HIGH 8.8EPSS 8.88% | 20 July 2017 |
| CVE-2017-7041 | It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site. | EXPLOIT ✓HIGH 8.8EPSS 9.50% | 20 July 2017 |
| CVE-2017-7040 | It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site. | EXPLOIT ✓HIGH 8.8EPSS 6.31% | 20 July 2017 |
| CVE-2017-7039 | It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site. | EXPLOIT ✓HIGH 8.8EPSS 6.31% | 20 July 2017 |
| CVE-2017-7037 | It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site. | EXPLOIT ✓HIGH 8.8EPSS 7.52% | 20 July 2017 |
| CVE-2017-7018 | It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site. | EXPLOIT ✓HIGH 8.8EPSS 7.04% | 20 July 2017 |
| CVE-2017-9822 | DotNetNuke (DNN) Remote Code Execution Vulnerability | KEVEXPLOIT ✓HIGH 8.8EPSS 94.8% | 20 July 2017 |
| CVE-2017-6316 | Citrix Multiple Products Remote Code Execution Vulnerability | KEVEXPLOIT ×2CRITICAL 9.8EPSS 73.0% | 20 July 2017 |
| CVE-2017-11471 | IDERA Uptime Monitor 7.8 has SQL injection in /gadgets/definitions/uptime.CapacityWhatIfGadget/getmetrics.php via the element parameter. | EXPLOITCRITICAL 9.8EPSS 1.47% | 20 July 2017 |
| CVE-2017-11470 | IDERA Uptime Monitor 7.8 has SQL injection in /gadgets/definitions/uptime.CapacityWhatifGadget/getxenmetrics.php via the element parameter. | EXPLOITCRITICAL 9.8EPSS 1.47% | 20 July 2017 |
| CVE-2017-11469 | get2post.php in IDERA Uptime Monitor 7.8 has directory traversal in the file_name parameter. | EXPLOITHIGH 7.5EPSS 4.93% | 20 July 2017 |
| CVE-2017-11467 | OrientDB through 2.2.22 does not enforce privilege requirements during "where" or "fetchplan" or "order by" use, which allows remote attackers to execute arbitrary OS commands via a crafted request. | EXPLOITCRITICAL 9.8EPSS 73.1% | 20 July 2017 |
| CVE-2017-11456 | Geneko GWR routers allow directory traversal sequences starting with a /../ substring, as demonstrated by unauthenticated read access to the configuration file. | EXPLOITHIGH 7.5EPSS 8.81% | 19 July 2017 |
| CVE-2017-11435 | The Humax Wi-Fi Router model HG100R-* 2.0.6 is prone to an authentication bypass vulnerability via specially crafted requests to the management console. | EXPLOITCRITICAL 9.8EPSS 10.1% | 19 July 2017 |
| CVE-2017-6320 | A remote command injection vulnerability exists in the Barracuda Load Balancer product line (confirmed on v5.4.0.004 (2015-11-26) and v6.0.1.006 (2016-08-19); fixed in 6.1.0.003 (2017-01-17)) in which an authenticated user can execute arbitrary shell… | EXPLOITHIGH 8.8EPSS 11.1% | 18 July 2017 |
| CVE-2017-9813 | In Kaspersky Anti-Virus for Linux File Server before Maintenance Pack 2 Critical Fix 4 (version 8.0.4.312), the scriptName parameter of the licenseKeyInfo action method is vulnerable to cross-site scripting (XSS). | EXPLOIT ✓MEDIUM 6.1EPSS 2.62% | 17 July 2017 |
| CVE-2017-9812 | The reportId parameter of the getReportStatus action method can be abused in the web interface in Kaspersky Anti-Virus for Linux File Server before Maintenance Pack 2 Critical Fix 4 (version 8.0.4.312) to read arbitrary files with kluser privileges. | EXPLOIT ✓HIGH 7.5EPSS 11.3% | 17 July 2017 |
| CVE-2017-9811 | The kluser is able to interact with the kav4fs-control binary in Kaspersky Anti-Virus for Linux File Server before Maintenance Pack 2 Critical Fix 4 (version 8.0.4.312). | EXPLOIT ✓CRITICAL 9.8EPSS 10.5% | 17 July 2017 |
| CVE-2017-9810 | There are no Anti-CSRF tokens in any forms on the web interface in Kaspersky Anti-Virus for Linux File Server before Maintenance Pack 2 Critical Fix 4 (version 8.0.4.312). | EXPLOIT ✓HIGH 8.8EPSS 1.93% | 17 July 2017 |
| CVE-2017-6736 | Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability | KEVEXPLOITHIGH 8.8EPSS 70.4% | 17 July 2017 |
| CVE-2017-11346 | Zoho ManageEngine Desktop Central before build 100092 allows remote attackers to execute arbitrary code via vectors involving the upload of help desk videos. | EXPLOITCRITICAL 9.8EPSS 43.3% | 17 July 2017 |
| CVE-2017-1000028 | Oracle, GlassFish Server Open Source Edition 4.1 is vulnerable to both authenticated and unauthenticated Directory Traversal vulnerability, that can be exploited by issuing a specially crafted HTTP GET request. | EXPLOIT ×3 ✓HIGH 7.5EPSS 99.5% | 17 July 2017 |
| CVE-2017-11165 | dataTaker DT80 dEX 1.50.012 allows remote attackers to obtain sensitive credential and configuration information via a direct request for the /services/getFile.cmd?userfile=config.xml URI. | EXPLOITCRITICAL 9.8EPSS 64.1% | 12 July 2017 |
| CVE-2017-11176 | During a user-space close of a Netlink socket, it allows attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact. | EXPLOITHIGH 7.8EPSS 3.60% | 11 July 2017 |
| CVE-2017-8618 | Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 Internet Explorer in the way affected Microsoft… | EXPLOIT ✓HIGH 7.5EPSS 58.1% | 11 July 2017 |
| CVE-2017-8601 | Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow an attacker to execute arbitrary code in the context of the current user when the JavaScript engine fails to render when handling objects in memory in… | EXPLOIT ✓HIGH 7.5EPSS 66.9% | 11 July 2017 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.