Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
395,947 CVEs1,717 in CISA KEV17,392 with EPSS ≥ 10%25,049 with a public exploitUpdated 21 September 2026
25,049 results · page 90 of 501
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2017-8912 | CMS Made Simple (CMSMS) 2.1.6 allows remote authenticated administrators to execute arbitrary PHP code via the code parameter to admin/editusertag.php, related to the CreateTagFunction and CallUserTag functions. | EXPLOITHIGH 7.2EPSS 3.11% | 12 May 2017 |
| CVE-2017-7472 | The KEYS subsystem in the Linux kernel before 4.10.13 allows local users to cause a denial of service (memory consumption) via a series of KEY_REQKEY_DEFL_THREAD_KEYRING keyctl_set_reqkey_keyring calls. | EXPLOIT ✓MEDIUM 5.5EPSS 2.26% | 11 May 2017 |
| CVE-2015-5437 | Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2015. | EXPLOITUnscoredEPSS — | 11 May 2017 |
| CVE-2015-5112 | Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2015. | EXPLOITUnscoredEPSS — | 11 May 2017 |
| CVE-2013-1298 | Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. | EXPLOIT ✓UnscoredEPSS — | 11 May 2017 |
| CVE-2011-0108 | Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2011. | EXPLOITUnscoredEPSS — | 11 May 2017 |
| CVE-2017-8798 | Integer signedness error in MiniUPnP MiniUPnPc v1.4.20101221 through v2.0 allows remote attackers to cause a denial of service or possibly have unspecified other impact. | EXPLOITCRITICAL 9.8EPSS 24.0% | 11 May 2017 |
| CVE-2017-8895 | In Veritas Backup Exec 2014 before build 14.1.1187.1126, 15 before build 14.2.1180.3160, and 16 before FP1, there is a use-after-free vulnerability in multiple agents that can lead to a denial of service or remote code execution. | EXPLOIT ✓CRITICAL 9.8EPSS 71.0% | 10 May 2017 |
| CVE-2017-8852 | SAP SAPCAR 721.510 has a Heap Based Buffer Overflow Vulnerability. | EXPLOIT ✓HIGH 7.8EPSS 3.30% | 10 May 2017 |
| CVE-2017-3068 | Adobe Flash Player versions 25.0.0.148 and earlier have an exploitable memory corruption vulnerability in the Advanced Video Coding engine. | EXPLOIT ✓HIGH 8.8EPSS 20.4% | 9 May 2017 |
| CVE-2017-0290 | The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and… | EXPLOIT ✓HIGH 7.8EPSS 81.4% | 9 May 2017 |
| CVE-2017-6953 | Gemalto SmartDiag Diagnosis Tool v2.5 has a stack-based Buffer Overflow with SEH Overwrite via long "Register a new card" input fields. | EXPLOIT ✓HIGH 7.8EPSS 1.25% | 8 May 2017 |
| CVE-2017-3730 | In OpenSSL 1.1.0 before 1.1.0d, if a malicious server supplies bad parameters for a DHE or ECDHE key exchange then this can result in the client attempting to dereference a NULL pointer leading to a client crash. | EXPLOITHIGH 7.5EPSS 55.3% | 4 May 2017 |
| CVE-2016-7054 | In OpenSSL 1.1.0 before 1.1.0c, TLS connections using *-CHACHA20-POLY1305 ciphersuites are susceptible to a DoS attack by corrupting larger payloads. | EXPLOITHIGH 7.5EPSS 32.4% | 4 May 2017 |
| CVE-2017-8779 | rpcbind through 0.2.4, LIBTIRPC through 1.0.1 and 1.0.2-rc through 1.0.2-rc3, and NTIRPC through 1.4.3 do not consider the maximum RPC data size during memory allocation for XDR strings, which allows remote attackers to cause a denial of service (memory… | EXPLOITHIGH 7.5EPSS 81.2% | 4 May 2017 |
| CVE-2017-8295 | WordPress through 4.7.4 relies on the Host HTTP header for a password-reset e-mail message, which makes it easier for remote attackers to reset arbitrary passwords by making a crafted wp-login.php?action=lostpassword request and then arranging for this… | EXPLOITMEDIUM 5.9EPSS 26.7% | 4 May 2017 |
| CVE-2017-5689 | Intel Active Management Technology (AMT), Small Business Technology (SBT), and Standard Manageability Privilege Escalation Vulnerability | KEVEXPLOITCRITICAL 9.8EPSS 92.2% | 2 May 2017 |
| CVE-2016-5063 | The RSCD agent in BMC Server Automation before 8.6 SP1 Patch 2 and 8.7 before Patch 3 on Windows might allow remote attackers to bypass authorization checks and make an RPC call via unspecified vectors. | EXPLOIT ×2MEDIUM 5.3EPSS 8.37% | 2 May 2017 |
| CVE-2015-8257 | The devtools.sh script in AXIS network cameras allows remote authenticated users to execute arbitrary commands via shell metacharacters in the app parameter to (1) app_license.shtml, (2) app_license_custom.shtml, (3) app_index.shtml, or (4)… | EXPLOITHIGH 8.8EPSS 17.7% | 2 May 2017 |
| CVE-2017-5631 | Reflected cross site scripting is present in the user parameter (i.e., "usr") that is transmitted in the login.php query string. | EXPLOITMEDIUM 6.1EPSS 4.49% | 1 May 2017 |
| CVE-2017-7981 | Tuleap before 9.7 allows command injection via the PhpWiki 1.3.10 SyntaxHighlighter plugin. | EXPLOIT ✓HIGH 8.8EPSS 16.1% | 29 April 2017 |
| CVE-2017-6553 | Buffer Overflow in Quest One Identity Privilege Manager for Unix before 6.0.0.061 allows remote attackers to obtain full access to the policy server via an ACT_ALERT_EVENT request that causes memory corruption in the pmmasterd daemon. | EXPLOIT ✓CRITICAL 9.8EPSS 42.3% | 29 April 2017 |
| CVE-2017-5135 | Certain Technicolor devices have an SNMP access-control bypass, possibly involving an ISP customization in some cases. | EXPLOITCRITICAL 9.1EPSS 17.5% | 27 April 2017 |
| CVE-2017-3066 | Adobe ColdFusion Deserialization Vulnerability | KEVEXPLOITCRITICAL 9.8EPSS 90.6% | 27 April 2017 |
| CVE-2017-8291 | Artifex Ghostscript Type Confusion Vulnerability | KEVEXPLOIT ✓HIGH 7.8EPSS 97.0% | 27 April 2017 |
| CVE-2017-7293 | The Dolby DAX2 and DAX3 API services are vulnerable to a privilege escalation vulnerability that allows a normal user to get arbitrary system privileges, because these services have .NET code for DCOM. | EXPLOIT ✓HIGH 7.8EPSS 2.63% | 26 April 2017 |
| CVE-2017-8225 | An attacker can bypass authentication by providing an empty loginuse parameter and an empty loginpas parameter in the URI. | EXPLOITCRITICAL 9.8EPSS 35.4% | 25 April 2017 |
| CVE-2017-8224 | Wireless IP Camera (P2P) WIFICAM devices have a backdoor root account that can be accessed with TELNET. | EXPLOITCRITICAL 9.8EPSS 8.65% | 25 April 2017 |
| CVE-2017-8223 | On Wireless IP Camera (P2P) WIFICAM devices, an attacker can use the RTSP server on port 10554/tcp to watch the streaming without authentication via tcp/av0_1 or tcp/av0_0. | EXPLOITHIGH 7.5EPSS 4.34% | 25 April 2017 |
| CVE-2017-8222 | Wireless IP Camera (P2P) WIFICAM devices have an "Apple Production IOS Push Services" private RSA key and certificate stored in /system/www/pem/ck.pem inside the firmware, which allows attackers to obtain sensitive information. | EXPLOITHIGH 7.5EPSS 4.26% | 25 April 2017 |
| CVE-2017-8221 | Wireless IP Camera (P2P) WIFICAM devices rely on a cleartext UDP tunnel protocol (aka the Cloud feature) for communication between an Android application and a camera device, which allows remote attackers to obtain sensitive information by sniffing the… | EXPLOITHIGH 7.5EPSS 2.71% | 25 April 2017 |
| CVE-2017-1274 | IBM Domino 8.5.3, and 9.0 is vulnerable to a stack based overflow in the IMAP service that could allow an authenticated attacker to execute arbitrary code by specifying a large mailbox name. | EXPLOITHIGH 8.8EPSS 6.79% | 25 April 2017 |
| CVE-2017-7221 | OpenText Documentum Content Server has an inadequate protection mechanism against SQL injection, which allows remote authenticated users to execute arbitrary code with super-user privileges by leveraging the availability of the dm_bp_transition docbase… | EXPLOITHIGH 8.8EPSS 4.23% | 25 April 2017 |
| CVE-2017-3623 | Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Kernel RPC). | EXPLOITCRITICAL 10.0EPSS 22.0% | 24 April 2017 |
| CVE-2017-3622 | Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Common Desktop Environment (CDE)). | EXPLOIT ✓HIGH 7.8EPSS 5.38% | 24 April 2017 |
| CVE-2017-3599 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Pluggable Auth). | EXPLOIT ✓HIGH 7.5EPSS 89.9% | 24 April 2017 |
| CVE-2017-3587 | Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Shared Folder). | EXPLOIT ✓HIGH 8.4EPSS 1.46% | 24 April 2017 |
| CVE-2017-3576 | Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). | EXPLOIT ✓HIGH 8.8EPSS 1.54% | 24 April 2017 |
| CVE-2017-3575 | Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). | EXPLOIT ✓HIGH 7.9EPSS 1.44% | 24 April 2017 |
| CVE-2017-3563 | Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). | EXPLOIT ✓HIGH 8.8EPSS 1.36% | 24 April 2017 |
| CVE-2017-3561 | Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). | EXPLOIT ✓HIGH 8.8EPSS 1.54% | 24 April 2017 |
| CVE-2017-3558 | Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). | EXPLOIT ✓HIGH 8.5EPSS 2.91% | 24 April 2017 |
| CVE-2017-3549 | Vulnerability in the Oracle Scripting component of Oracle E-Business Suite (subcomponent: Scripting Administration). | EXPLOITCRITICAL 9.1EPSS 15.8% | 24 April 2017 |
| CVE-2017-3548 | Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: Integration Broker). | EXPLOIT ×2MEDIUM 6.5EPSS 50.8% | 24 April 2017 |
| CVE-2017-3546 | Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: MultiChannel Framework). | EXPLOITMEDIUM 6.5EPSS 9.64% | 24 April 2017 |
| CVE-2017-3528 | Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (lists of values, datepicker, etc.)). | EXPLOIT ✓MEDIUM 5.4EPSS 14.6% | 24 April 2017 |
| CVE-2016-4313 | Directory traversal vulnerability in unzip/extract feature in eXtplorer 2.1.9 allows remote attackers to execute arbitrary files via a .. | EXPLOITHIGH 7.8EPSS 8.68% | 24 April 2017 |
| CVE-2015-7572 | Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. | EXPLOITUnscoredEPSS — | 24 April 2017 |
| CVE-2015-7570 | Multiple server-side request forgery (SSRF) vulnerabilities in Yeager CMS 1.2.1 allow remote attackers to trigger outbound requests and enumerate open ports via the dbhost parameter to libs/org/adodb_lite/tests/test_adodb_lite.php,… | EXPLOITHIGH 7.2EPSS 6.03% | 24 April 2017 |
| CVE-2015-7569 | SQL injection vulnerability in "yeager/y.php/tab_USERLIST" in Yeager CMS 1.2.1 allows local users to execute arbitrary SQL commands via the "pagedir_orderby" parameter. | EXPLOITHIGH 8.8EPSS 2.79% | 24 April 2017 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.