Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
The year’s CVE activity with KEV, EPSS and exploit data as a PDF: heatmaps, a vendor treemap, and the lists worth checking against your estate.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
417,593 CVEs1,766 in CISA KEV17,506 with EPSS ≥ 10%25,055 with a public exploitUpdated 31 October 2026
1,766 results · page 32 of 36
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2016-3427 | Oracle Java SE and JRockit Unspecified Vulnerability | KEVCRITICAL 9.8EPSS 92.3% | 21 April 2016 |
| CVE-2016-0167 | Microsoft Win32k Privilege Escalation Vulnerability | KEVHIGH 7.8EPSS 5.66% | 12 April 2016 |
| CVE-2016-0165 | Microsoft Win32k Privilege Escalation Vulnerability | KEVEXPLOITHIGH 7.8EPSS 13.7% | 12 April 2016 |
| CVE-2016-0162 | Microsoft Internet Explorer Information Disclosure Vulnerability | KEVMEDIUM 4.3EPSS 21.9% | 12 April 2016 |
| CVE-2016-0151 | Microsoft Windows CSRSS Security Feature Bypass Vulnerability | KEVEXPLOIT ✓HIGH 7.8EPSS 62.8% | 12 April 2016 |
| CVE-2016-3976 | SAP NetWeaver Directory Traversal Vulnerability | KEVEXPLOITHIGH 7.5EPSS 47.3% | 7 April 2016 |
| CVE-2016-1019 | Adobe Flash Player Arbitrary Code Execution Vulnerability | KEVCRITICAL 9.8EPSS 22.3% | 7 April 2016 |
| CVE-2016-1646 | Google Chromium V8 Out-of-Bounds Read Vulnerability | KEVHIGH 8.8EPSS 48.1% | 29 March 2016 |
| CVE-2016-1010 | Adobe Flash Player and AIR Integer Overflow Vulnerability | KEVHIGH 8.8EPSS 19.3% | 12 March 2016 |
| CVE-2016-0099 | Microsoft Windows Secondary Logon Service Privilege Escalation Vulnerability | KEVEXPLOIT ×4 ✓HIGH 7.8EPSS 37.0% | 9 March 2016 |
| CVE-2016-2388 | SAP NetWeaver Information Disclosure Vulnerability | KEVEXPLOIT ×2MEDIUM 5.3EPSS 52.2% | 16 February 2016 |
| CVE-2016-2386 | SAP NetWeaver SQL Injection Vulnerability | KEVEXPLOIT ×2CRITICAL 9.8EPSS 71.5% | 16 February 2016 |
| CVE-2016-0752 | Ruby on Rails Directory Traversal Vulnerability | KEVEXPLOIT ✓HIGH 7.5EPSS 95.5% | 16 February 2016 |
| CVE-2016-0984 | Adobe Flash Player and AIR Use-After-Free Vulnerability | KEVEXPLOIT ✓HIGH 8.8EPSS 54.5% | 10 February 2016 |
| CVE-2016-0040 | Microsoft Windows Kernel Privilege Escalation Vulnerability | KEVEXPLOIT ✓HIGH 7.8EPSS 24.3% | 10 February 2016 |
| CVE-2016-0034 | Microsoft Silverlight Runtime Remote Code Execution Vulnerability | KEVHIGH 8.8EPSS 69.4% | 13 January 2016 |
| CVE-2015-7450 | IBM WebSphere Application Server and Server Hypervisor Edition Code Injection. | KEVEXPLOIT ✓CRITICAL 9.8EPSS 97.8% | 2 January 2016 |
| CVE-2015-8651 | Adobe Flash Player Integer Overflow Vulnerability | KEVHIGH 8.8EPSS 67.7% | 28 December 2015 |
| CVE-2015-7755 | Juniper ScreenOS Improper Authentication Vulnerability | KEVCRITICAL 9.8EPSS 61.1% | 19 December 2015 |
| CVE-2015-6175 | Microsoft Windows Kernel Privilege Escalation Vulnerability | KEVHIGH 7.8EPSS 5.33% | 9 December 2015 |
| CVE-2015-5287 | Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability | KEVEXPLOIT ×3 ✓HIGH 7.8EPSS 5.00% | 7 December 2015 |
| CVE-2015-5317 | Jenkins User Interface (UI) Information Disclosure Vulnerability | KEVHIGH 7.5EPSS 23.0% | 25 November 2015 |
| CVE-2015-4852 | Oracle WebLogic Server Deserialization of Untrusted Data Vulnerability | KEVEXPLOIT ×3 ✓CRITICAL 9.8EPSS 95.0% | 18 November 2015 |
| CVE-2015-4902 | Oracle Java SE Integrity Check Vulnerability | KEVMEDIUM 5.3EPSS 13.6% | 22 October 2015 |
| CVE-2015-7645 | Adobe Flash Player Arbitrary Code Execution Vulnerability | KEVEXPLOIT ✓HIGH 7.8EPSS 65.3% | 15 October 2015 |
| CVE-2015-2546 | Microsoft Win32k Memory Corruption Vulnerability | KEVHIGH 8.2EPSS 10.1% | 9 September 2015 |
| CVE-2015-2545 | Microsoft Office Malformed EPS File Vulnerability | KEVHIGH 7.8EPSS 85.9% | 9 September 2015 |
| CVE-2015-2502 | Microsoft Internet Explorer Memory Corruption Vulnerability | KEVHIGH 8.8EPSS 51.0% | 19 August 2015 |
| CVE-2015-1769 | Microsoft Windows Mount Manager Privilege Escalation Vulnerability | KEVMEDIUM 6.6EPSS 4.08% | 15 August 2015 |
| CVE-2015-1642 | Microsoft Office Memory Corruption Vulnerability | KEVHIGH 7.8EPSS 53.1% | 15 August 2015 |
| CVE-2015-3246 | Red Hat Libuser Race Condition Vulnerability | KEVEXPLOIT ×2 ✓HIGH 7.4EPSS 8.50% | 11 August 2015 |
| CVE-2015-4495 | Mozilla Firefox Security Feature Bypass Vulnerability | KEVEXPLOITHIGH 8.8EPSS 68.6% | 8 August 2015 |
| CVE-2015-5477 | ISC BIND Data Processing Errors Vulnerability | KEVEXPLOIT ×2 ✓HIGH 7.5EPSS 99.6% | 29 July 2015 |
| CVE-2015-2426 | Microsoft Windows Adobe Type Manager Library Remote Code Execution Vulnerability | KEVEXPLOIT ✓HIGH 8.8EPSS 86.6% | 20 July 2015 |
| CVE-2015-2590 | Oracle Java SE and Java SE Embedded Remote Code Execution Vulnerability | KEVCRITICAL 9.8EPSS 25.5% | 16 July 2015 |
| CVE-2015-2387 | Microsoft ATM Font Driver Privilege Escalation Vulnerability | KEVHIGH 7.8EPSS 34.9% | 14 July 2015 |
| CVE-2015-2425 | Microsoft Internet Explorer Memory Corruption Vulnerability | KEVHIGH 8.8EPSS 44.7% | 14 July 2015 |
| CVE-2015-2424 | Microsoft PowerPoint Memory Corruption Vulnerability | KEVHIGH 8.8EPSS 40.1% | 14 July 2015 |
| CVE-2015-2419 | Microsoft Internet Explorer Memory Corruption Vulnerability | KEVEXPLOITHIGH 8.8EPSS 53.0% | 14 July 2015 |
| CVE-2015-5123 | Adobe Flash Player Use-After-Free Vulnerability | KEVCRITICAL 9.8EPSS 18.8% | 14 July 2015 |
| CVE-2015-5122 | Adobe Flash Player Use-After-Free Vulnerability | KEVEXPLOIT ✓CRITICAL 9.8EPSS 87.0% | 14 July 2015 |
| CVE-2015-5119 | Adobe Flash Player Use-After-Free Vulnerability | KEVEXPLOIT ✓CRITICAL 9.8EPSS 98.6% | 8 July 2015 |
| CVE-2015-3113 | Adobe Flash Player Heap-Based Buffer Overflow Vulnerability | KEVEXPLOIT ✓CRITICAL 9.8EPSS 99.8% | 23 June 2015 |
| CVE-2015-2360 | Microsoft Win32k Privilege Escalation Vulnerability | KEVHIGH 8.8EPSS 14.8% | 10 June 2015 |
| CVE-2015-1770 | Microsoft Office Uninitialized Memory Use Vulnerability | KEVHIGH 8.8EPSS 35.0% | 10 June 2015 |
| CVE-2015-4068 | Arcserve Unified Data Protection (UDP) Directory Traversal Vulnerability | KEVCRITICAL 9.1EPSS 63.6% | 29 May 2015 |
| CVE-2015-3306 | ProFTPD Improper Access Control Vulnerability | KEVEXPLOIT ×4 ✓CRITICAL 10.0EPSS 99.5% | 18 May 2015 |
| CVE-2015-1671 | Microsoft Windows Remote Code Execution Vulnerability | KEVHIGH 7.8EPSS 48.8% | 13 May 2015 |
| CVE-2014-8361 | Realtek SDK Improper Input Validation Vulnerability | KEVEXPLOIT ✓CRITICAL 9.8EPSS 100.0% | 1 May 2015 |
| CVE-2015-3035 | TP-Link Multiple Archer Devices Directory Traversal Vulnerability | KEVHIGH 7.5EPSS 83.9% | 22 April 2015 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.