SOC status:Duty analyst on shift

UK Cyber Defence

Tools / CVE Explorer

Which vulnerabilities actually matter?

Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.

CVE Analysis Report · 2026-10-31 edition · PDF

The year’s CVEs, on paper.

Every CVE published this year by month, severity and exploitability, the vendors carrying the volume, how the exploited minority scores on EPSS, and the KEV additions and public exploits to check against your estate. Built from the same data as this page, refreshed daily. Tell us where to send it.

Free · PDF · No newsletter attached

We keep your name and email so we know who asked. UK Cyber Defence Ltd is the controller; see the privacy notice for the rest.

The year’s CVE activity with KEV, EPSS and exploit data as a PDF: heatmaps, a vendor treemap, and the lists worth checking against your estate.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed

417,596 CVEs1,766 in CISA KEV17,506 with EPSS ≥ 10%25,055 with a public exploitUpdated 31 October 2026

1,766 results · page 36 of 36

CVESummaryPriorityPublished
CVE-2009-0238Microsoft Office Remote Code ExecutionKEVHIGH 8.8EPSS 42.9%25 February 2009
CVE-2008-2992Adobe Reader and Acrobat Input Validation VulnerabilityKEVEXPLOIT ×4 ✓HIGH 7.8EPSS 99.8%4 November 2008
CVE-2008-4250Microsoft Windows Buffer Overflow VulnerabilityKEVEXPLOIT ×6 ✓CRITICAL 9.8EPSS 98.8%23 October 2008
CVE-2008-4128Cisco IOS Cross-Site Request Forgery VulnerabilityKEVEXPLOIT ✓HIGH 8.1EPSS 33.9%18 September 2008
CVE-2008-3431Oracle VirtualBox Insufficient Input Validation VulnerabilityKEVEXPLOIT ✓HIGH 8.8EPSS 6.88%5 August 2008
CVE-2007-5659Adobe Acrobat and Reader Buffer Overflow VulnerabilityKEVEXPLOIT ×2 ✓HIGH 7.8EPSS 87.4%12 February 2008
CVE-2008-0655Adobe Acrobat and Reader Unspecified VulnerabilityKEVHIGH 8.8EPSS 37.9%7 February 2008
CVE-2007-3010Alcatel OmniPCX Enterprise Remote Code Execution VulnerabilityKEVEXPLOIT ×3 ✓CRITICAL 9.8EPSS 97.4%18 September 2007
CVE-2007-0671Microsoft Office Excel Remote Code Execution VulnerabilityKEVHIGH 8.8EPSS 43.2%3 February 2007
CVE-2006-2492Microsoft Word Malformed Object Pointer VulnerabilityKEVHIGH 8.8EPSS 48.1%20 May 2006
CVE-2006-1547Apache Struts 1 ActionForm Denial-of-Service VulnerabilityKEVHIGH 7.5EPSS 54.6%30 March 2006
CVE-2005-2773HP OpenView Network Node Manager Remote Code Execution VulnerabilityKEVEXPLOIT ×2 ✓CRITICAL 9.8EPSS 74.6%2 September 2005
CVE-2004-1464Cisco IOS Denial-of-Service VulnerabilityKEVMEDIUM 5.9EPSS 4.84%31 December 2004
CVE-2004-0210Microsoft Windows Privilege Escalation VulnerabilityKEVEXPLOIT ✓HIGH 7.8EPSS 7.21%6 August 2004
CVE-2002-0367Microsoft Windows Privilege Escalation VulnerabilityKEVEXPLOIT ✓HIGH 7.8EPSS 4.92%25 June 2002
CVE-2026-118527Ivanti Connect Secure Generation of Predictable Numbers or Identifiers VulnerabilityKEVUnscoredEPSS —

How to read this

CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.

Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.