Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
The year’s CVE activity with KEV, EPSS and exploit data as a PDF: heatmaps, a vendor treemap, and the lists worth checking against your estate.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
419,343 CVEs1,768 in CISA KEV17,514 with EPSS ≥ 10%25,055 with a public exploitUpdated 5 November 2026
17,514 results · page 154 of 351
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2018-11130 | The header::add_FORMAT_descriptor function in header.cpp in VCFtools 0.1.15 allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted vcf file. | HIGH 7.8EPSS 20.1% | 17 May 2018 |
| CVE-2018-1111 | DHCP packages in Red Hat Enterprise Linux 6 and 7, Fedora 28, and earlier are vulnerable to a command injection flaw in the NetworkManager integration script included in the DHCP client. | EXPLOIT ×2 ✓HIGH 7.5EPSS 97.9% | 17 May 2018 |
| CVE-2018-9958 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. | EXPLOIT ×3 ✓HIGH 8.8EPSS 61.7% | 17 May 2018 |
| CVE-2018-9948 | This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.0.0.29935. | EXPLOIT ×2 ✓MEDIUM 6.5EPSS 62.5% | 17 May 2018 |
| CVE-2018-8014 | The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all origins. | CRITICAL 9.8EPSS 20.9% | 16 May 2018 |
| CVE-2018-10738 | A SQL injection issue was discovered in Nagios XI before 5.4.13 via the admin/menuaccess.php chbKey1 parameter. | HIGH 7.2EPSS 41.4% | 16 May 2018 |
| CVE-2018-10737 | A SQL injection issue was discovered in Nagios XI before 5.4.13 via the admin/logbook.php txtSearch parameter. | HIGH 7.2EPSS 41.4% | 16 May 2018 |
| CVE-2018-10736 | A SQL injection issue was discovered in Nagios XI before 5.4.13 via the admin/info.php key1 parameter. | HIGH 7.2EPSS 41.4% | 16 May 2018 |
| CVE-2018-10735 | A SQL injection issue was discovered in Nagios XI before 5.4.13 via the admin/commandline.php cname parameter. | HIGH 7.2EPSS 41.4% | 16 May 2018 |
| CVE-2018-10123 | p910nd on Inteno IOPSYS 2.0 through 4.2.0 allows remote attackers to read, or append data to, arbitrary files via requests on TCP port 9100. | EXPLOITHIGH 8.8EPSS 10.2% | 16 May 2018 |
| CVE-2018-11094 | An issue was discovered on Intelbras NCLOUD 300 1.0 devices. /cgi-bin/ExportSettings.sh, /goform/updateWPS, /goform/RebootSystem, and /goform/vpnBasicSettings do not require authentication. | EXPLOITCRITICAL 9.8EPSS 32.9% | 15 May 2018 |
| CVE-2017-12128 | An exploitable information disclosure vulnerability exists in the Server Agent functionality of Moxa EDR-810 V4.1 build 17030317. | HIGH 7.5EPSS 40.1% | 14 May 2018 |
| CVE-2018-5230 | The issue collector in Atlassian Jira before version 7.6.6, from version 7.7.0 before version 7.7.4, from version 7.8.0 before version 7.8.4 and from version 7.9.0 before version 7.9.2 allows remote attackers to inject arbitrary HTML or JavaScript via a… | MEDIUM 6.1EPSS 37.0% | 14 May 2018 |
| CVE-2018-6361 | Easy Hosting Control Panel (EHCP) v0.37.12.b has XSS via the op parameter, as demonstrated by adding a backdoor FTP account. | MEDIUM 6.1EPSS 37.8% | 11 May 2018 |
| CVE-2018-1260 | Spring Security OAuth, versions 2.3 prior to 2.3.3, 2.2 prior to 2.2.2, 2.1 prior to 2.1.2, 2.0 prior to 2.0.15 and older unsupported versions contains a remote code execution vulnerability. | CRITICAL 9.8EPSS 10.6% | 11 May 2018 |
| CVE-2018-10655 | DLPnpAuditor.exe in DeviceLock Plug and Play Auditor (freeware) 5.72 has a Unicode Buffer Overflow (SEH). | EXPLOITHIGH 7.8EPSS 15.9% | 10 May 2018 |
| CVE-2018-10942 | modules/attributewizardpro/file_upload.php in the Attribute Wizard addon 1.6.9 for PrestaShop 1.4.0.1 through 1.6.1.18 allows remote attackers to execute arbitrary code by uploading a .phtml file. | CRITICAL 9.8EPSS 12.3% | 10 May 2018 |
| CVE-2018-8179 | A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory Corruption Vulnerability." This affects Microsoft Edge. | HIGH 7.5EPSS 14.0% | 9 May 2018 |
| CVE-2018-8178 | A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory, aka "Microsoft Browser Memory Corruption Vulnerability." This affects ChakraCore, Internet Explorer 11, Microsoft Edge. | HIGH 7.5EPSS 15.5% | 9 May 2018 |
| CVE-2018-8177 | A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects ChakraCore. | HIGH 7.5EPSS 11.4% | 9 May 2018 |
| CVE-2018-8174 | Microsoft Windows VBScript Engine Out-of-Bounds Write Vulnerability | KEVEXPLOITHIGH 7.5EPSS 88.2% | 9 May 2018 |
| CVE-2018-8173 | A remote code execution vulnerability exists in Microsoft InfoPath when the software fails to properly handle objects in memory, aka "Microsoft InfoPath Remote Code Execution Vulnerability." This affects Microsoft Infopath. | HIGH 7.8EPSS 19.6% | 9 May 2018 |
| CVE-2018-8163 | An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory, aka "Microsoft Excel Information Disclosure Vulnerability." This affects Microsoft Office, Microsoft Excel. | MEDIUM 5.5EPSS 12.9% | 9 May 2018 |
| CVE-2018-8162 | A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka "Microsoft Excel Remote Code Execution Vulnerability." This affects Microsoft Office, Microsoft Excel. | HIGH 7.8EPSS 24.3% | 9 May 2018 |
| CVE-2018-8161 | A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory, aka "Microsoft Office Remote Code Execution Vulnerability." This affects Microsoft Word, Word, Microsoft Office,… | HIGH 7.8EPSS 21.3% | 9 May 2018 |
| CVE-2018-8158 | A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory, aka "Microsoft Office Remote Code Execution Vulnerability." This affects Microsoft Office. | HIGH 7.8EPSS 24.3% | 9 May 2018 |
| CVE-2018-8157 | A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory, aka "Microsoft Office Remote Code Execution Vulnerability." This affects Microsoft Office. | HIGH 7.8EPSS 24.3% | 9 May 2018 |
| CVE-2018-8154 | A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, aka "Microsoft Exchange Memory Corruption Vulnerability." This affects Microsoft Exchange Server. | CRITICAL 9.8EPSS 23.6% | 9 May 2018 |
| CVE-2018-8148 | A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka "Microsoft Excel Remote Code Execution Vulnerability." This affects Microsoft Office, Microsoft Excel. | HIGH 7.8EPSS 24.3% | 9 May 2018 |
| CVE-2018-8147 | A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka "Microsoft Excel Remote Code Execution Vulnerability." This affects Microsoft Office, Microsoft Excel. | HIGH 7.8EPSS 24.3% | 9 May 2018 |
| CVE-2018-8145 | An information disclosure vulnerability exists when Chakra improperly discloses the contents of its memory, which could provide an attacker with information to further compromise the user's computer or data, aka "Chakra Scripting Engine Memory… | EXPLOIT ✓HIGH 7.5EPSS 66.6% | 9 May 2018 |
| CVE-2018-8139 | A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka "Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. | EXPLOIT ✓HIGH 7.5EPSS 66.3% | 9 May 2018 |
| CVE-2018-8137 | A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka "Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. | HIGH 7.5EPSS 15.7% | 9 May 2018 |
| CVE-2018-8136 | A remote code execution vulnerability exists in the way that Windows handles objects in memory, aka "Windows Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012,… | HIGH 7.8EPSS 23.0% | 9 May 2018 |
| CVE-2018-8133 | A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. | EXPLOIT ✓HIGH 7.5EPSS 50.2% | 9 May 2018 |
| CVE-2018-8130 | A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. | HIGH 7.5EPSS 15.7% | 9 May 2018 |
| CVE-2018-8128 | A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka "Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. | HIGH 7.5EPSS 15.7% | 9 May 2018 |
| CVE-2018-8122 | A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scripting Engine Memory Corruption Vulnerability." This affects Internet Explorer 11. | HIGH 7.5EPSS 15.7% | 9 May 2018 |
| CVE-2018-8120 | Microsoft Win32k Privilege Escalation Vulnerability | KEVEXPLOIT ✓HIGH 7.0EPSS 73.3% | 9 May 2018 |
| CVE-2018-8114 | A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scripting Engine Memory Corruption Vulnerability." This affects Internet Explorer 11. | HIGH 7.5EPSS 15.7% | 9 May 2018 |
| CVE-2018-1022 | A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka "Scripting Engine Memory Corruption Vulnerability." This affects ChakraCore, Internet Explorer 11, Microsoft Edge. | HIGH 7.5EPSS 15.5% | 9 May 2018 |
| CVE-2018-0955 | A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scripting Engine Memory Corruption Vulnerability." This affects Internet Explorer 9, Internet Explorer 11, Internet… | HIGH 7.5EPSS 15.7% | 9 May 2018 |
| CVE-2018-0954 | A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka "Scripting Engine Memory Corruption Vulnerability." This affects Internet Explorer 9, ChakraCore, Internet Explorer 11,… | HIGH 7.5EPSS 15.5% | 9 May 2018 |
| CVE-2018-0953 | A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka "Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. | EXPLOIT ✓HIGH 7.5EPSS 66.3% | 9 May 2018 |
| CVE-2018-0951 | A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka "Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge. | HIGH 7.5EPSS 15.7% | 9 May 2018 |
| CVE-2018-0946 | A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka "Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. | EXPLOIT ✓HIGH 7.5EPSS 51.1% | 9 May 2018 |
| CVE-2018-0945 | A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka "Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. | HIGH 7.5EPSS 15.7% | 9 May 2018 |
| CVE-2018-0943 | A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. | HIGH 7.5EPSS 15.7% | 9 May 2018 |
| CVE-2018-0824 | Microsoft COM for Windows Deserialization of Untrusted Data Vulnerability | KEVEXPLOITHIGH 8.8EPSS 73.0% | 9 May 2018 |
| CVE-2015-1503 | Multiple directory traversal vulnerabilities in IceWarp Mail Server before 11.2 allow remote attackers to read arbitrary files via a (1) .. | EXPLOITHIGH 7.5EPSS 57.0% | 8 May 2018 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.