Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
395,560 CVEs1,716 in CISA KEV17,391 with EPSS ≥ 10%Updated 20 September 2026
17,391 results · page 184 of 348
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2016-7232 | Microsoft Word 2007, Office 2010 SP2, Word 2010 SP2, Word for Mac 2011, and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability." | HIGH 7.8EPSS 24.9% | 10 November 2016 |
| CVE-2016-7231 | Microsoft Excel 2007 SP3, Excel for Mac 2011, Office Compatibility Pack SP3, and Excel Viewer allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability." | HIGH 7.8EPSS 18.7% | 10 November 2016 |
| CVE-2016-7230 | Microsoft PowerPoint 2010 SP2, PowerPoint Viewer, and Office Web Apps 2010 SP2 allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability." | HIGH 7.8EPSS 18.4% | 10 November 2016 |
| CVE-2016-7229 | Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Excel for Mac 2011, Excel 2016 for Mac, Office Compatibility Pack SP3, and Excel Viewer allow remote attackers to execute arbitrary code via a crafted Office… | HIGH 7.8EPSS 19.3% | 10 November 2016 |
| CVE-2016-7228 | Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Excel for Mac 2011, Excel 2016 for Mac, and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code via a crafted Office document, aka… | HIGH 7.8EPSS 28.3% | 10 November 2016 |
| CVE-2016-7227 | The scripting engines in Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to determine the existence of local files via unspecified vectors, aka "Microsoft Browser Information Disclosure Vulnerability." | LOW 3.1EPSS 11.6% | 10 November 2016 |
| CVE-2016-7217 | Media Foundation in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Windows Server 2016 allows remote attackers to execute arbitrary code via a crafted web site, aka "Media Foundation Memory… | HIGH 8.8EPSS 21.5% | 10 November 2016 |
| CVE-2016-7213 | Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Excel for Mac 2011, Excel 2016 for Mac, and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code via a crafted Office document, aka… | HIGH 7.8EPSS 19.3% | 10 November 2016 |
| CVE-2016-7212 | Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Windows Server 2016 allow remote attackers to execute arbitrary code via a… | HIGH 7.8EPSS 69.8% | 10 November 2016 |
| CVE-2016-7210 | atmfd.dll in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Windows Server 2016 allows remote attackers to obtain… | MEDIUM 6.5EPSS 21.1% | 10 November 2016 |
| CVE-2016-7208 | The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different… | HIGH 7.5EPSS 15.3% | 10 November 2016 |
| CVE-2016-7205 | Animation Manager in Microsoft Windows Server 2008 R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Windows Server 2016 allows remote attackers to execute arbitrary code via a… | HIGH 8.8EPSS 21.5% | 10 November 2016 |
| CVE-2016-7204 | Microsoft Edge allows remote attackers to access arbitrary "My Documents" files via a crafted web site, aka "Microsoft Edge Information Disclosure Vulnerability." | LOW 3.1EPSS 11.4% | 10 November 2016 |
| CVE-2016-7203 | The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different… | HIGH 7.5EPSS 64.9% | 10 November 2016 |
| CVE-2016-7202 | The scripting engines in Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption… | HIGH 7.5EPSS 73.3% | 10 November 2016 |
| CVE-2016-7201 | Microsoft Edge Memory Corruption Vulnerability | KEVHIGH 8.8EPSS 80.1% | 10 November 2016 |
| CVE-2016-7200 | Microsoft Edge Memory Corruption Vulnerability | KEVHIGH 8.8EPSS 82.9% | 10 November 2016 |
| CVE-2016-7199 | Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to bypass the Same Origin Policy and obtain sensitive window-state information via a crafted web site, aka "Microsoft Browser Information Disclosure Vulnerability." | LOW 3.1EPSS 13.1% | 10 November 2016 |
| CVE-2016-7198 | Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Browser Memory Corruption Vulnerability," a different… | HIGH 7.5EPSS 14.3% | 10 November 2016 |
| CVE-2016-7196 | Microsoft Internet Explorer 10 and 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Browser Memory Corruption Vulnerability." | HIGH 7.5EPSS 14.3% | 10 November 2016 |
| CVE-2016-7195 | Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Browser Memory Corruption Vulnerability," a different… | HIGH 7.5EPSS 17.0% | 10 November 2016 |
| CVE-2016-3343 | The Common Log File System (CLFS) driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Windows Server 2016 allows… | HIGH 7.8EPSS 12.6% | 10 November 2016 |
| CVE-2016-3342 | The Common Log File System (CLFS) driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Windows Server 2016 allows… | HIGH 7.8EPSS 12.6% | 10 November 2016 |
| CVE-2016-3340 | The Common Log File System (CLFS) driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Windows Server 2016 allows… | HIGH 7.8EPSS 12.6% | 10 November 2016 |
| CVE-2016-8870 | The register method in the UsersModelRegistration class in controllers/user.php in the Users component in Joomla! before 3.6.4, when registration has been disabled, allows remote attackers to create user accounts by leveraging failure to check the Allow… | HIGH 8.1EPSS 81.2% | 4 November 2016 |
| CVE-2016-8869 | The register method in the UsersModelRegistration class in controllers/user.php in the Users component in Joomla! before 3.6.4 allows remote attackers to gain privileges by leveraging incorrect use of unfiltered data when registering on a site. | CRITICAL 9.8EPSS 97.2% | 4 November 2016 |
| CVE-2016-8864 | named in ISC BIND 9.x before 9.9.9-P4, 9.10.x before 9.10.4-P4, and 9.11.x before 9.11.0-P1 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a DNAME record in the answer section of a response to a recursive… | HIGH 7.5EPSS 38.7% | 2 November 2016 |
| CVE-2016-7855 | Adobe Flash Player Use-After-Free Vulnerability | KEVHIGH 8.8EPSS 25.2% | 1 November 2016 |
| CVE-2016-8582 | A vulnerability exists in gauge.php of AlienVault OSSIM and USM before 5.3.2 that allows an attacker to execute an arbitrary SQL query and retrieve database information or read local system files via MySQL's LOAD_FILE. | CRITICAL 9.8EPSS 57.4% | 28 October 2016 |
| CVE-2016-8581 | A persistent XSS vulnerability exists in the User-Agent header of the login process of AlienVault OSSIM and USM before 5.3.2 that allows an attacker to steal session IDs of logged in users when the current sessions are viewed by an administrator. | MEDIUM 6.1EPSS 17.1% | 28 October 2016 |
| CVE-2016-8339 | A buffer overflow in Redis 3.2.x prior to 3.2.4 causes arbitrary code execution when a crafted command is sent. | CRITICAL 9.8EPSS 14.8% | 28 October 2016 |
| CVE-2016-3473 | Unspecified vulnerability in the BI Publisher (formerly XML Publisher) component in Oracle Fusion Middleware 11.1.1.7.0, 11.1.1.9.0, and 12.2.1.0.0 allows remote authenticated users to affect confidentiality via unknown vectors. | HIGH 7.7EPSS 13.9% | 25 October 2016 |
| CVE-2016-1000031 | Apache Commons FileUpload before 1.3.3 DiskFileItem File Manipulation Remote Code Execution | CRITICAL 9.8EPSS 33.7% | 25 October 2016 |
| CVE-2016-2848 | ISC BIND 9.1.0 through 9.8.4-P2 and 9.9.0 through 9.9.2-P2 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via malformed options data in an OPT resource record. | HIGH 7.5EPSS 25.8% | 21 October 2016 |
| CVE-2016-7194 | The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability… | HIGH 7.5EPSS 57.9% | 14 October 2016 |
| CVE-2016-7193 | Microsoft Office Memory Corruption Vulnerability | KEVHIGH 7.8EPSS 57.6% | 14 October 2016 |
| CVE-2016-7190 | The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability… | HIGH 7.5EPSS 66.9% | 14 October 2016 |
| CVE-2016-7189 | The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code via a crafted web site, aka "Scripting Engine Remote Code Execution Vulnerability." | HIGH 7.5EPSS 48.1% | 14 October 2016 |
| CVE-2016-7182 | The Graphics component in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; Windows 10 Gold, 1511, and 1607; Office 2007 SP3; Office 2010 SP2; Word Viewer; Skype… | CRITICAL 9.8EPSS 30.3% | 14 October 2016 |
| CVE-2016-3396 | Graphics Device Interface (aka GDI or GDI+) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; Windows 10 Gold, 1511, and 1607; Office 2007 SP3; Office 2010… | HIGH 7.8EPSS 24.4% | 14 October 2016 |
| CVE-2016-3393 | Microsoft Windows Graphics Device Interface (GDI) Remote Code Execution Vulnerability | KEVHIGH 7.8EPSS 68.5% | 14 October 2016 |
| CVE-2016-3390 | The scripting engines in Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, as demonstrated by the Chakra JavaScript engine, aka… | HIGH 7.5EPSS 16.8% | 14 October 2016 |
| CVE-2016-3389 | The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability… | HIGH 7.5EPSS 15.2% | 14 October 2016 |
| CVE-2016-3388 | Microsoft Internet Explorer 10 and 11 and Microsoft Edge do not properly restrict access to private namespaces, which allows remote attackers to gain privileges via unspecified vectors, aka "Microsoft Browser Elevation of Privilege Vulnerability," a… | MEDIUM 5.3EPSS 27.6% | 14 October 2016 |
| CVE-2016-3387 | Microsoft Internet Explorer 10 and 11 and Microsoft Edge do not properly restrict access to private namespaces, which allows remote attackers to gain privileges via unspecified vectors, aka "Microsoft Browser Elevation of Privilege Vulnerability," a… | HIGH 7.5EPSS 19.9% | 14 October 2016 |
| CVE-2016-3386 | The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability… | HIGH 7.5EPSS 41.3% | 14 October 2016 |
| CVE-2016-3385 | The scripting engine in Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability." | HIGH 7.5EPSS 23.0% | 14 October 2016 |
| CVE-2016-3384 | Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability." | HIGH 7.5EPSS 12.6% | 14 October 2016 |
| CVE-2016-3383 | Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Browser Memory Corruption Vulnerability." | HIGH 7.5EPSS 13.6% | 14 October 2016 |
| CVE-2016-3382 | The scripting engines in Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, as demonstrated by the Chakra JavaScript… | HIGH 7.5EPSS 17.0% | 14 October 2016 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. Patch KEV entries first, then anything with an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS and the CISA KEV catalogue. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.