Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
395,598 CVEs1,716 in CISA KEV17,391 with EPSS ≥ 10%25,049 with a public exploitUpdated 20 September 2026
17,391 results · page 195 of 348
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2015-7547 | Multiple stack-based buffer overflows in the (1) send_dg and (2) send_vc functions in the libresolv library in the GNU C Library (aka glibc or libc6) before 2.23 allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary… | EXPLOIT ×2 ✓HIGH 8.1EPSS 91.0% | 18 February 2016 |
| CVE-2016-2389 | Directory traversal vulnerability in the GetFileList function in the SAP Manufacturing Integration and Intelligence (xMII) component 15.0 for SAP NetWeaver 7.4 allows remote attackers to read arbitrary files via a .. | EXPLOITHIGH 7.5EPSS 41.4% | 16 February 2016 |
| CVE-2016-2388 | SAP NetWeaver Information Disclosure Vulnerability | KEVEXPLOIT ×2MEDIUM 5.3EPSS 52.2% | 16 February 2016 |
| CVE-2016-2386 | SAP NetWeaver SQL Injection Vulnerability | KEVEXPLOIT ×2CRITICAL 9.8EPSS 71.5% | 16 February 2016 |
| CVE-2016-0752 | Ruby on Rails Directory Traversal Vulnerability | KEVEXPLOIT ✓HIGH 7.5EPSS 95.5% | 16 February 2016 |
| CVE-2016-0742 | The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 allows remote attackers to cause a denial of service (invalid pointer dereference and worker process crash) via a crafted UDP DNS response. | HIGH 7.5EPSS 82.0% | 15 February 2016 |
| CVE-2016-0701 | The DH_check_pub_key function in crypto/dh/dh_check.c in OpenSSL 1.0.2 before 1.0.2f does not ensure that prime numbers are appropriate for Diffie-Hellman (DH) key exchange, which makes it easier for remote attackers to discover a private DH exponent by… | LOW 3.7EPSS 83.6% | 15 February 2016 |
| CVE-2015-3197 | ssl/s2_srvr.c in OpenSSL 1.0.1 before 1.0.1r and 1.0.2 before 1.0.2f does not prevent use of disabled ciphers, which makes it easier for man-in-the-middle attackers to defeat cryptographic protection mechanisms by performing computations on SSLv2… | MEDIUM 5.9EPSS 10.7% | 15 February 2016 |
| CVE-2016-1525 | Directory traversal vulnerability in data/config/image.do in NETGEAR Management System NMS300 1.5.0.11 and earlier allows remote authenticated users to read arbitrary files via a .. | EXPLOIT ×2 ✓HIGH 8.6EPSS 75.0% | 13 February 2016 |
| CVE-2016-1524 | Multiple unrestricted file upload vulnerabilities in NETGEAR Management System NMS300 1.5.0.11 and earlier allow remote attackers to execute arbitrary Java code by using (1) fileUpload.do or (2) lib-1.0/external/flash/fileUpload.do to upload a JSP file,… | EXPLOITCRITICAL 9.6EPSS 94.1% | 13 February 2016 |
| CVE-2016-1287 | Buffer overflow in the IKEv1 and IKEv2 implementations in Cisco ASA Software before 8.4(7.30), 8.7 before 8.7(1.18), 9.0 before 9.0(4.38), 9.1 before 9.1(7), 9.2 before 9.2(4.5), 9.3 before 9.3(3.7), 9.4 before 9.4(2.4), and 9.5 before 9.5(2.2) on ASA… | EXPLOIT ✓CRITICAL 9.8EPSS 74.8% | 11 February 2016 |
| CVE-2016-0985 | Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allow attackers… | EXPLOIT ✓HIGH 8.8EPSS 26.1% | 10 February 2016 |
| CVE-2016-0984 | Adobe Flash Player and AIR Use-After-Free Vulnerability | KEVEXPLOIT ✓HIGH 8.8EPSS 54.5% | 10 February 2016 |
| CVE-2016-0974 | Use-after-free vulnerability in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler… | EXPLOIT ✓HIGH 8.8EPSS 30.8% | 10 February 2016 |
| CVE-2016-0971 | Heap-based buffer overflow in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler… | EXPLOIT ✓HIGH 8.8EPSS 33.5% | 10 February 2016 |
| CVE-2016-0967 | Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allow attackers… | EXPLOIT ✓HIGH 8.8EPSS 19.7% | 10 February 2016 |
| CVE-2016-0965 | Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allow attackers… | EXPLOIT ✓HIGH 8.8EPSS 19.7% | 10 February 2016 |
| CVE-2016-0964 | Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allow attackers… | EXPLOIT ✓HIGH 8.8EPSS 19.7% | 10 February 2016 |
| CVE-2016-0957 | Dispatcher before 4.1.5 in Adobe Experience Manager 5.6.1, 6.0.0, and 6.1.0 does not properly implement a URL filter, which allows remote attackers to bypass dispatcher rules via unspecified vectors. | HIGH 7.5EPSS 52.0% | 10 February 2016 |
| CVE-2016-0956 | The Servlets Post component 2.3.6 in Apache Sling, as used in Adobe Experience Manager 5.6.1, 6.0.0, and 6.1.0, allows remote attackers to obtain sensitive information via unspecified vectors. | EXPLOIT ✓HIGH 7.5EPSS 51.2% | 10 February 2016 |
| CVE-2016-0953 | Adobe Photoshop CC 2014 before 15.2.4, Photoshop CC 2015 before 16.1.2, and Bridge CC before 6.2 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than… | EXPLOIT ✓CRITICAL 9.8EPSS 19.6% | 10 February 2016 |
| CVE-2016-0952 | Adobe Photoshop CC 2014 before 15.2.4, Photoshop CC 2015 before 16.1.2, and Bridge CC before 6.2 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than… | EXPLOIT ✓CRITICAL 9.8EPSS 19.6% | 10 February 2016 |
| CVE-2016-0951 | Adobe Photoshop CC 2014 before 15.2.4, Photoshop CC 2015 before 16.1.2, and Bridge CC before 6.2 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than… | EXPLOIT ✓CRITICAL 9.8EPSS 19.6% | 10 February 2016 |
| CVE-2016-0084 | Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Edge Memory Corruption Vulnerability." | HIGH 8.8EPSS 17.4% | 10 February 2016 |
| CVE-2016-0080 | Microsoft Edge mishandles exceptions during window-message dispatch operations, which allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Microsoft Edge ASLR Bypass." | MEDIUM 4.3EPSS 15.0% | 10 February 2016 |
| CVE-2016-0072 | Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than… | HIGH 8.8EPSS 20.2% | 10 February 2016 |
| CVE-2016-0071 | Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability." | HIGH 8.8EPSS 14.1% | 10 February 2016 |
| CVE-2016-0067 | Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than… | HIGH 8.8EPSS 14.1% | 10 February 2016 |
| CVE-2016-0064 | Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability." | HIGH 8.8EPSS 14.1% | 10 February 2016 |
| CVE-2016-0063 | Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than… | EXPLOIT ✓HIGH 8.8EPSS 39.1% | 10 February 2016 |
| CVE-2016-0062 | Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Browser Memory Corruption Vulnerability." | HIGH 8.8EPSS 21.3% | 10 February 2016 |
| CVE-2016-0061 | Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Browser Memory Corruption Vulnerability," a different… | HIGH 8.8EPSS 21.3% | 10 February 2016 |
| CVE-2016-0060 | Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Browser Memory Corruption Vulnerability," a different… | HIGH 8.8EPSS 27.1% | 10 February 2016 |
| CVE-2016-0059 | The Hyperlink Object Library in Microsoft Internet Explorer 9 through 11 allows remote attackers to obtain sensitive information from process memory via a crafted URL in a (1) e-mail message or (2) Office document, aka "Internet Explorer Information… | MEDIUM 4.3EPSS 23.1% | 10 February 2016 |
| CVE-2016-0058 | Buffer overflow in the PDF Library in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, and Windows 10 allows remote attackers to execute arbitrary code via a crafted PDF document that triggers API calls, aka "Microsoft PDF Library Buffer Overflow… | HIGH 7.8EPSS 22.5% | 10 February 2016 |
| CVE-2016-0056 | Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory… | HIGH 7.8EPSS 16.0% | 10 February 2016 |
| CVE-2016-0055 | Microsoft Office 2007 SP3 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability." | HIGH 7.8EPSS 15.9% | 10 February 2016 |
| CVE-2016-0054 | Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Excel for Mac 2011, Excel 2016 for Mac, Office Compatibility Pack SP3, Excel Viewer, Excel Services on SharePoint Server 2007 SP3, Excel Services on SharePoint… | HIGH 7.8EPSS 15.7% | 10 February 2016 |
| CVE-2016-0053 | Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Office Compatibility Pack SP3, Word Viewer, Word Automation Services on SharePoint Server 2013 SP1, Office Web Apps Server 2013 SP1, and SharePoint… | HIGH 7.8EPSS 19.1% | 10 February 2016 |
| CVE-2016-0052 | Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Word for Mac 2011, Word 2016 for Mac, Office Compatibility Pack SP3, Word Viewer, Word Automation Services on SharePoint Server 2013 SP1, Office Web… | HIGH 7.8EPSS 19.1% | 10 February 2016 |
| CVE-2016-0051 | The WebDAV client in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows local users to gain privileges via a crafted… | EXPLOIT ×3 ✓HIGH 7.8EPSS 22.8% | 10 February 2016 |
| CVE-2016-0050 | Network Policy Server (NPS) in Microsoft Windows Server 2008 SP2 and R2 SP1 and Server 2012 Gold and R2 misparses username queries, which allows remote attackers to cause a denial of service (RADIUS authentication outage) via crafted requests, aka… | MEDIUM 5.3EPSS 17.9% | 10 February 2016 |
| CVE-2016-0049 | Kerberos in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, and Windows 10 Gold and 1511 does not properly validate password changes, which allows remote attackers to bypass… | EXPLOIT ✓MEDIUM 6.2EPSS 13.1% | 10 February 2016 |
| CVE-2016-0047 | WinForms in Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, and 4.6.1 allows remote attackers to obtain sensitive information from process memory via crafted icon data, aka "Windows Forms Information Disclosure Vulnerability." | HIGH 7.5EPSS 20.1% | 10 February 2016 |
| CVE-2016-0046 | Windows Reader in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, and Windows 10 allows remote attackers to execute arbitrary code via a crafted Reader file, aka "Microsoft Windows Reader Vulnerability." | HIGH 7.8EPSS 25.9% | 10 February 2016 |
| CVE-2016-0044 | Sync Framework in Microsoft Windows 8.1, Windows Server 2012 R2, and Windows RT 8.1 allows remote attackers to cause a denial of service (SyncShareSvc service outage) via crafted "change batch" data, aka "Windows DLL Loading Denial of Service… | HIGH 7.5EPSS 14.2% | 10 February 2016 |
| CVE-2016-0041 | Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold and 1511, and Internet Explorer 10 and 11 mishandle DLL loading, which allows local users to… | EXPLOIT ✓HIGH 7.8EPSS 82.9% | 10 February 2016 |
| CVE-2016-0040 | Microsoft Windows Kernel Privilege Escalation Vulnerability | KEVEXPLOIT ✓HIGH 7.8EPSS 24.5% | 10 February 2016 |
| CVE-2016-0038 | Windows Journal in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, and Windows 10 Gold and 1511 allows remote attackers to execute arbitrary code via a crafted Journal file,… | HIGH 7.8EPSS 18.4% | 10 February 2016 |
| CVE-2016-0037 | The forms-based authentication implementation in Active Directory Federation Services (ADFS) 3.0 in Microsoft Windows Server 2012 R2 allows remote attackers to cause a denial of service (daemon outage) via crafted data, aka "Microsoft Active Directory… | HIGH 7.5EPSS 25.7% | 10 February 2016 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.