Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
395,605 CVEs1,716 in CISA KEV17,391 with EPSS ≥ 10%25,049 with a public exploitUpdated 20 September 2026
17,391 results · page 202 of 348
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2015-2499 | Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2486,… | HIGH 9.3EPSS 23.7% | 9 September 2015 |
| CVE-2015-2498 | Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2486,… | HIGH 9.3EPSS 23.7% | 9 September 2015 |
| CVE-2015-2494 | Microsoft Internet Explorer 7 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerability," a different vulnerability than… | HIGH 9.3EPSS 20.2% | 9 September 2015 |
| CVE-2015-2493 | The (1) VBScript and (2) JScript engines in Microsoft Internet Explorer 8 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability." | HIGH 9.3EPSS 18.1% | 9 September 2015 |
| CVE-2015-2492 | Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2486,… | HIGH 9.3EPSS 18.1% | 9 September 2015 |
| CVE-2015-2491 | Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2485 and… | HIGH 9.3EPSS 15.6% | 9 September 2015 |
| CVE-2015-2490 | Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2486,… | HIGH 9.3EPSS 15.6% | 9 September 2015 |
| CVE-2015-2489 | Microsoft Internet Explorer 11 allows remote attackers to gain privileges via a crafted web site, as demonstrated by a transition from Low Integrity to Medium Integrity, aka "Elevation of Privilege Vulnerability." | MEDIUM 4.3EPSS 10.7% | 9 September 2015 |
| CVE-2015-2487 | Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2486,… | HIGH 9.3EPSS 18.1% | 9 September 2015 |
| CVE-2015-2486 | Microsoft Internet Explorer 7 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerability," a different vulnerability than… | HIGH 9.3EPSS 20.2% | 9 September 2015 |
| CVE-2015-2485 | Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerability," a different vulnerability than… | HIGH 9.3EPSS 16.5% | 9 September 2015 |
| CVE-2015-2484 | Microsoft Internet Explorer 10 and 11 uses an incorrect flag during certain filesystem accesses, which allows remote attackers to delete arbitrary files via unspecified vectors, aka "Tampering Vulnerability." | MEDIUM 6.4EPSS 13.7% | 9 September 2015 |
| CVE-2015-2483 | Microsoft Internet Explorer 10 and 11 allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Information Disclosure Vulnerability." | MEDIUM 5.0EPSS 19.1% | 9 September 2015 |
| CVE-2015-5625 | Cross-site scripting (XSS) vulnerability in OpenDocMan before 1.3.4 allows remote attackers to inject arbitrary web script or HTML via the redirection parameter. | MEDIUM 4.3EPSS 22.8% | 7 September 2015 |
| CVE-2015-5986 | openpgpkey_61.c in named in ISC BIND 9.9.7 before 9.9.7-P3 and 9.10.x before 9.10.2-P4 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via a crafted DNS response. | HIGH 7.1EPSS 26.1% | 5 September 2015 |
| CVE-2015-5722 | buffer.c in named in ISC BIND 9.x before 9.9.7-P3 and 9.10.x before 9.10.2-P4 allows remote attackers to cause a denial of service (assertion failure and daemon exit) by creating a zone containing a malformed DNSSEC key and issuing a query for a name in… | HIGH 7.8EPSS 33.9% | 5 September 2015 |
| CVE-2015-1171 | Stack-based buffer overflow in GSM SIM Utility (aka SIM Card Editor) 6.6 allows remote attackers to execute arbitrary code via a long entry in a .sms file. | EXPLOITHIGH 10.0EPSS 62.7% | 28 August 2015 |
| CVE-2015-3221 | OpenStack Neutron before 2014.2.4 (juno) and 2015.1.x before 2015.1.1 (kilo), when using the IPTables firewall driver, allows remote authenticated users to cause a denial of service (L2 agent crash) by adding an address pair that is rejected by the… | EXPLOITMEDIUM 4.0EPSS 11.4% | 26 August 2015 |
| CVE-2015-5949 | VideoLAN VLC media player 2.2.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted 3GP file, which triggers the freeing of arbitrary pointers. | MEDIUM 6.8EPSS 13.3% | 25 August 2015 |
| CVE-2015-5424 | Unspecified vulnerability in HP KeyView before 10.23.0.1 and 10.24.x before 10.24.0.1 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-2885. | HIGH 7.5EPSS 10.7% | 24 August 2015 |
| CVE-2015-5423 | Unspecified vulnerability in HP KeyView before 10.23.0.1 and 10.24.x before 10.24.0.1 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-2884. | HIGH 7.5EPSS 10.7% | 24 August 2015 |
| CVE-2015-5422 | Unspecified vulnerability in HP KeyView before 10.23.0.1 and 10.24.x before 10.24.0.1 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-2883. | HIGH 7.5EPSS 10.7% | 24 August 2015 |
| CVE-2015-5421 | Unspecified vulnerability in HP KeyView before 10.23.0.1 and 10.24.x before 10.24.0.1 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-2881. | HIGH 7.5EPSS 10.7% | 24 August 2015 |
| CVE-2015-5420 | Unspecified vulnerability in HP KeyView before 10.23.0.1 and 10.24.x before 10.24.0.1 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-2880. | HIGH 7.5EPSS 10.7% | 24 August 2015 |
| CVE-2015-5419 | Unspecified vulnerability in HP KeyView before 10.23.0.1 and 10.24.x before 10.24.0.1 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-2879. | HIGH 7.5EPSS 10.7% | 24 August 2015 |
| CVE-2015-5418 | Unspecified vulnerability in HP KeyView before 10.23.0.1 and 10.24.x before 10.24.0.1 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-2877. | HIGH 7.5EPSS 10.7% | 24 August 2015 |
| CVE-2015-5417 | Unspecified vulnerability in HP KeyView before 10.23.0.1 and 10.24.x before 10.24.0.1 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-2876. | HIGH 7.5EPSS 10.7% | 24 August 2015 |
| CVE-2015-5416 | Unspecified vulnerability in HP KeyView before 10.23.0.1 and 10.24.x before 10.24.0.1 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-2875. | HIGH 7.5EPSS 11.3% | 24 August 2015 |
| CVE-2015-6251 | Double free vulnerability in GnuTLS before 3.3.17 and 3.4.x before 3.4.4 allows remote attackers to cause a denial of service via a long DistinguishedName (DN) entry in a certificate. | MEDIUM 5.0EPSS 19.0% | 24 August 2015 |
| CVE-2015-6522 | SQL injection vulnerability in the WP Symposium plugin before 15.8 for WordPress allows remote attackers to execute arbitrary SQL commands via the size parameter to get_album_item.php. | EXPLOITHIGH 7.5EPSS 74.1% | 19 August 2015 |
| CVE-2015-5621 | The snmp_pdu_parse function in snmp_api.c in net-snmp 5.7.2 and earlier does not remove the varBind variable in a netsnmp_variable_list item when parsing of the SNMP PDU fails, which allows remote attackers to cause a denial of service (crash) and… | EXPLOITHIGH 7.5EPSS 40.9% | 19 August 2015 |
| CVE-2015-1830 | Directory traversal vulnerability in the fileserver upload/download functionality for blob messages in Apache ActiveMQ 5.x before 5.11.2 for Windows allows remote attackers to create JSP files in arbitrary directories via unspecified vectors. | EXPLOIT ×2 ✓MEDIUM 5.0EPSS 84.4% | 19 August 2015 |
| CVE-2015-2502 | Microsoft Internet Explorer Memory Corruption Vulnerability | KEVHIGH 8.8EPSS 51.0% | 19 August 2015 |
| CVE-2015-4029 | Cross-site scripting (XSS) vulnerability in the WebGUI in pfSense before 2.2.3 allows remote attackers to inject arbitrary web script or HTML via the zone parameter in a del action to services_captiveportal_zones.php. | MEDIUM 4.3EPSS 20.4% | 18 August 2015 |
| CVE-2015-5531 | Directory traversal vulnerability in Elasticsearch before 1.6.1 allows remote attackers to read arbitrary files via unspecified vectors related to snapshot API calls. | EXPLOITMEDIUM 5.0EPSS 94.8% | 17 August 2015 |
| CVE-2015-3798 | The TRE library in Libc in Apple iOS before 8.4.1 and OS X before 10.10.5 allows context-dependent attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted regular expression, a different… | EXPLOIT ✓HIGH 7.5EPSS 13.3% | 17 August 2015 |
| CVE-2015-3796 | The TRE library in Libc in Apple iOS before 8.4.1 and OS X before 10.10.5 allows context-dependent attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted regular expression, a different… | EXPLOIT ✓HIGH 7.5EPSS 12.4% | 17 August 2015 |
| CVE-2015-3783 | SceneKit in Apple OS X before 10.10.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via unspecified vectors. | EXPLOIT ✓HIGH 7.5EPSS 35.8% | 16 August 2015 |
| CVE-2015-2481 | The RyuJIT compiler in Microsoft .NET Framework 4.6 produces incorrect code during an attempt at optimization, which allows remote attackers to execute arbitrary code via a crafted .NET application, aka "RyuJIT Optimization Elevation of Privilege… | HIGH 9.3EPSS 14.1% | 15 August 2015 |
| CVE-2015-2480 | The RyuJIT compiler in Microsoft .NET Framework 4.6 produces incorrect code during an attempt at optimization, which allows remote attackers to execute arbitrary code via a crafted .NET application, aka "RyuJIT Optimization Elevation of Privilege… | HIGH 9.3EPSS 14.1% | 15 August 2015 |
| CVE-2015-2479 | The RyuJIT compiler in Microsoft .NET Framework 4.6 produces incorrect code during an attempt at optimization, which allows remote attackers to execute arbitrary code via a crafted .NET application, aka "RyuJIT Optimization Elevation of Privilege… | HIGH 9.3EPSS 16.9% | 15 August 2015 |
| CVE-2015-2477 | Microsoft Office 2007 SP3, Office for Mac 2011, Office for Mac 2016, and Word Viewer allow remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office Memory Corruption Vulnerability." | HIGH 9.3EPSS 13.6% | 15 August 2015 |
| CVE-2015-2476 | The WebDAV client in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 supports SSL 2.0, which makes it easier for remote attackers to… | LOW 2.6EPSS 11.2% | 15 August 2015 |
| CVE-2015-2475 | Cross-site scripting (XSS) vulnerability in uddi/search/frames.aspx in the UDDI Services component in Microsoft Windows Server 2008 SP2 and BizTalk Server 2010, 2013 Gold, and 2013 R2 allows remote attackers to inject arbitrary web script or HTML via… | MEDIUM 4.3EPSS 14.6% | 15 August 2015 |
| CVE-2015-2474 | Microsoft Windows Vista SP2 and Server 2008 SP2 allow remote authenticated users to execute arbitrary code via a crafted string in a Server Message Block (SMB) server error-logging action, aka "Server Message Block Memory Corruption Vulnerability." | HIGH 9.0EPSS 30.5% | 15 August 2015 |
| CVE-2015-2473 | Untrusted search path vulnerability in the client in Remote Desktop Protocol (RDP) through 8.1 in Microsoft Windows 7 SP1 and Windows Server 2008 R2 SP1 allows local users to gain privileges via a Trojan horse DLL in the current working directory, as… | HIGH 9.3EPSS 25.3% | 15 August 2015 |
| CVE-2015-2471 | Microsoft XML Core Services 3.0, 5.0, and 6.0 supports SSL 2.0, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by sniffing the network and conducting a decryption attack, aka "MSXML Information Disclosure… | MEDIUM 4.3EPSS 15.5% | 15 August 2015 |
| CVE-2015-2470 | Integer underflow in Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2013 RT SP1, Office for Mac 2011, and Word Viewer allows remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office Integer Underflow… | EXPLOIT ✓HIGH 9.3EPSS 26.9% | 15 August 2015 |
| CVE-2015-2469 | Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, and Office for Mac 2011 allow remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office Memory Corruption Vulnerability." | EXPLOIT ✓HIGH 9.3EPSS 26.9% | 15 August 2015 |
| CVE-2015-2468 | Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office for Mac 2011, Office for Mac 2016, Office Compatibility Pack SP3, Word Viewer, Word Automation Services on SharePoint Server 2010 SP2 and 2013 SP1, Word Web… | EXPLOIT ✓HIGH 9.3EPSS 29.5% | 15 August 2015 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.