Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
395,656 CVEs1,716 in CISA KEV17,391 with EPSS ≥ 10%25,049 with a public exploitUpdated 20 September 2026
17,391 results · page 230 of 348
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2013-6129 | The install/upgrade.php scripts in vBulletin 4.1 and 5 allow remote attackers to create administrative accounts via the customerid, htmldata[password], htmldata[confirmpassword], and htmldata[email] parameters, as exploited in the wild in October 2013. | EXPLOIT ✓HIGH 7.5EPSS 51.9% | 19 October 2013 |
| CVE-2013-6021 | Buffer overflow in WGagent in WatchGuard WSM and Fireware before 11.8 allows remote attackers to execute arbitrary code via a long sessionid value in a cookie. | EXPLOITHIGH 9.3EPSS 11.7% | 19 October 2013 |
| CVE-2013-4365 | Heap-based buffer overflow in the fcgid_header_bucket_read function in fcgid_bucket.c in the mod_fcgid module before 2.3.9 for the Apache HTTP Server allows remote attackers to have an unspecified impact via unknown vectors. | HIGH 7.5EPSS 13.2% | 17 October 2013 |
| CVE-2013-5842 | Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors… | HIGH 10.0EPSS 17.6% | 16 October 2013 |
| CVE-2013-3827 | Unspecified vulnerability in the Oracle GlassFish Server component in Oracle Fusion Middleware 2.1.1, 3.0.1, and 3.1.2; the Oracle JDeveloper component in Oracle Fusion Middleware 11.1.2.3.0, 11.1.2.4.0, and 12.1.2.0.0; and the Oracle WebLogic Server… | EXPLOIT ✓MEDIUM 5.0EPSS 32.4% | 16 October 2013 |
| CVE-2013-4826 | Unspecified vulnerability in HP Intelligent Management Center (iMC) and HP IMC Service Operation Management Software Module allows remote attackers to obtain sensitive information via unknown vectors, aka ZDI-CAN-1647. | MEDIUM 5.0EPSS 31.6% | 13 October 2013 |
| CVE-2013-4824 | Unspecified vulnerability in HP Intelligent Management Center (iMC) and HP IMC Service Operation Management Software Module allows remote attackers to bypass authentication via unknown vectors, aka ZDI-CAN-1644. | HIGH 7.5EPSS 23.9% | 13 October 2013 |
| CVE-2013-4823 | Unspecified vulnerability in HP Intelligent Management Center (iMC) and HP IMC Branch Intelligent Management System Software Module (aka BIMS) allows remote attackers to obtain sensitive information via unknown vectors, aka ZDI-CAN-1607. | MEDIUM 5.0EPSS 37.5% | 13 October 2013 |
| CVE-2013-4822 | Unspecified vulnerability in HP Intelligent Management Center (iMC) and HP IMC Branch Intelligent Management System Software Module (aka BIMS) allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1606. | EXPLOIT ✓HIGH 10.0EPSS 62.6% | 13 October 2013 |
| CVE-2013-3686 | cgi-bin/operator/param in AirLive WL2600CAM and possibly other camera models allows remote attackers to obtain the administrator password via a list action. | EXPLOITHIGH 10.0EPSS 27.6% | 11 October 2013 |
| CVE-2013-2578 | cgi-bin/admin/servetest in TP-Link IP Cameras TL-SC3130, TL-SC3130G, TL-SC3171, TL-SC3171G, and possibly other models before beta firmware LM.1.6.18P12_sign6 allows remote attackers to execute arbitrary commands via shell metacharacters in (1) the… | EXPLOIT ✓HIGH 10.0EPSS 73.7% | 11 October 2013 |
| CVE-2013-5528 | Directory traversal vulnerability in the Tomcat administrative web interface in Cisco Unified Communications Manager allows remote authenticated users to read arbitrary files via directory traversal sequences in an unspecified input string, aka Bug ID… | EXPLOITMEDIUM 4.0EPSS 23.3% | 11 October 2013 |
| CVE-2012-4412 | Integer overflow in string/strcoll_l.c in the GNU C Library (aka glibc or libc6) 2.17 and earlier allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long string, which triggers a heap-based… | EXPLOIT ✓HIGH 7.5EPSS 16.7% | 9 October 2013 |
| CVE-2013-5967 | Multiple SQL injection vulnerabilities in AlienVault Open Source Security Information Management (OSSIM) 4.3 and earlier allow remote attackers to execute arbitrary SQL commands via the date_from parameter to (1) radar-iso27001-potential.php, (2)… | EXPLOIT ✓HIGH 7.5EPSS 19.0% | 9 October 2013 |
| CVE-2013-5576 | 2.5.x before 2.5.14 and 3.x before 3.1.5 allows remote authenticated users or remote attackers to bypass intended access restrictions and upload files with dangerous extensions via a filename with a trailing . | EXPLOIT ✓MEDIUM 6.8EPSS 48.2% | 9 October 2013 |
| CVE-2013-3897 | Microsoft Internet Explorer Use-After-Free Vulnerability | KEVEXPLOIT ✓HIGH 8.8EPSS 77.3% | 9 October 2013 |
| CVE-2013-3896 | Microsoft Silverlight Information Disclosure Vulnerability | KEVEXPLOIT ✓MEDIUM 5.5EPSS 69.4% | 9 October 2013 |
| CVE-2013-3895 | Microsoft SharePoint Server 2007 SP3 and 2010 SP1 and SP2 allows remote attackers to conduct clickjacking attacks via a crafted web page, aka "Parameter Injection Vulnerability." | MEDIUM 6.8EPSS 29.6% | 9 October 2013 |
| CVE-2013-3894 | The kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows Server 2012, and Windows RT allow remote attackers to execute arbitrary code… | HIGH 8.1EPSS 43.1% | 9 October 2013 |
| CVE-2013-3892 | Microsoft Word 2007 SP3 and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code via a crafted Office document, aka "Memory Corruption Vulnerability." | HIGH 9.3EPSS 20.2% | 9 October 2013 |
| CVE-2013-3891 | Microsoft Word 2003 SP3 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Memory Corruption Vulnerability." | HIGH 9.3EPSS 18.7% | 9 October 2013 |
| CVE-2013-3890 | Microsoft Excel 2007 SP3, Excel Viewer, and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Excel Memory Corruption Vulnerability." | HIGH 9.3EPSS 20.0% | 9 October 2013 |
| CVE-2013-3889 | Microsoft Excel 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Office 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Office for Mac 2011; Excel Viewer; Office Compatibility Pack SP3; and Excel Services and Word Automation Services in SharePoint Server… | HIGH 9.3EPSS 27.4% | 9 October 2013 |
| CVE-2013-3886 | Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability." | HIGH 9.3EPSS 20.1% | 9 October 2013 |
| CVE-2013-3885 | Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than… | HIGH 9.3EPSS 20.1% | 9 October 2013 |
| CVE-2013-3882 | Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than… | HIGH 9.3EPSS 20.1% | 9 October 2013 |
| CVE-2013-3881 | win32k.sys in the kernel-mode drivers in Microsoft Windows 7 SP1 and Windows Server 2008 R2 SP1 allows local users to gain privileges via a crafted application, aka "Win32k NULL Page Vulnerability." | EXPLOIT ✓HIGH 7.2EPSS 14.8% | 9 October 2013 |
| CVE-2013-3880 | The App Container feature in the kernel-mode drivers in Microsoft Windows 8, Windows Server 2012, and Windows RT allows remote attackers to bypass intended access restrictions and obtain sensitive information from a different container via a Trojan… | LOW 3.5EPSS 12.9% | 9 October 2013 |
| CVE-2013-3875 | Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability." | HIGH 9.3EPSS 20.1% | 9 October 2013 |
| CVE-2013-3874 | Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability." | HIGH 9.3EPSS 20.1% | 9 October 2013 |
| CVE-2013-3873 | Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than… | HIGH 9.3EPSS 20.1% | 9 October 2013 |
| CVE-2013-3872 | Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than… | HIGH 9.3EPSS 21.0% | 9 October 2013 |
| CVE-2013-3871 | Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability." | HIGH 9.3EPSS 21.2% | 9 October 2013 |
| CVE-2013-3861 | Microsoft .NET Framework 2.0 SP2, 3.5, 3.5 SP1, 3.5.1, 4, and 4.5 allows remote attackers to cause a denial of service (application crash or hang) via crafted character sequences in JSON data, aka "JSON Parsing Vulnerability." | HIGH 7.8EPSS 82.4% | 9 October 2013 |
| CVE-2013-3860 | Microsoft .NET Framework 2.0 SP2, 3.5, 3.5 SP1, 3.5.1, 4, and 4.5 does not properly parse a DTD during XML digital-signature validation, which allows remote attackers to cause a denial of service (application crash or hang) via a crafted signed XML… | HIGH 7.8EPSS 30.6% | 9 October 2013 |
| CVE-2013-3195 | The DSA_InsertItem function in Comctl32.dll in the Windows common control library in Microsoft Windows XP SP2, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows Server 2012, and Windows RT… | HIGH 10.0EPSS 38.5% | 9 October 2013 |
| CVE-2013-3128 | The kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows Server 2012, and Windows RT, and .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, and… | HIGH 9.3EPSS 50.4% | 9 October 2013 |
| CVE-2013-4788 | The PTR_MANGLE implementation in the GNU C Library (aka glibc or libc6) 2.4, 2.17, and earlier, and Embedded GLIBC (EGLIBC) does not initialize the random value for the pointer guard, which makes it easier for context-dependent attackers to control… | EXPLOITMEDIUM 5.1EPSS 11.4% | 4 October 2013 |
| CVE-2013-3248 | Untrusted search path vulnerability in Corel PDF Fusion 1.11 allows local users to gain privileges via a Trojan horse wintab32.dll file in the current working directory, as demonstrated by a directory that contains a .pdf or .xps file. | EXPLOIT ✓HIGH 9.3EPSS 18.5% | 3 October 2013 |
| CVE-2013-5979 | Directory traversal vulnerability in Spring Signage Xibo 1.2.x before 1.2.3 and 1.4.x before 1.4.2 allows remote attackers to read arbitrary files via a .. | EXPLOITMEDIUM 5.0EPSS 18.1% | 2 October 2013 |
| CVE-2013-3969 | The find prototype in scripting/engine_v8.h in MongoDB 2.4.0 through 2.4.4 allows remote authenticated users to cause a denial of service (uninitialized pointer dereference and server crash) or possibly execute arbitrary code via an invalid RefDB object. | EXPLOIT ✓MEDIUM 6.5EPSS 10.1% | 1 October 2013 |
| CVE-2013-1892 | MongoDB before 2.0.9 and 2.2.x before 2.2.4 does not properly validate requests to the nativeHelper function in SpiderMonkey, which allows remote authenticated users to cause a denial of service (invalid memory access and server crash) or execute… | EXPLOIT ×2 ✓MEDIUM 6.0EPSS 44.5% | 1 October 2013 |
| CVE-2013-3690 | Cross-site request forgery (CSRF) vulnerability in cgi-bin/users.cgi in Brickcom FB-100Ap, WCB-100Ap, MD-100Ap, WFB-100Ap, OB-100Ae, OSD-040E, and possibly other camera models with firmware 3.1.0.8 and earlier, allows remote attackers to hijack the… | EXPLOIT ✓MEDIUM 6.8EPSS 12.4% | 1 October 2013 |
| CVE-2012-5627 | Oracle MySQL and MariaDB 5.5.x before 5.5.29, 5.3.x before 5.3.12, and 5.2.x before 5.2.14 does not modify the salt during multiple executions of the change_user command within the same connection which makes it easier for remote authenticated users to… | EXPLOIT ✓MEDIUM 4.0EPSS 11.4% | 1 October 2013 |
| CVE-2013-1839 | The strHdrAcptLangGetItem function in errorpage.cc in Squid 3.2.x before 3.2.9 and 3.3.x before 3.3.3 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a "," character in an Accept-Language header. | HIGH 7.8EPSS 18.3% | 30 September 2013 |
| CVE-2013-5962 | Unrestricted file upload vulnerability in frames/upload-images.php in the Complete Gallery Manager plugin before 3.3.4 rev40279 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then… | EXPLOITMEDIUM 5.1EPSS 14.8% | 30 September 2013 |
| CVE-2013-2068 | Multiple directory traversal vulnerabilities in the AgentController in Red Hat CloudForms Management Engine 2.0 allow remote attackers to create and overwrite arbitrary files via a .. | EXPLOIT ✓HIGH 9.4EPSS 58.6% | 28 September 2013 |
| CVE-2013-5093 | The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object. | EXPLOIT ✓MEDIUM 6.8EPSS 38.7% | 27 September 2013 |
| CVE-2013-5486 | Directory traversal vulnerability in processImageSave.jsp in DCNM-SAN Server in Cisco Prime Data Center Network Manager (DCNM) before 6.2(1) allows remote attackers to write arbitrary files via the chartid parameter, aka Bug IDs CSCue77035 and CSCue77036. | EXPLOIT ✓HIGH 10.0EPSS 76.0% | 23 September 2013 |
| CVE-2013-3893 | Microsoft Internet Explorer Resource Management Errors Vulnerability | KEVEXPLOIT ×2 ✓HIGH 8.8EPSS 85.8% | 18 September 2013 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.