Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
395,716 CVEs1,716 in CISA KEV17,392 with EPSS ≥ 10%25,049 with a public exploitUpdated 21 September 2026
17,392 results · page 267 of 348
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2010-1299 | Multiple PHP remote file inclusion vulnerabilities in DynPG CMS 4.1.0, and possibly earlier, when magic_quotes_gpc is disabled and register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the (1) DefineRootToTool… | EXPLOIT ×2MEDIUM 5.1EPSS 10.7% | 7 April 2010 |
| CVE-2010-1223 | Multiple buffer overflows in CA XOsoft r12.0 and r12.5 allow remote attackers to execute arbitrary code via (1) a malformed request to the ws_man/xosoapapi.asmx SOAP endpoint or (2) a long string to the entry_point.aspx service. | HIGH 10.0EPSS 16.8% | 7 April 2010 |
| CVE-2009-2936 | The Command Line Interface (aka Server CLI or administration interface) in the master process in the reverse proxy server in Varnish before 2.1.0 does not require authentication for commands received through a TCP port, which allows remote attackers to… | EXPLOITHIGH 7.5EPSS 63.8% | 5 April 2010 |
| CVE-2010-1240 | Adobe Reader and Acrobat 9.x before 9.3.3, and 8.x before 8.2.3 on Windows and Mac OS X, do not restrict the contents of one text field in the Launch File warning dialog, which makes it easier for remote attackers to trick users into executing an… | EXPLOIT ×3 ✓HIGH 9.3EPSS 73.6% | 5 April 2010 |
| CVE-2010-1225 | The memory-management implementation in the Virtual Machine Monitor (aka VMM or hypervisor) in Microsoft Virtual PC 2007 Gold and SP1, Virtual Server 2005 Gold and R2 SP1, and Windows Virtual PC does not properly restrict access from the guest OS to… | EXPLOIT ✓HIGH 9.3EPSS 28.2% | 1 April 2010 |
| CVE-2010-0842 | Unspecified vulnerability in the Sound component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, 1.4.2_25, and 1.3.1_27 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. | EXPLOIT ✓HIGH 7.5EPSS 77.7% | 1 April 2010 |
| CVE-2010-0840 | Oracle JRE Unspecified Vulnerability | KEVEXPLOIT ✓CRITICAL 9.8EPSS 96.3% | 1 April 2010 |
| CVE-2010-0838 | Unspecified vulnerability in the Java 2D component in Oracle Java SE and Java for Business 6 Update 18, 5.0, Update, and 23 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. | EXPLOIT ✓HIGH 7.5EPSS 14.9% | 1 April 2010 |
| CVE-2010-0094 | Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 18 and 5.0 Update 23 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. | EXPLOIT ✓HIGH 7.5EPSS 80.8% | 1 April 2010 |
| CVE-2010-0807 | Microsoft Internet Explorer 7 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a deleted object, leading to memory corruption, aka "HTML Rendering Memory Corruption Vulnerability." | HIGH 9.3EPSS 29.3% | 31 March 2010 |
| CVE-2010-0805 | The Tabular Data Control (TDC) ActiveX control in Microsoft Internet Explorer 5.01 SP4, 6 on Windows XP SP2 and SP3, and 6 SP1 allows remote attackers to execute arbitrary code via a long URL (DataURL parameter) that triggers memory corruption in the… | EXPLOIT ×2 ✓HIGH 9.3EPSS 80.6% | 31 March 2010 |
| CVE-2010-0494 | Cross-domain vulnerability in Microsoft Internet Explorer 6, 6 SP1, 7, and 8 allows user-assisted remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via a crafted HTML document in a situation where the… | MEDIUM 4.3EPSS 22.9% | 31 March 2010 |
| CVE-2010-0492 | Use-after-free vulnerability in mstime.dll in Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code via vectors related to the TIME2 behavior, the CTimeAction object, and destruction of markup, leading to memory corruption, aka… | HIGH 8.1EPSS 27.5% | 31 March 2010 |
| CVE-2010-0491 | Use-after-free vulnerability in Microsoft Internet Explorer 5.01 SP4, 6, and 6 SP1 allows remote attackers to execute arbitrary code by changing unspecified properties of an HTML object that has an onreadystatechange event handler, aka "HTML Object… | HIGH 9.3EPSS 29.3% | 31 March 2010 |
| CVE-2010-0490 | Microsoft Internet Explorer 6, 6 SP1, 7, and 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted, leading to memory… | HIGH 9.3EPSS 29.3% | 31 March 2010 |
| CVE-2010-0489 | Race condition in Microsoft Internet Explorer 5.01 SP4, 6, 6 SP1, and 7 allows remote attackers to execute arbitrary code via a crafted HTML document that triggers memory corruption, aka "Race Condition Memory Corruption Vulnerability." | HIGH 9.3EPSS 23.7% | 31 March 2010 |
| CVE-2010-0488 | Microsoft Internet Explorer 5.01 SP4, 6, 6 SP1, and 7 does not properly handle unspecified "encoding strings," which allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted web site, aka "Post Encoding… | MEDIUM 6.5EPSS 29.2% | 31 March 2010 |
| CVE-2010-0267 | Microsoft Internet Explorer 6, 6 SP1, and 7 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted, leading to memory corruption,… | HIGH 9.3EPSS 34.4% | 31 March 2010 |
| CVE-2010-0529 | Heap-based buffer overflow in QuickTime.qts in Apple QuickTime before 7.6.6 on Windows allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a PICT image with a BkPixPat opcode (0x12) containing crafted… | HIGH 9.3EPSS 12.2% | 31 March 2010 |
| CVE-2010-0520 | Heap-based buffer overflow in QuickTimeAuthoring.qtx in QuickTime in Apple Mac OS X before 10.6.3 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted FLC file, related to crafted DELTA_FLI… | EXPLOIT ✓MEDIUM 6.8EPSS 18.6% | 30 March 2010 |
| CVE-2010-1185 | Stack-based buffer overflow in serv.exe in SAP MaxDB 7.4.3.32, and 7.6.0.37 through 7.6.06 allows remote attackers to execute arbitrary code via an invalid length parameter in a handshake packet to TCP port 7210. | EXPLOIT ✓HIGH 10.0EPSS 15.2% | 29 March 2010 |
| CVE-2010-1175 | Microsoft Internet Explorer 7.0 on Windows XP and Windows Server 2003 allows remote attackers to have an unspecified impact via a certain XML document that references a crafted web site in the SRC attribute of an image element, related to a "0day… | EXPLOIT ✓HIGH 9.3EPSS 14.2% | 29 March 2010 |
| CVE-2010-1127 | Microsoft Internet Explorer 6 and 7 does not initialize certain data structures during execution of the createElement method, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via crafted… | MEDIUM 5.0EPSS 18.3% | 26 March 2010 |
| CVE-2010-0740 | The ssl3_get_record function in ssl/s3_pkt.c in OpenSSL 0.9.8f through 0.9.8m allows remote attackers to cause a denial of service (crash) via a malformed record in a TLS connection that triggers a NULL pointer dereference, related to the minor version… | EXPLOIT ✓MEDIUM 5.0EPSS 20.3% | 26 March 2010 |
| CVE-2010-1119 | Use-after-free vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, Safari before 4.1 on Mac OS X 10.4, and Safari on Apple iPhone OS allows remote attackers to execute arbitrary code or cause a denial of service… | EXPLOIT ✓HIGH 10.0EPSS 19.0% | 25 March 2010 |
| CVE-2010-1118 | Unspecified vulnerability in Internet Explorer 8 on Microsoft Windows 7 allows remote attackers to execute arbitrary code via unknown vectors, possibly related to a use-after-free issue, as demonstrated by Peter Vreugdenhil during a Pwn2Own competition… | HIGH 10.0EPSS 21.9% | 25 March 2010 |
| CVE-2010-1117 | Heap-based buffer overflow in Internet Explorer 8 on Microsoft Windows 7 allows remote attackers to discover the base address of a Windows .dll file, and possibly have unspecified other impact, via unknown vectors, as demonstrated by Peter Vreugdenhil… | HIGH 7.6EPSS 14.0% | 25 March 2010 |
| CVE-2010-0168 | The nsDocument::MaybePreLoadImage function in content/base/src/nsDocument.cpp in the image-preloading implementation in Mozilla Firefox 3.6 before 3.6.2 does not apply scheme restrictions and policy restrictions to the image's URL, which might allow… | EXPLOIT ✓HIGH 7.6EPSS 12.4% | 25 March 2010 |
| CVE-2010-0167 | The browser engine in Mozilla Firefox 3.0.x before 3.0.18, 3.5.x before 3.5.8, and 3.6.x before 3.6.2; Thunderbird before 3.0.2; and SeaMonkey before 2.0.3 allows remote attackers to cause a denial of service (memory corruption and application crash)… | EXPLOIT ✓HIGH 9.3EPSS 10.5% | 25 March 2010 |
| CVE-2010-1098 | The ANI parser in Microsoft Windows before 7 on the x86 platform, as used in Internet Explorer and other applications, allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted biClrUsed value in the BITMAPINFO… | HIGH 7.1EPSS 15.0% | 24 March 2010 |
| CVE-2010-0437 | The ip6_dst_lookup_tail function in net/ipv6/ip6_output.c in the Linux kernel before 2.6.27 does not properly handle certain circumstances involving an IPv6 TUN network interface and a large number of neighbors, which allows attackers to cause a denial… | EXPLOIT ✓HIGH 7.8EPSS 12.4% | 24 March 2010 |
| CVE-2010-1081 | Directory traversal vulnerability in the Community Polls (com_communitypolls) component 1.5.2, and possibly earlier, for Core Joomla! allows remote attackers to read arbitrary files via a .. | EXPLOIT ✓MEDIUM 5.0EPSS 14.6% | 23 March 2010 |
| CVE-2010-1056 | Directory traversal vulnerability in the RokDownloads (com_rokdownloads) component before 1.0.1 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. | EXPLOIT ✓MEDIUM 6.8EPSS 11.4% | 23 March 2010 |
| CVE-2010-1042 | Microsoft Windows Media Player 11 does not properly perform colorspace conversion, which allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted .AVI file. | EXPLOIT ✓MEDIUM 4.3EPSS 10.3% | 23 March 2010 |
| CVE-2010-1029 | Stack consumption vulnerability in the WebCore::CSSSelector function in WebKit, as used in Apple Safari 4.0.4, Apple Safari on iPhone OS and iPhone OS for iPod touch, and Google Chrome 4.0.249, allows remote attackers to cause a denial of service… | EXPLOIT ×2 ✓MEDIUM 5.0EPSS 10.4% | 19 March 2010 |
| CVE-2010-0688 | Stack-based buffer overflow in Orbital Viewer 1.04 allows user-assisted remote attackers to execute arbitrary code via a crafted (1) .orb or (2) .ov file. | EXPLOIT ×3 ✓HIGH 9.3EPSS 37.9% | 19 March 2010 |
| CVE-2010-0985 | Directory traversal vulnerability in the Abbreviations Manager (com_abbrev) component 1.1 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. | EXPLOIT ✓HIGH 7.5EPSS 13.1% | 16 March 2010 |
| CVE-2010-0397 | The xmlrpc extension in PHP 5.3.1 does not properly handle a missing methodName element in the first argument to the xmlrpc_decode_request function, which allows context-dependent attackers to cause a denial of service (NULL pointer dereference and… | EXPLOIT ✓MEDIUM 5.0EPSS 11.5% | 16 March 2010 |
| CVE-2010-0972 | Directory traversal vulnerability in the GCalendar (com_gcalendar) component 2.1.5 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. | EXPLOIT ✓HIGH 7.5EPSS 13.3% | 16 March 2010 |
| CVE-2010-0050 | Use-after-free vulnerability in WebKit in Apple Safari before 4.0.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via an HTML document with improperly nested tags. | EXPLOIT ✓HIGH 8.8EPSS 11.6% | 15 March 2010 |
| CVE-2010-0049 | Use-after-free vulnerability in WebKit in Apple Safari before 4.0.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via HTML elements with right-to-left (RTL) text directionality. | EXPLOIT ✓HIGH 9.3EPSS 10.9% | 15 March 2010 |
| CVE-2010-0806 | Microsoft Internet Explorer Use-After-Free Vulnerability | KEVEXPLOIT ×2 ✓HIGH 8.8EPSS 82.2% | 10 March 2010 |
| CVE-2010-0265 | Buffer overflow in Microsoft Windows Movie Maker 2.1, 2.6, and 6.0, and Microsoft Producer 2003, allows remote attackers to execute arbitrary code via a crafted project (.MSWMM) file, aka "Movie Maker and Producer Buffer Overflow Vulnerability." | EXPLOIT ✓HIGH 9.3EPSS 26.6% | 10 March 2010 |
| CVE-2010-0264 | Microsoft Office Excel 2002 SP3, Office 2004 and 2008 for Mac, and Open XML File Format Converter for Mac do not properly parse the Excel file format, which allows remote attackers to execute arbitrary code via a crafted spreadsheet, aka "Microsoft… | HIGH 9.3EPSS 21.2% | 10 March 2010 |
| CVE-2010-0263 | Microsoft Office Excel 2007 SP1 and SP2; Office 2008 for Mac; Open XML File Format Converter for Mac; Office Excel Viewer SP1 and SP2; Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2; and Office SharePoint Server… | HIGH 9.3EPSS 25.7% | 10 March 2010 |
| CVE-2010-0262 | Microsoft Office Excel 2007 SP1 and SP2 and Office 2004 for Mac do not properly parse the Excel file format, which allows remote attackers to execute arbitrary code via a crafted spreadsheet that triggers access of an uninitialized stack variable, aka… | HIGH 9.3EPSS 21.3% | 10 March 2010 |
| CVE-2010-0261 | Heap-based buffer overflow in Microsoft Office Excel 2007 SP1 and SP2 and Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2 allows remote attackers to execute arbitrary code via a crafted spreadsheet in which "a… | HIGH 9.3EPSS 23.1% | 10 March 2010 |
| CVE-2010-0260 | Heap-based buffer overflow in Microsoft Office Excel 2007 SP1 and SP2; Office Excel Viewer SP1 and SP2; and Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2 allows remote attackers to execute arbitrary code via a… | HIGH 9.3EPSS 23.1% | 10 March 2010 |
| CVE-2010-0258 | Microsoft Office Excel 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Office Excel Viewer SP1 and SP2; and Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1… | HIGH 7.8EPSS 61.0% | 10 March 2010 |
| CVE-2010-0257 | Microsoft Office Excel 2002 SP3 does not properly parse the Excel file format, which allows remote attackers to execute arbitrary code via a crafted spreadsheet, aka "Microsoft Office Excel Record Memory Corruption Vulnerability." | HIGH 9.3EPSS 18.6% | 10 March 2010 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.