Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
395,739 CVEs1,716 in CISA KEV17,392 with EPSS ≥ 10%25,049 with a public exploitUpdated 21 September 2026
17,392 results · page 269 of 348
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2010-0020 | The SMB implementation in the Server service in Microsoft Windows 2000 SP4, Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista Gold, SP1, and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 does not properly validate request… | HIGH 9.0EPSS 32.0% | 10 February 2010 |
| CVE-2010-0017 | Race condition in the SMB client implementation in Microsoft Windows Server 2008 R2 and Windows 7 allows remote SMB servers and man-in-the-middle attackers to execute arbitrary code, and in the SMB client implementation in Windows Vista Gold, SP1, and… | EXPLOIT ✓HIGH 9.3EPSS 30.9% | 10 February 2010 |
| CVE-2009-4637 | FFmpeg 0.5 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown vectors that trigger a stack-based buffer overflow. | EXPLOIT ✓HIGH 10.0EPSS 17.0% | 10 February 2010 |
| CVE-2010-0557 | IBM Cognos Express 9.0 allows attackers to obtain unspecified access to the Tomcat Manager component, and cause a denial of service, by leveraging hardcoded credentials. | EXPLOIT ✓HIGH 7.5EPSS 51.1% | 5 February 2010 |
| CVE-2003-1582 | Microsoft Internet Information Services (IIS) 6.0, when DNS resolution is enabled for client IP addresses, allows remote attackers to inject arbitrary text into log files via an HTTP request in conjunction with a crafted DNS response, as demonstrated by… | LOW 2.6EPSS 10.3% | 5 February 2010 |
| CVE-2010-0255 | Microsoft Internet Explorer 5.01 SP4, 6, 6 SP1, 7, and 8 does not prevent rendering of non-HTML local files as HTML documents, which allows remote attackers to bypass intended access restrictions and read arbitrary files via vectors involving JavaScript… | MEDIUM 4.3EPSS 37.0% | 4 February 2010 |
| CVE-2010-0555 | Microsoft Internet Explorer 5.01 SP4, 6, 6 SP1, 7, and 8 does not prevent rendering of non-HTML local files as HTML documents, which allows remote attackers to bypass intended access restrictions and read arbitrary files via vectors involving the… | HIGH 9.3EPSS 20.9% | 4 February 2010 |
| CVE-2010-0295 | lighttpd before 1.4.26, and 1.5.x, allocates a buffer for each read operation that occurs for a request, which allows remote attackers to cause a denial of service (memory consumption) by breaking a request into small pieces that are sent at a slow rate. | EXPLOIT ✓MEDIUM 5.0EPSS 12.1% | 3 February 2010 |
| CVE-2010-0308 | lib/rfc1035.c in Squid 2.x, 3.0 through 3.0.STABLE22, and 3.1 through 3.1.0.15 allows remote attackers to cause a denial of service (assertion failure) via a crafted DNS packet that only contains a header. | MEDIUM 4.0EPSS 27.3% | 3 February 2010 |
| CVE-2010-0304 | Multiple buffer overflows in the LWRES dissector in Wireshark 0.9.15 through 1.0.10 and 1.2.0 through 1.2.5 allow remote attackers to cause a denial of service (crash) via a malformed packet, as demonstrated using a stack-based buffer overflow to the… | EXPLOIT ×3 ✓HIGH 7.5EPSS 73.7% | 3 February 2010 |
| CVE-2010-0442 | The bitsubstr function in backend/utils/adt/varbit.c in PostgreSQL 8.0.23, 8.1.11, and 8.3.8 allows remote authenticated users to cause a denial of service (daemon crash) or have unspecified other impact via vectors involving a negative integer in the… | EXPLOIT ✓MEDIUM 6.5EPSS 13.4% | 2 February 2010 |
| CVE-2010-0467 | Directory traversal vulnerability in the ccNewsletter (com_ccnewsletter) component 1.0.5 for Joomla! allows remote attackers to read arbitrary files via a .. | EXPLOIT ×2 ✓MEDIUM 5.8EPSS 43.3% | 2 February 2010 |
| CVE-2010-0010 | Integer overflow in the ap_proxy_send_fb function in proxy/proxy_util.c in mod_proxy in the Apache HTTP Server before 1.3.42 on 64-bit platforms allows remote origin servers to cause a denial of service (daemon crash) or possibly execute arbitrary code… | MEDIUM 6.8EPSS 43.4% | 2 February 2010 |
| CVE-2009-2902 | Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to delete work-directory files via directory traversal sequences in a WAR filename, as demonstrated by the ...war filename. | MEDIUM 4.3EPSS 10.8% | 28 January 2010 |
| CVE-2009-4272 | A certain Red Hat patch for net/ipv4/route.c in the Linux kernel 2.6.18 on Red Hat Enterprise Linux (RHEL) 5 allows remote attackers to cause a denial of service (deadlock) via crafted packets that force collisions in the IPv4 routing hash table, and… | HIGH 7.5EPSS 11.1% | 27 January 2010 |
| CVE-2009-4273 | stap-server in SystemTap before 1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in stap command-line arguments in a request. | EXPLOIT ✓HIGH 10.0EPSS 17.7% | 26 January 2010 |
| CVE-2010-0248 | Microsoft Internet Explorer 6, 6 SP1, 7, and 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted, leading to memory… | EXPLOIT ✓HIGH 8.1EPSS 53.1% | 22 January 2010 |
| CVE-2010-0247 | Microsoft Internet Explorer 5.01 SP4, 6, and 6 SP1 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted, leading to memory… | HIGH 9.3EPSS 19.0% | 22 January 2010 |
| CVE-2010-0246 | Microsoft Internet Explorer 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted, leading to memory corruption, aka… | HIGH 9.3EPSS 19.0% | 22 January 2010 |
| CVE-2010-0245 | Microsoft Internet Explorer 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted, leading to memory corruption, aka… | HIGH 9.3EPSS 19.0% | 22 January 2010 |
| CVE-2010-0244 | Microsoft Internet Explorer 6, 6 SP1, 7, and 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted, leading to memory… | HIGH 9.3EPSS 20.8% | 22 January 2010 |
| CVE-2010-0027 | The URL validation functionality in Microsoft Internet Explorer 5.01, 6, 6 SP1, 7 and 8, and the ShellExecute API function in Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2, does not properly process input parameters, which allows remote… | EXPLOIT ✓HIGH 9.3EPSS 34.0% | 22 January 2010 |
| CVE-2010-0379 | Multiple unspecified vulnerabilities in the Macromedia Flash ActiveX control in Adobe Flash Player 6, as distributed in Microsoft Windows XP SP2 and SP3, might allow remote attackers to execute arbitrary code via unspecified vectors that are not related… | HIGH 9.3EPSS 16.3% | 21 January 2010 |
| CVE-2010-0232 | Microsoft Windows Kernel Exception Handler Vulnerability | KEVEXPLOIT ✓HIGH 7.8EPSS 29.3% | 21 January 2010 |
| CVE-2009-4000 | Directory traversal vulnerability in goform/formExportDataLogs in HP Power Manager before 4.2.10 allows remote attackers to overwrite arbitrary files, and execute arbitrary code, via directory traversal sequences in the fileName parameter. | HIGH 10.0EPSS 19.8% | 20 January 2010 |
| CVE-2009-3999 | Stack-based buffer overflow in goform/formExportDataLogs in HP Power Manager before 4.2.10 allows remote attackers to execute arbitrary code via a long fileName parameter. | EXPLOIT ✓HIGH 10.0EPSS 71.8% | 20 January 2010 |
| CVE-2010-0361 | Stack-based buffer overflow in the WebDAV implementation in webservd in Sun Java System Web Server (aka SJWS) 7.0 Update 7 allows remote attackers to cause a denial of service (daemon crash) and possibly have unspecified other impact via a long URI in… | EXPLOIT ×3 ✓HIGH 10.0EPSS 80.4% | 20 January 2010 |
| CVE-2010-0359 | Buffer overflow in the SSLv2 support in Zeus Web Server before 4.3r5 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a long string in an invalid Client Hello message. | EXPLOIT ✓HIGH 10.0EPSS 20.0% | 20 January 2010 |
| CVE-2010-0356 | Stack-based buffer overflow in the MOVIEPLAYER.MoviePlayerCtrl.1 ActiveX control in MoviePlayer.ocx 6.8.0.0 in Viscom Software Movie Player Pro SDK ActiveX 6.8 allows remote attackers to execute arbitrary code via a long strFontName parameter to the… | EXPLOIT ×2 ✓HIGH 9.3EPSS 30.3% | 18 January 2010 |
| CVE-2010-0317 | Novell Netware 6.5 SP8 allows remote attackers to cause a denial of service (NULL pointer dereference, memory consumption, ABEND, and crash) via a large number of malformed or AFP requests that are not properly handled by (1) the CIFS functionality in… | EXPLOIT ✓HIGH 7.8EPSS 10.5% | 15 January 2010 |
| CVE-2010-0249 | Microsoft Internet Explorer Use-After-Free Vulnerability | KEVEXPLOIT ×2 ✓HIGH 8.8EPSS 91.9% | 15 January 2010 |
| CVE-2009-4496 | Boa 0.94.14rc21 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape… | EXPLOIT ✓MEDIUM 5.0EPSS 12.3% | 13 January 2010 |
| CVE-2009-4492 | WEBrick 1.3.1 in Ruby 1.8.6 through patchlevel 383, 1.8.7 through patchlevel 248, 1.8.8dev, 1.9.1 through patchlevel 376, and 1.9.2dev writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a… | EXPLOIT ✓HIGH 7.5EPSS 16.2% | 13 January 2010 |
| CVE-2009-4491 | thttpd 2.25b0 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape… | EXPLOIT ✓CRITICAL 9.8EPSS 13.7% | 13 January 2010 |
| CVE-2009-4490 | mini_httpd 1.19 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape… | EXPLOIT ✓MEDIUM 5.0EPSS 10.2% | 13 January 2010 |
| CVE-2009-4488 | Varnish 2.0.6 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape… | EXPLOIT ✓CRITICAL 9.8EPSS 13.0% | 13 January 2010 |
| CVE-2009-4487 | nginx 0.7.64 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape… | EXPLOIT ✓MEDIUM 6.8EPSS 29.5% | 13 January 2010 |
| CVE-2010-0018 | Integer overflow in the Embedded OpenType (EOT) Font Engine (t2embed.dll) in Microsoft Windows 2000 SP4; Windows XP SP2 and SP3; Windows Server 2003 SP2; Windows Vista Gold, SP1, and SP2; Windows Server 2008 Gold, SP2, and R2; and Windows 7 allows… | HIGH 9.3EPSS 26.5% | 13 January 2010 |
| CVE-2009-3959 | Integer overflow in the U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, allows remote attackers to execute arbitrary code via a malformed PDF document. | HIGH 10.0EPSS 11.5% | 13 January 2010 |
| CVE-2009-3958 | Multiple stack-based buffer overflows in the NOS Microsystems getPlus Helper ActiveX control before 1.6.2.49 in gp.ocx in the Download Manager in Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, might allow remote… | EXPLOITHIGH 10.0EPSS 52.6% | 13 January 2010 |
| CVE-2009-3955 | Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, allows remote attackers to execute arbitrary code via a crafted JPC_MS_RGN marker in the Jp2c stream of a JpxDecode encoded data stream, which triggers an integer sign… | HIGH 10.0EPSS 15.8% | 13 January 2010 |
| CVE-2009-3953 | Adobe Acrobat and Reader Universal 3D Remote Code Execution Vulnerability | KEVEXPLOIT ✓HIGH 8.8EPSS 83.9% | 13 January 2010 |
| CVE-2010-0013 | Directory traversal vulnerability in slp.c in the MSN protocol plugin in libpurple in Pidgin 2.6.4 and Adium 1.3.8 allows remote attackers to read arbitrary files via a .. | EXPLOIT ✓HIGH 7.5EPSS 12.5% | 9 January 2010 |
| CVE-2009-4010 | Unspecified vulnerability in PowerDNS Recursor before 3.1.7.2 allows remote attackers to spoof DNS data via crafted zones. | HIGH 7.5EPSS 10.3% | 8 January 2010 |
| CVE-2009-4009 | Buffer overflow in PowerDNS Recursor before 3.1.7.2 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via crafted packets. | HIGH 10.0EPSS 17.6% | 8 January 2010 |
| CVE-2009-4588 | Heap-based buffer overflow in the WindsPlayerIE.View.1 ActiveX control in WindsPly.ocx 3.5.0.0 Beta, 3.0.0.5, and earlier in AwingSoft Awakening Web3D Player and Winds3D Viewer allows remote attackers to cause a denial of service (application crash) or… | EXPLOIT ×2 ✓HIGH 9.3EPSS 32.0% | 7 January 2010 |
| CVE-2010-0157 | Directory traversal vulnerability in the Bible Study (com_biblestudy) component 6.1 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. | EXPLOIT ✓HIGH 7.5EPSS 13.0% | 6 January 2010 |
| CVE-2009-4502 | The NET_TCP_LISTEN function in net.c in Zabbix Agent before 1.6.7, when running on FreeBSD or Solaris, allows remote attackers to bypass the EnableRemoteCommands setting and execute arbitrary commands via shell metacharacters in the argument to… | EXPLOIT ×2 ✓HIGH 9.3EPSS 21.6% | 31 December 2009 |
| CVE-2009-4498 | The node_process_command function in Zabbix Server before 1.8 allows remote attackers to execute arbitrary commands via a crafted request. | EXPLOIT ×2 ✓MEDIUM 6.8EPSS 31.9% | 31 December 2009 |
| CVE-2009-4484 | Multiple stack-based buffer overflows in the CertDecoder::GetName function in src/asn.cpp in TaoCrypt in yaSSL before 1.9.9, as used in mysqld in MySQL 5.0.x before 5.0.90, MySQL 5.1.x before 5.1.43, MySQL 5.5.x through 5.5.0-m2, and other products,… | EXPLOIT ✓HIGH 7.5EPSS 69.6% | 30 December 2009 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.