Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
395,841 CVEs1,716 in CISA KEV17,392 with EPSS ≥ 10%25,049 with a public exploitUpdated 21 September 2026
17,392 results · page 279 of 348
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2009-0187 | Stack-based buffer overflow in Orbit Downloader 2.8.2 and 2.8.3, and possibly other versions before 2.8.5, allows remote attackers to execute arbitrary code via a crafted HTTP URL with a long host name, which is not properly handled when constructing a… | EXPLOIT ×2 ✓HIGH 9.3EPSS 40.0% | 26 February 2009 |
| CVE-2009-0238 | Microsoft Office Remote Code Execution | KEVHIGH 8.8EPSS 43.2% | 25 February 2009 |
| CVE-2008-6222 | Directory traversal vulnerability in the Pro Desk Support Center (com_pro_desk) component 1.0 and 1.2 for Joomla! allows remote attackers to read arbitrary files via a .. | EXPLOIT ×2 ✓MEDIUM 5.0EPSS 11.5% | 20 February 2009 |
| CVE-2008-6221 | PHP remote file inclusion vulnerability in config.dadamail.php in the Dada Mail Manager (com_dadamail) component 2.6 for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[mosConfig_absolute_path] parameter. | EXPLOIT ✓HIGH 7.5EPSS 37.7% | 20 February 2009 |
| CVE-2009-0658 | Buffer overflow in Adobe Reader 9.0 and earlier, and Acrobat 9.0 and earlier, allows remote attackers to execute arbitrary code via a crafted PDF document, related to a non-JavaScript function call and possibly an embedded JBIG2 image stream, as… | EXPLOIT ×3 ✓HIGH 7.8EPSS 87.8% | 20 February 2009 |
| CVE-2009-0650 | Stack-based buffer overflow in the GetStatsFromLine function in TPTEST 3.1.7 and earlier, and possibly 5.02, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a STATS line with a long pwd… | EXPLOIT ✓HIGH 10.0EPSS 12.8% | 20 February 2009 |
| CVE-2008-6194 | Memory leak in the DNS server in Microsoft Windows allows remote attackers to cause a denial of service (memory consumption) via DNS packets. | HIGH 7.8EPSS 11.4% | 19 February 2009 |
| CVE-2009-0647 | msnmsgr.exe in Windows Live Messenger (WLM) 2009 build 14.0.8064.206, and other 14.0.8064.x builds, allows remote attackers to cause a denial of service (application crash) via a modified header in a packet, as possibly demonstrated by a UTF-8.0 value… | MEDIUM 5.0EPSS 17.4% | 19 February 2009 |
| CVE-2008-6172 | Directory traversal vulnerability in captcha/captcha_image.php in the RWCards (com_rwcards) 3.0.11 component for Joomla!, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via directory traversal… | EXPLOIT ✓MEDIUM 6.8EPSS 12.3% | 19 February 2009 |
| CVE-2009-0595 | PHP remote file inclusion vulnerability in skysilver/login.tpl.php in phpSkelSite 1.4, when register_globals is enabled and magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary PHP code via a URL in the theme parameter. | EXPLOIT ✓MEDIUM 5.1EPSS 22.2% | 16 February 2009 |
| CVE-2009-0592 | Multiple directory traversal vulnerabilities in PNphpBB2 1.2i and earlier allow remote attackers to include and execute arbitrary local files via a .. | EXPLOIT ✓HIGH 7.5EPSS 28.8% | 16 February 2009 |
| CVE-2008-6132 | Eval injection vulnerability in reserve.php in phpScheduleIt 1.2.10 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary PHP code via the start_date parameter. | EXPLOIT ×2 ✓MEDIUM 6.8EPSS 26.1% | 13 February 2009 |
| CVE-2009-0546 | Stack-based buffer overflow in NewsGator FeedDemon 2.7 and earlier allows user-assisted remote attackers to execute arbitrary code via a long text attribute in an outline element in a .opml file. | EXPLOIT ×4 ✓HIGH 9.3EPSS 36.5% | 12 February 2009 |
| CVE-2009-0545 | cgi-bin/kerbynet in ZeroShell 1.0beta11 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the type parameter in a NoAuthREQ x509List action. | EXPLOIT ✓HIGH 10.0EPSS 90.4% | 12 February 2009 |
| CVE-2009-0544 | Buffer overflow in the PyCrypto ARC2 module 2.0.1 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a large ARC2 key length. | EXPLOIT ✓HIGH 10.0EPSS 11.5% | 12 February 2009 |
| CVE-2009-0543 | ProFTPD Server 1.3.1, with NLS support enabled, allows remote attackers to bypass SQL injection protection mechanisms via invalid, encoded multibyte characters, which are not properly handled in (1) mod_sql_mysql and (2) mod_sql_postgres. | EXPLOIT ✓MEDIUM 6.8EPSS 18.7% | 12 February 2009 |
| CVE-2009-0542 | SQL injection vulnerability in ProFTPD Server 1.3.1 through 1.3.2rc2 allows remote attackers to execute arbitrary SQL commands via a "%" (percent) character in the username, which introduces a "'" (single quote) character during variable substitution by… | EXPLOIT ×2 ✓HIGH 7.5EPSS 77.4% | 12 February 2009 |
| CVE-2009-0517 | Eval injection vulnerability in index.php in phpSlash 0.8.1.1 and earlier allows remote attackers to execute arbitrary PHP code via the fields parameter, which is supplied to an eval function call within the generic function in include/class/tz_env.class. | EXPLOIT ✓HIGH 10.0EPSS 48.9% | 11 February 2009 |
| CVE-2009-0305 | Multiple stack-based buffer overflows in the Research in Motion RIM AxLoader ActiveX control in AxLoader.ocx and AxLoader.dll in BlackBerry Application Web Loader 1.0 allow remote attackers to execute arbitrary code via unspecified use of the (1) load… | HIGH 9.3EPSS 19.3% | 10 February 2009 |
| CVE-2009-0099 | The Electronic Messaging System Microsoft Data Base (EMSMDB32) provider in Microsoft Exchange 2000 Server SP3 and Exchange Server 2003 SP2, as used in Exchange System Attendant, allows remote attackers to cause a denial of service (application outage)… | MEDIUM 5.0EPSS 26.2% | 10 February 2009 |
| CVE-2009-0098 | Microsoft Exchange 2000 Server SP3, Exchange Server 2003 SP2, and Exchange Server 2007 SP1 do not properly interpret Transport Neutral Encapsulation (TNEF) properties, which allows remote attackers to execute arbitrary code via a crafted TNEF message,… | HIGH 9.3EPSS 24.9% | 10 February 2009 |
| CVE-2009-0097 | Microsoft Office Visio 2002 SP2 and 2003 SP3 does not properly validate memory allocation for Visio files, which allows remote attackers to execute arbitrary code via a crafted file, aka "Memory Corruption Vulnerability." | HIGH 9.3EPSS 22.6% | 10 February 2009 |
| CVE-2009-0096 | Microsoft Office Visio 2002 SP2, 2003 SP3, and 2007 SP1 does not properly perform memory copy operations for object data, which allows remote attackers to execute arbitrary code via a crafted Visio document, aka "Memory Corruption Vulnerability." | HIGH 9.3EPSS 22.6% | 10 February 2009 |
| CVE-2009-0095 | Microsoft Office Visio 2002 SP2, 2003 SP3, and 2007 SP1 does not properly validate object data in Visio files, which allows remote attackers to execute arbitrary code via a crafted file, aka "Memory Validation Vulnerability." | HIGH 9.3EPSS 23.5% | 10 February 2009 |
| CVE-2009-0076 | Microsoft Internet Explorer 7, when XHTML strict mode is used, allows remote attackers to execute arbitrary code via the zoom style directive in conjunction with unspecified other directives in a malformed Cascading Style Sheets (CSS) stylesheet in a… | EXPLOIT ×4 ✓HIGH 9.3EPSS 33.5% | 10 February 2009 |
| CVE-2009-0075 | Microsoft Internet Explorer 7 does not properly handle errors during attempted access to deleted objects, which allows remote attackers to execute arbitrary code via a crafted HTML document, related to CFunctionPointer and the appending of document… | EXPLOIT ×6 ✓HIGH 9.3EPSS 85.3% | 10 February 2009 |
| CVE-2009-0450 | Stack-based buffer overflow in BlazeVideo HDTV Player 3.5 and earlier allows remote attackers to execute arbitrary code via a long string in a playlist (aka .plf) file. | EXPLOIT ×4 ✓HIGH 9.3EPSS 10.1% | 10 February 2009 |
| CVE-2009-0490 | Stack-based buffer overflow in the String_parse::get_nonspace_quoted function in lib-src/allegro/strparse.cpp in Audacity 1.2.6 and other versions before 1.3.6 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary… | EXPLOIT ×3 ✓HIGH 9.3EPSS 16.6% | 10 February 2009 |
| CVE-2009-0478 | Squid 2.7 to 2.7.STABLE5, 3.0 to 3.0.STABLE12, and 3.1 to 3.1.0.4 allows remote attackers to cause a denial of service via an HTTP request with an invalid version number, which triggers a reachable assertion in (1) HttpMsg.c and (2) HttpStatusLine.c. | EXPLOIT ✓MEDIUM 5.0EPSS 72.0% | 8 February 2009 |
| CVE-2009-0476 | Stack-based buffer overflow in MultiMedia Soft AdjMmsEng.dll 7.11.1.0 and 7.11.2.7, as distributed in multiple MultiMedia Soft audio components for .NET, allows remote attackers to execute arbitrary code via a long string in a playlist (.pls) file, as… | EXPLOIT ×7 ✓HIGH 9.3EPSS 37.0% | 8 February 2009 |
| CVE-2008-4559 | HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allows remote attackers to execute arbitrary code via shell metacharacters in argument fields to the (1) webappmon.exe or (2) OpenView5.exe CGI program. | HIGH 10.0EPSS 24.4% | 8 February 2009 |
| CVE-2009-0473 | Open redirect vulnerability in the web interface in the Rockwell Automation ControlLogix 1756-ENBT/A EtherNet/IP Bridge Module allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors. | MEDIUM 6.8EPSS 13.2% | 6 February 2009 |
| CVE-2008-6082 | Titan FTP Server 6.26 build 630 allows remote attackers to cause a denial of service (CPU consumption) via the SITE WHO command. | EXPLOIT ✓MEDIUM 5.0EPSS 44.6% | 6 February 2009 |
| CVE-2008-6080 | Directory traversal vulnerability in download.php in the ionFiles (com_ionfiles) 4.4.2 component for Joomla! allows remote attackers to read arbitrary files via a .. | EXPLOIT ✓MEDIUM 5.0EPSS 10.6% | 6 February 2009 |
| CVE-2008-6063 | Microsoft Word 2007, when the "Save as PDF" add-on is enabled, places an absolute pathname in the Subject field during an "Email as PDF" operation, which allows remote attackers to obtain sensitive information such as the sender's account name and a… | MEDIUM 4.3EPSS 10.3% | 5 February 2009 |
| CVE-2009-0419 | Microsoft XML Core Services, as used in Microsoft Expression Web, Office, Internet Explorer 6 and 7, and other products, does not properly restrict access from web pages to Set-Cookie2 HTTP response headers, which allows remote attackers to obtain… | MEDIUM 5.0EPSS 15.3% | 4 February 2009 |
| CVE-2009-0388 | Multiple integer signedness errors in (1) UltraVNC 1.0.2 and 1.0.5 and (2) TightVnc 1.3.9 allow remote VNC servers to cause a denial of service (heap corruption and application crash) or possibly execute arbitrary code via a large length value in a… | EXPLOIT ×2 ✓HIGH 10.0EPSS 13.3% | 4 February 2009 |
| CVE-2009-0184 | Multiple buffer overflows in the torrent parsing implementation in Free Download Manager (FDM) 2.5 Build 758 and 3.0 Build 844 allow remote attackers to execute arbitrary code via (1) a long file name within a torrent file, (2) a long tracker URL in a… | EXPLOIT ×2 ✓HIGH 9.3EPSS 27.8% | 3 February 2009 |
| CVE-2009-0183 | Stack-based buffer overflow in Remote Control Server in Free Download Manager (FDM) 2.5 Build 758 and 3.0 Build 844 allows remote attackers to execute arbitrary code via a long Authorization header in an HTTP request. | EXPLOIT ×2 ✓HIGH 10.0EPSS 66.5% | 3 February 2009 |
| CVE-2009-0369 | Microsoft Internet Explorer 7 allows remote attackers to trick a user into visiting an arbitrary URL via an onclick action that moves a crafted element to the current mouse position, related to a "Clickjacking" vulnerability. | EXPLOIT ✓MEDIUM 4.3EPSS 10.6% | 30 January 2009 |
| CVE-2009-0350 | Stack-based buffer overflow in Merak Media Player 3.2 allows remote attackers to execute arbitrary code via a long string in a .m3u playlist file, related to the status bar icon's tooltip. | EXPLOIT ×2 ✓HIGH 9.3EPSS 10.2% | 29 January 2009 |
| CVE-2009-0347 | Open redirect vulnerability in cs.html in the Autonomy (formerly Verity) Ultraseek search engine allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the url parameter. | EXPLOIT ✓MEDIUM 5.8EPSS 10.9% | 29 January 2009 |
| CVE-2009-0341 | The shell32 module in Microsoft Internet Explorer 7.0 on Windows XP SP3 might allow remote attackers to execute arbitrary code via a long VALUE attribute in an INPUT element, possibly related to a stack consumption vulnerability. | EXPLOIT ✓HIGH 9.3EPSS 16.0% | 29 January 2009 |
| CVE-2009-0323 | Multiple stack-based buffer overflows in W3C Amaya Web Browser 10.0 and 11.0 allow remote attackers to execute arbitrary code via (1) a long type parameter in an input tag, which is not properly handled by the EndOfXmlAttributeValue function; (2) an… | EXPLOIT ×2 ✓HIGH 10.0EPSS 62.5% | 28 January 2009 |
| CVE-2007-2795 | Multiple buffer overflows in Ipswitch IMail before 2006.21 allow remote attackers or authenticated users to execute arbitrary code via (1) the authentication feature in IMailsec.dll, which triggers heap corruption in the IMail Server, or (2) a long… | EXPLOIT ✓HIGH 9.0EPSS 24.5% | 27 January 2009 |
| CVE-2009-0263 | Multiple buffer overflows in Winamp 5.541 and earlier allow remote attackers to cause a denial of service and possibly execute arbitrary code via (1) a large Common Chunk (COMM) header value in an AIFF file and (2) a large invalid value in an MP3 file. | EXPLOIT ✓HIGH 10.0EPSS 16.7% | 23 January 2009 |
| CVE-2009-0261 | Stack-based buffer overflow in EffectMatrix Total Video Player 1.31 allows user-assisted attackers to execute arbitrary code via a Skins\DefaultSkin\DefaultSkin.ini file with a large ColumnHeaderSpan value. | EXPLOIT ✓HIGH 9.3EPSS 13.2% | 23 January 2009 |
| CVE-2009-0244 | Directory traversal vulnerability in the OBEX FTP Service in the Microsoft Bluetooth stack in Windows Mobile 6 Professional, and probably Windows Mobile 5.0 for Pocket PC and 5.0 for Pocket PC Phone Edition, allows remote authenticated users to list… | HIGH 8.8EPSS 30.3% | 21 January 2009 |
| CVE-2009-0026 | Multiple cross-site scripting (XSS) vulnerabilities in Apache Jackrabbit before 1.5.2 allow remote attackers to inject arbitrary web script or HTML via the q parameter to (1) search.jsp or (2) swr.jsp. | EXPLOIT ×2 ✓MEDIUM 4.3EPSS 26.8% | 21 January 2009 |
| CVE-2009-0182 | Buffer overflow in VUPlayer 2.49 and earlier allows user-assisted attackers to execute arbitrary code via a long URL in a File line in a .pls file, as demonstrated by an http URL on a File1 line. | EXPLOIT ×2 ✓HIGH 8.8EPSS 48.4% | 20 January 2009 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.