Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
395,841 CVEs1,716 in CISA KEV17,392 with EPSS ≥ 10%25,049 with a public exploitUpdated 21 September 2026
17,392 results · page 282 of 348
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2008-4824 | Multiple unspecified vulnerabilities in Adobe Flash Player 10.x before 10.0.12.36 and 9.x before 9.0.151.0 allow remote attackers to execute arbitrary code via unknown vectors related to "input validation errors." | HIGH 9.3EPSS 13.3% | 17 November 2008 |
| CVE-2008-5106 | Buffer overflow in KarjaSoft Sami FTP Server 2.0.x allows remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code via a long argument to an arbitrary command, which triggers the overflow when the SamyFtp.binlog… | HIGH 10.0EPSS 12.5% | 17 November 2008 |
| CVE-2008-5053 | PHP remote file inclusion vulnerability in admin.rssreader.php in the Simple RSS Reader (com_rssreader) 1.0 component for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_live_site parameter. | EXPLOIT ✓HIGH 10.0EPSS 64.1% | 13 November 2008 |
| CVE-2008-4037 | Microsoft Windows 2000 Gold through SP4, XP Gold through SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 allows remote SMB servers to execute arbitrary code on a client machine by replaying the NTLM credentials of a client user, as… | EXPLOIT ×3 ✓HIGH 9.3EPSS 59.1% | 12 November 2008 |
| CVE-2008-4033 | Cross-domain vulnerability in Microsoft XML Core Services 3.0 through 6.0, as used in Microsoft Expression Web, Office, Internet Explorer, and other products, allows remote attackers to obtain sensitive information from another domain and corrupt the… | EXPLOIT ✓MEDIUM 4.3EPSS 27.7% | 12 November 2008 |
| CVE-2008-4029 | Cross-domain vulnerability in Microsoft XML Core Services 3.0 and 4.0, as used in Internet Explorer, allows remote attackers to obtain sensitive information from another domain via a crafted XML document, related to improper error checks for external… | EXPLOIT ✓MEDIUM 4.3EPSS 26.7% | 12 November 2008 |
| CVE-2008-5036 | Stack-based buffer overflow in VideoLAN VLC media player 0.9.x before 0.9.6 might allow user-assisted attackers to execute arbitrary code via an an invalid RealText (rt) subtitle file, related to the ParseRealText function in modules/demux/subtitle.c. | EXPLOIT ×2 ✓HIGH 9.3EPSS 41.4% | 10 November 2008 |
| CVE-2008-5032 | Stack-based buffer overflow in VideoLAN VLC media player 0.5.0 through 0.9.5 might allow user-assisted attackers to execute arbitrary code via the header of an invalid CUE image file, related to modules/access/vcd/cdrom.c. | EXPLOIT ✓HIGH 9.3EPSS 10.7% | 10 November 2008 |
| CVE-2008-4387 | Unspecified vulnerability in the Simba MDrmSap ActiveX control in mdrmsap.dll in SAP SAPgui allows remote attackers to execute arbitrary code via unknown vectors involving instantiation by Internet Explorer. | HIGH 9.3EPSS 15.5% | 10 November 2008 |
| CVE-2008-5002 | Insecure method vulnerability in the ChilkatCrypt2.ChilkatCrypt2.1 ActiveX control (ChilkatCrypt2.dll 4.3.2.1) in Chilkat Crypt ActiveX Component allows remote attackers to create and overwrite arbitrary files via the WriteFile method. | EXPLOIT ×2 ✓HIGH 9.3EPSS 40.7% | 10 November 2008 |
| CVE-2008-4814 | Unspecified vulnerability in a JavaScript method in Adobe Reader and Acrobat 8.1.2 and earlier, and before 7.1.1, allows remote attackers to execute arbitrary code via unknown vectors, related to an "input validation issue." | HIGH 9.3EPSS 11.9% | 5 November 2008 |
| CVE-2008-4922 | Buffer overflow in the DjVu ActiveX Control 3.0 for Microsoft Office (DjVu_ActiveX_MSOffice.dll) allows remote attackers to execute arbitrary code via a long (1) ImageURL property, and possibly the (2) Mode, (3) Page, or (4) Zoom properties. | EXPLOIT ×2 ✓HIGH 9.3EPSS 32.7% | 4 November 2008 |
| CVE-2008-2992 | Adobe Reader and Acrobat Input Validation Vulnerability | KEVEXPLOIT ×4 ✓HIGH 7.8EPSS 98.5% | 4 November 2008 |
| CVE-2008-4910 | The BasicService in Sun Java Web Start allows remote attackers to execute arbitrary programs on a client machine via a file:// URL argument to the showDocument method. | EXPLOIT ✓HIGH 10.0EPSS 10.3% | 4 November 2008 |
| CVE-2008-4864 | Multiple integer overflows in imageop.c in the imageop module in Python 1.5.2 through 2.5.1 allow context-dependent attackers to break out of the Python VM and execute arbitrary code via large integer values in certain arguments to the crop function,… | EXPLOIT ×2 ✓HIGH 7.5EPSS 21.0% | 1 November 2008 |
| CVE-2008-4801 | Heap-based buffer overflow in the Data Protection for SQL CAD service (aka dsmcat.exe) in the Client Acceptor Daemon (CAD) and the scheduler in the Backup-Archive client 5.1.0.0 through 5.1.8.1, 5.2.0.0 through 5.2.5.2, 5.3.0.0 through 5.3.6.1, 5.4.0.0… | HIGH 10.0EPSS 11.4% | 31 October 2008 |
| CVE-2008-4800 | The DebugDiag ActiveX control in CrashHangExt.dll, possibly 1.0, in Microsoft Debug Diagnostic Tool allows remote attackers to cause a denial of service (NULL pointer dereference and Internet Explorer 6.0 crash) via a large negative integer argument to… | EXPLOIT ✓MEDIUM 5.0EPSS 25.8% | 31 October 2008 |
| CVE-2008-4787 | Visual truncation vulnerability in Microsoft Internet Explorer 6 allows remote attackers to spoof the address bar via a URL with a hostname containing many (Non-Blocking Space character) sequences, which are rendered as whitespace, aka MSRC… | EXPLOIT ✓MEDIUM 5.8EPSS 13.6% | 29 October 2008 |
| CVE-2008-4779 | Stack-based buffer overflow in TUGzip 3.5.0.0 allows remote attackers to denial of service (crash) or execute arbitrary code via a long filename in a .zip file. | EXPLOIT ×3 ✓HIGH 10.0EPSS 64.7% | 29 October 2008 |
| CVE-2008-4764 | Directory traversal vulnerability in the eXtplorer module (com_extplorer) 2.0.0 RC2 and earlier in Joomla! allows remote attackers to read arbitrary files via a .. | EXPLOIT ✓MEDIUM 5.0EPSS 16.5% | 28 October 2008 |
| CVE-2008-4762 | Stack-based buffer overflow in freeSSHd 1.2.1 allows remote authenticated users to cause a denial of service (service crash) and potentially execute arbitrary code via a long argument to the (1) rename and (2) realpath parameters. | EXPLOIT ×2 ✓HIGH 9.0EPSS 14.5% | 28 October 2008 |
| CVE-2008-4728 | Multiple insecure method vulnerabilities in the DeployRun.DeploymentSetup.1 (DeployRun.dll) ActiveX control 10.0.0.44 in Hummingbird Deployment Wizard 2008 allow remote attackers to execute arbitrary programs via the (1) Run and (2) PerformUpdateAsync… | EXPLOIT ×3 ✓HIGH 9.3EPSS 31.6% | 24 October 2008 |
| CVE-2008-4726 | Stack-based buffer overflow in the SFTP subsystem in GoodTech SSH 6.4 allows remote authenticated users to execute arbitrary code via a long string to the (1) open (aka SSH_FXP_OPEN), (2) unlink, (3) opendir, and other unspecified parameters. | EXPLOIT ✓HIGH 9.0EPSS 44.3% | 24 October 2008 |
| CVE-2008-4696 | Cross-site scripting (XSS) vulnerability in Opera.dll in Opera before 9.61 allows remote attackers to inject arbitrary web script or HTML via the anchor identifier (aka the "optional fragment"), which is not properly escaped before storage in the… | EXPLOIT ×3 ✓MEDIUM 4.3EPSS 45.7% | 23 October 2008 |
| CVE-2008-4250 | Microsoft Windows Buffer Overflow Vulnerability | KEVEXPLOIT ×6 ✓CRITICAL 9.8EPSS 98.8% | 23 October 2008 |
| CVE-2008-3862 | Stack-based buffer overflow in CGI programs in the server in Trend Micro OfficeScan 7.3 Patch 4 build 1367 and other builds before 1374, and 8.0 SP1 Patch 1 before build 3110, allows remote attackers to execute arbitrary code via an HTTP POST request… | HIGH 10.0EPSS 18.4% | 23 October 2008 |
| CVE-2008-2469 | Heap-based buffer overflow in the SPF_dns_resolv_lookup function in Spf_dns_resolv.c in libspf2 before 1.2.8 allows remote attackers to execute arbitrary code via a long DNS TXT record with a modified length field. | EXPLOIT ✓HIGH 10.0EPSS 22.3% | 23 October 2008 |
| CVE-2008-4699 | Insecure method vulnerability in the ActiveX control (PAWWeb11.ocx) in Peachtree Accounting 2004 allows remote attackers to execute arbitrary programs via the ExecutePreferredApplication method. | EXPLOIT ✓HIGH 9.3EPSS 27.2% | 22 October 2008 |
| CVE-2008-4688 | core/string_api.php in Mantis before 1.1.3 does not check the privileges of the viewer before composing a link with issue data in the source anchor, which allows remote attackers to discover an issue's title and status via a request with a modified… | MEDIUM 5.0EPSS 11.7% | 22 October 2008 |
| CVE-2008-4687 | manage_proj_page.php in Mantis before 1.1.4 allows remote authenticated users to execute arbitrary code via a sort parameter containing PHP sequences, which are processed by create_function within the multi_sort function in core/utility_api.php. | EXPLOIT ×2 ✓HIGH 9.0EPSS 67.5% | 22 October 2008 |
| CVE-2008-4668 | Directory traversal vulnerability in the Image Browser (com_imagebrowser) 0.1.5 component for Joomla! allows remote attackers to include and execute arbitrary local files via a .. | EXPLOIT ✓HIGH 9.0EPSS 21.5% | 22 October 2008 |
| CVE-2008-4654 | Stack-based buffer overflow in the parse_master function in the Ty demux plugin (modules/demux/ty.c) in VLC Media Player 0.9.0 through 0.9.4 allows remote attackers to execute arbitrary code via a TiVo TY media file with a header containing a crafted… | EXPLOIT ×3 ✓HIGH 9.3EPSS 57.5% | 22 October 2008 |
| CVE-2008-4652 | Buffer overflow in the ActiveX control (DartFtp.dll) in Dart Communications PowerTCP FTP for ActiveX 2.0.2 0 allows remote attackers to execute arbitrary code via a long SecretKey property. | EXPLOIT ×2 ✓HIGH 9.3EPSS 10.1% | 22 October 2008 |
| CVE-2008-1547 | Open redirect vulnerability in exchweb/bin/redir.asp in Microsoft Outlook Web Access (OWA) for Exchange Server 2003 SP2 (aka build 6.5.7638) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the… | EXPLOIT ✓MEDIUM 4.3EPSS 48.1% | 21 October 2008 |
| CVE-2008-4619 | The RPC subsystem in Sun Solaris 9 allows remote attackers to cause a denial of service (daemon crash) via a crafted request to procedure 8 in program 100000 (rpcbind), related to the XDR_DECODE operation and the taddr2uaddr function. | EXPLOIT ✓HIGH 10.0EPSS 12.0% | 21 October 2008 |
| CVE-2008-4609 | The TCP implementation in (1) Linux, (2) platforms based on BSD Unix, (3) Microsoft Windows, (4) Cisco products, and probably other operating systems allows remote attackers to cause a denial of service (connection queue exhaustion) via multiple vectors… | HIGH 7.1EPSS 32.1% | 20 October 2008 |
| CVE-2008-4587 | Insecure method vulnerability in the MSVNClientDownloadManager61Lib.DownloadManager.1 ActiveX control (ISDM.exe 6.1.100.61372) in Macrovision FLEXnet Connect 6.1 allows remote attackers to force the download and execution of arbitrary files via the… | EXPLOIT ✓HIGH 9.3EPSS 10.5% | 15 October 2008 |
| CVE-2008-4582 | Mozilla Firefox 3.0.1 through 3.0.3, Firefox 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13, when running on Windows, do not properly identify the context of Windows .url shortcut files, which allows user-assisted remote attackers to bypass the… | EXPLOIT ✓MEDIUM 4.3EPSS 10.2% | 15 October 2008 |
| CVE-2008-4572 | GuildFTPd 0.999.14, and possibly other versions, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via long arguments to the CWD and LIST commands, which triggers heap corruption related to an improper free… | EXPLOIT ✓HIGH 10.0EPSS 60.7% | 15 October 2008 |
| CVE-2008-4038 | Buffer underflow in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 allows remote attackers to execute arbitrary code via a Server Message Block (SMB) request that contains a filename with a… | HIGH 10.0EPSS 39.2% | 15 October 2008 |
| CVE-2008-4023 | Active Directory in Microsoft Windows 2000 SP4 does not properly allocate memory for (1) LDAP and (2) LDAPS requests, which allows remote attackers to execute arbitrary code via a crafted request, aka "Active Directory Overflow Vulnerability." | HIGH 10.0EPSS 39.2% | 15 October 2008 |
| CVE-2008-4020 | Cross-site scripting (XSS) vulnerability in Microsoft Office XP SP3 allows remote attackers to inject arbitrary web script or HTML via a document that contains a "Content-Disposition: attachment" header and is accessed through a cdo: URL, which renders… | MEDIUM 4.3EPSS 24.4% | 15 October 2008 |
| CVE-2008-4019 | Integer overflow in the REPT function in Microsoft Excel 2000 SP3, 2002 SP3, 2003 SP2 and SP3, and 2007 Gold and SP1; Office Excel Viewer 2003 SP3; Office Excel Viewer; Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats Gold and… | HIGH 9.3EPSS 34.4% | 15 October 2008 |
| CVE-2008-3479 | Heap-based buffer overflow in the Microsoft Message Queuing (MSMQ) service (mqsvc.exe) in Microsoft Windows 2000 SP4 allows remote attackers to read memory contents and execute arbitrary code via a crafted RPC call, related to improper processing of… | HIGH 10.0EPSS 44.5% | 15 October 2008 |
| CVE-2008-3477 | Microsoft Excel 2000 SP3, 2002 SP3, and 2003 SP2 and SP3 does not properly validate data in the VBA Performance Cache when processing an Office document with an embedded object, which allows remote attackers to execute arbitrary code via an Excel file… | HIGH 9.3EPSS 35.7% | 15 October 2008 |
| CVE-2008-3476 | Microsoft Internet Explorer 5.01 SP4 and 6 does not properly handle errors associated with access to uninitialized memory, which allows remote attackers to execute arbitrary code via a crafted HTML document, aka "HTML Objects Memory Corruption… | HIGH 9.3EPSS 31.1% | 15 October 2008 |
| CVE-2008-3475 | Microsoft Internet Explorer 6 does not properly handle errors related to using the componentFromPoint method on xml objects that have been (1) incorrectly initialized or (2) deleted, which allows remote attackers to execute arbitrary code via a crafted… | HIGH 8.8EPSS 39.9% | 15 October 2008 |
| CVE-2008-3474 | Microsoft Internet Explorer 6 and 7 does not properly determine the domain or security zone of origin of web script, which allows remote attackers to bypass the intended cross-domain security policy and obtain sensitive information via a crafted HTML… | MEDIUM 6.5EPSS 28.0% | 15 October 2008 |
| CVE-2008-3473 | Microsoft Internet Explorer 6 and 7 does not properly determine the domain or security zone of origin of web script, which allows remote attackers to bypass the intended cross-domain security policy, and execute arbitrary code or obtain sensitive… | HIGH 9.3EPSS 31.7% | 15 October 2008 |
| CVE-2008-3472 | Microsoft Internet Explorer 6 and 7 does not properly determine the domain or security zone of origin of web script, which allows remote attackers to bypass the intended cross-domain security policy, and execute arbitrary code or obtain sensitive… | HIGH 9.3EPSS 32.6% | 15 October 2008 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.