Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
395,841 CVEs1,716 in CISA KEV17,392 with EPSS ≥ 10%25,049 with a public exploitUpdated 21 September 2026
17,392 results · page 283 of 348
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2008-3471 | Stack-based buffer overflow in Microsoft Excel 2000 SP3, 2002 SP3, 2003 SP2 and SP3, and 2007 Gold and SP1; Office Excel Viewer 2003 SP3; Office Excel Viewer; Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats Gold and SP1;… | HIGH 9.3EPSS 52.3% | 15 October 2008 |
| CVE-2008-3466 | Microsoft Host Integration Server (HIS) 2000, 2004, and 2006 does not limit RPC access to administrative functions, which allows remote attackers to bypass authentication and execute arbitrary programs via a crafted SNA RPC message using opcode 1 or 6… | HIGH 10.0EPSS 77.7% | 15 October 2008 |
| CVE-2008-1446 | Integer overflow in the Internet Printing Protocol (IPP) ISAPI extension in Microsoft Internet Information Services (IIS) 5.0 through 7.0 on Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, and Server 2008 allows remote authenticated users to… | HIGH 9.0EPSS 46.3% | 15 October 2008 |
| CVE-2008-4557 | plugins/wacko/highlight/html.php in Strawberry in CuteNews.ru 1.1.1 (aka Strawberry) allows remote attackers to execute arbitrary PHP code via the text parameter, which is inserted into an executable regular expression. | EXPLOIT ✓HIGH 10.0EPSS 45.3% | 14 October 2008 |
| CVE-2008-4556 | Stack-based buffer overflow in the adm_build_path function in sadmind in Sun Solstice AdminSuite on Solaris 8 and 9 allows remote attackers to execute arbitrary code via a crafted request. | EXPLOIT ×3 ✓HIGH 10.0EPSS 69.9% | 14 October 2008 |
| CVE-2008-4480 | Heap-based buffer overflow in dhost.exe in Novell eDirectory 8.x before 8.8.3, and 8.7.3 before 8.7.3.10 ftf1, allows remote attackers to execute arbitrary code via a crafted Netware Core Protocol opcode 0x24 message that triggers a calculation error… | HIGH 10.0EPSS 10.6% | 14 October 2008 |
| CVE-2008-4479 | Heap-based buffer overflow in dhost.exe in Novell eDirectory 8.8 before 8.8.3, and 8.7.3 before 8.7.3.10 ftf1, allows remote attackers to execute arbitrary code via a SOAP request with a long Accept-Language header. | HIGH 10.0EPSS 10.3% | 14 October 2008 |
| CVE-2008-4008 | Unspecified vulnerability in the WebLogic Server Plugins for Apache component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0, 8.1 SP6, 7.0 SP7, and 6.1 SP7 allows remote attackers to affect confidentiality, integrity, and availability via… | EXPLOIT ✓HIGH 10.0EPSS 56.3% | 14 October 2008 |
| CVE-2008-3984 | Unspecified vulnerability in the Workspace Manager component in Oracle Database 9.2.0.8, 9.2.0.8DV, 10.1.0.5, 10.2.0.3, and 11.1.0.6 allows remote authenticated users to affect confidentiality and integrity, related to SYS.LT and WMSYS.LT, a different… | EXPLOIT ✓MEDIUM 5.5EPSS 41.8% | 14 October 2008 |
| CVE-2008-3983 | Unspecified vulnerability in the Workspace Manager component in Oracle Database 9.2.0.8, 9.2.0.8DV, 10.1.0.5, 10.2.0.3, and 11.1.0.6 allows remote authenticated users to affect confidentiality and integrity, related to SYS.LT and WMSYS.LT, a different… | EXPLOIT ✓MEDIUM 5.5EPSS 41.8% | 14 October 2008 |
| CVE-2008-3982 | Unspecified vulnerability in the Workspace Manager component in Oracle Database 9.2.0.8, 9.2.0.8DV, 10.1.0.5, 10.2.0.3, and 11.1.0.6 allows remote authenticated users to affect confidentiality and integrity, related to SYS.LT and WMSYS.LT, a different… | MEDIUM 5.5EPSS 11.4% | 14 October 2008 |
| CVE-2008-4397 | Directory traversal vulnerability in the RPC interface (asdbapi.dll) in CA ARCserve Backup (formerly BrightStor ARCserve Backup) r11.1 through r12.0 allows remote attackers to execute arbitrary commands via a .. | EXPLOIT ✓HIGH 10.0EPSS 80.5% | 14 October 2008 |
| CVE-2008-4385 | Husdawg, LLC Systems Requirements Lab 3, as used by Instant Expert Analysis, allows remote attackers to force the download and execution of arbitrary programs via by specifiying a malicious website argument to the Init method in (1) a certain ActiveX… | EXPLOIT ✓HIGH 9.3EPSS 37.7% | 14 October 2008 |
| CVE-2008-4547 | Heap-based buffer overflow in the PdvrAtl.PdvrOcx.1 ActiveX control (pdvratl.dll) in DVRHOST Web CMS OCX 1.0.1.25 allows remote attackers to execute arbitrary code via a long second argument to the TimeSpanFormat method. | EXPLOIT ✓HIGH 9.3EPSS 11.3% | 14 October 2008 |
| CVE-2008-4546 | Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64, and Adobe AIR before 2.0.2.12610, allows remote web servers to cause a denial of service (NULL pointer dereference and browser crash) by returning a different response when an HTTP request… | EXPLOIT ✓MEDIUM 4.3EPSS 16.8% | 14 October 2008 |
| CVE-2008-3544 | Multiple stack-based buffer overflows in ovalarmsrv in HP OpenView Network Node Manager (OV NNM) 7.51, and possibly 7.01, 7.50, and 7.53, allow remote attackers to execute arbitrary code via a long (1) REQUEST_SEV_CHANGE (aka number 47), (2)… | EXPLOIT ✓HIGH 9.0EPSS 18.0% | 13 October 2008 |
| CVE-2008-3641 | The Hewlett-Packard Graphics Language (HPGL) filter in CUPS before 1.3.9 allows remote attackers to execute arbitrary code via crafted pen width and pen color opcodes that overwrite arbitrary memory. | EXPLOIT ✓HIGH 10.0EPSS 24.1% | 10 October 2008 |
| CVE-2008-4501 | Directory traversal vulnerability in the FTP server in Serv-U 7.0.0.1 through 7.3, including 7.2.0.1, allows remote authenticated users to overwrite or create arbitrary files via a ..\ (dot dot backslash) in the RNTO command. | EXPLOIT ✓HIGH 9.0EPSS 10.7% | 9 October 2008 |
| CVE-2008-4500 | Serv-U 7.0.0.1 through 7.3, including 7.2.0.1, allows remote authenticated users to cause a denial of service (CPU consumption) via a crafted stou command, probably related to MS-DOS device names, as demonstrated using "con:1". | EXPLOIT ✓MEDIUM 4.0EPSS 10.3% | 9 October 2008 |
| CVE-2008-4493 | Microsoft PicturePusher ActiveX control (PipPPush.DLL 7.00.0709), as used in Microsoft Digital Image 2006 Starter Edition, allows remote attackers to force the upload of arbitrary files by using the AddString and Post methods and a modified PostURL to… | EXPLOIT ✓MEDIUM 6.8EPSS 17.6% | 8 October 2008 |
| CVE-2008-4384 | Multiple stack-based buffer overflows in MGI Software LPViewer ActiveX control (LPControl.dll), as acquired by Roxio and iseemedia, allow remote attackers to execute arbitrary code via the (1) url, (2) toolbar, and (3) enableZoomPastMax methods. | EXPLOIT ✓HIGH 9.3EPSS 28.7% | 7 October 2008 |
| CVE-2008-4453 | The GdPicture (1) Light Imaging Toolkit 4.7.1 GdPicture4S.Imaging ActiveX control (gdpicture4s.ocx) 4.7.0.1 and (2) Pro Imaging SDK 5.7.1 GdPicturePro5S.Imaging ActiveX control (gdpicturepro5s.ocx) 5.7.0.1 allows remote attackers to create, overwrite,… | EXPLOIT ✓HIGH 9.3EPSS 10.5% | 6 October 2008 |
| CVE-2008-4449 | Stack-based buffer overflow in mIRC 6.34 allows remote attackers to execute arbitrary code via a long hostname in a PRIVMSG message. | EXPLOIT ×3 ✓HIGH 9.3EPSS 38.7% | 6 October 2008 |
| CVE-2008-4434 | Stack-based buffer overflow in (1) uTorrent 1.7.7 build 8179 and earlier and (2) BitTorrent 6.0.3 build 8642 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long Created By field in a… | EXPLOIT ✓HIGH 9.3EPSS 11.0% | 3 October 2008 |
| CVE-2008-2439 | Directory traversal vulnerability in the UpdateAgent function in TmListen.exe in the OfficeScanNT Listener service in the client in Trend Micro OfficeScan 7.3 Patch 4 build 1367 and other builds before 1372, OfficeScan 8.0 SP1 before build 1222,… | MEDIUM 5.0EPSS 20.1% | 3 October 2008 |
| CVE-2008-4381 | Microsoft Internet Explorer 7 allows remote attackers to cause a denial of service (application crash) via Javascript that calls the alert function with a URL-encoded string of a large number of invalid characters. | MEDIUM 5.0EPSS 18.4% | 2 October 2008 |
| CVE-2008-4342 | NuMedia Soft NMS DVD Burning SDK Activex NMSDVDX.DVDEngineX.1 ActiveX control (NMSDVDX.dll) 1.013C and earlier, as used in CDBurnerXP 4.2.1.976, BurnAware 2.1.3, Blaze Media Pro 8.02 Special Edition, and possibly other products, allows remote attackers… | EXPLOIT ✓HIGH 9.3EPSS 17.2% | 30 September 2008 |
| CVE-2008-4327 | gdiplus.dll in GDI+ in Microsoft Windows XP SP3 does not properly handle crafted .ico files, which allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a certain crash.ico file on a web site, and allows… | EXPLOIT ✓MEDIUM 4.3EPSS 15.7% | 30 September 2008 |
| CVE-2008-4322 | Stack-based buffer overflow in RealFlex Technologies Ltd. | EXPLOIT ✓HIGH 10.0EPSS 65.1% | 29 September 2008 |
| CVE-2008-3827 | Multiple integer underflows in the Real demuxer (demux_real.c) in MPlayer 1.0_rc2 and earlier allow remote attackers to cause a denial of service (process termination) and possibly execute arbitrary code via a crafted video file that causes the… | HIGH 9.3EPSS 10.9% | 29 September 2008 |
| CVE-2008-4318 | Observer 0.3.2.1 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the query parameter to (1) whois.php or (2) netcmd.php. | EXPLOIT ✓HIGH 10.0EPSS 14.1% | 29 September 2008 |
| CVE-2008-4301 | A certain ActiveX control in iisext.dll in Microsoft Internet Information Services (IIS) allows remote attackers to set a password via a string argument to the SetPassword method. | HIGH 10.0EPSS 17.1% | 29 September 2008 |
| CVE-2008-4300 | A certain ActiveX control in adsiis.dll in Microsoft Internet Information Services (IIS) allows remote attackers to cause a denial of service (browser crash) via a long string in the second argument to the GetObject method. | MEDIUM 5.0EPSS 13.6% | 29 September 2008 |
| CVE-2008-4299 | A certain ActiveX control in the Microsoft Internet Authentication Service (IAS) Helper COM Component in iashlpr.dll allows remote attackers to cause a denial of service (browser crash) via a large integer value in the first argument to the PutProperty… | MEDIUM 5.0EPSS 15.9% | 29 September 2008 |
| CVE-2008-4295 | Microsoft Windows Mobile 6.0 on HTC Wiza 200 and HTC MDA 8125 devices does not properly handle the first attempt to establish a Bluetooth connection to a peer with a long name, which allows remote attackers to cause a denial of service (device reboot)… | EXPLOIT ✓MEDIUM 5.4EPSS 30.1% | 27 September 2008 |
| CVE-2008-0016 | Stack-based buffer overflow in the URL parsing implementation in Mozilla Firefox before 2.0.0.17 and SeaMonkey before 1.1.12 allows remote attackers to execute arbitrary code via a crafted UTF-8 URL in a link. | EXPLOIT ✓HIGH 10.0EPSS 43.9% | 24 September 2008 |
| CVE-2008-4193 | Stack-based buffer overflow in SecurityGateway.dll in Alt-N Technologies SecurityGateway 1.0.1 allows remote attackers to execute arbitrary code via a long username parameter. | EXPLOIT ×3 ✓HIGH 10.0EPSS 74.6% | 24 September 2008 |
| CVE-2008-4138 | PHP remote file inclusion vulnerability in skin_shop/standard/3_plugin_twindow/twindow_notice.php in TECHNOTE 7 allows remote attackers to execute arbitrary PHP code via a URL in the shop_this_skin_path parameter. | EXPLOIT ✓HIGH 10.0EPSS 10.3% | 24 September 2008 |
| CVE-2008-4128 | Cisco IOS Cross-Site Request Forgery Vulnerability | KEVEXPLOIT ✓MEDIUM 4.3EPSS 33.9% | 18 September 2008 |
| CVE-2008-4127 | Mshtml.dll in Microsoft Internet Explorer 7 Gold 7.0.5730 and 8 Beta 8.0.6001 on Windows XP SP2 allows remote attackers to cause a denial of service (failure of subsequent image rendering) via a crafted PNG file, related to an infinite loop in the… | MEDIUM 4.3EPSS 16.4% | 18 September 2008 |
| CVE-2008-4116 | Buffer overflow in Apple QuickTime 7.5.5 and iTunes 8.0 allows remote attackers to cause a denial of service (browser crash) or possibly execute arbitrary code via a long type attribute in a quicktime tag (1) on a web page or embedded in a (2) .mp4 or… | EXPLOIT ✓HIGH 9.3EPSS 11.6% | 18 September 2008 |
| CVE-2008-4109 | A certain Debian patch for OpenSSH before 4.3p2-9etch3 on etch; before 4.6p1-1 on sid and lenny; and on other distributions such as SUSE uses functions that are not async-signal-safe in the signal handler for login timeouts, which allows remote… | MEDIUM 5.0EPSS 28.4% | 18 September 2008 |
| CVE-2008-4096 | libraries/database_interface.lib.php in phpMyAdmin before 2.11.9.1 allows remote authenticated users to execute arbitrary code via a request to server_databases.php with a sort_by parameter containing PHP sequences, which are processed by create_function. | EXPLOIT ✓HIGH 8.5EPSS 11.2% | 18 September 2008 |
| CVE-2008-4114 | srv.sys in the Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 allows remote attackers to cause a denial of service (system crash) or possibly have unspecified other impact via… | EXPLOIT ✓HIGH 7.1EPSS 49.3% | 16 September 2008 |
| CVE-2008-4110 | Buffer overflow in the SQLVDIRLib.SQLVDirControl ActiveX control in Tools\Binn\sqlvdir.dll in Microsoft SQL Server 2000 (aka SQL Server 8.0) allows remote attackers to cause a denial of service (browser crash) or possibly execute arbitrary code via a… | HIGH 7.6EPSS 18.4% | 16 September 2008 |
| CVE-2008-4071 | A certain ActiveX control in Adobe Acrobat 9, when used with Microsoft Windows Vista and Internet Explorer 7, allows remote attackers to cause a denial of service (browser crash) via an src property value with an invalid acroie:// URL. | EXPLOIT ✓MEDIUM 5.0EPSS 18.4% | 15 September 2008 |
| CVE-2008-3529 | Heap-based buffer overflow in the xmlParseAttValueComplex function in parser.c in libxml2 before 2.7.0 allows context-dependent attackers to cause a denial of service (crash) or execute arbitrary code via a long XML entity name. | EXPLOIT ✓HIGH 10.0EPSS 23.4% | 12 September 2008 |
| CVE-2008-3957 | The Microsoft Windows Image Acquisition Logger ActiveX control allows remote attackers to force the download of arbitrary files onto a client system via a URL in the first argument to the Open method, in conjunction with a full destination pathname in… | EXPLOIT ×2 ✓HIGH 9.3EPSS 17.8% | 11 September 2008 |
| CVE-2008-3956 | orgchart.exe in Microsoft Organization Chart 2.00 allows user-assisted attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted .opx file. | EXPLOIT ✓HIGH 9.3EPSS 13.4% | 11 September 2008 |
| CVE-2008-3015 | Integer overflow in gdiplus.dll in GDI+ in Microsoft Office XP SP3, Office 2003 SP2 and SP3, 2007 Microsoft Office System Gold and SP1, Visio 2002 SP2, PowerPoint Viewer 2003, Works 8, Digital Image Suite 2006, SQL Server 2000 Reporting Services SP2,… | HIGH 9.3EPSS 39.3% | 11 September 2008 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.