Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
395,914 CVEs1,717 in CISA KEV17,392 with EPSS ≥ 10%25,049 with a public exploitUpdated 21 September 2026
17,392 results · page 287 of 348
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2008-2286 | SQL injection vulnerability in axengine.exe in Symantec Altiris Deployment Solution 6.8.x and 6.9.x before 6.9.176 allows remote attackers to execute arbitrary SQL commands via unspecified string fields in a notification packet. | EXPLOIT ✓HIGH 7.5EPSS 32.7% | 18 May 2008 |
| CVE-2008-2281 | Cross-zone scripting vulnerability in the Print Table of Links feature in Internet Explorer 6.0, 7.0, and 8.0b allows user-assisted remote attackers to inject arbitrary web script or HTML in the Local Machine Zone via an HTML document with a link… | EXPLOIT ✓HIGH 9.3EPSS 23.2% | 18 May 2008 |
| CVE-2008-1438 | Unspecified vulnerability in Microsoft Malware Protection Engine (mpengine.dll) 1.1.3520.0 and 0.1.13.192, as used in multiple Microsoft products, allows context-dependent attackers to cause a denial of service (disk space exhaustion) via a file with… | MEDIUM 5.0EPSS 12.9% | 13 May 2008 |
| CVE-2008-1437 | Unspecified vulnerability in Microsoft Malware Protection Engine (mpengine.dll) 1.1.3520.0 and 0.1.13.192, as used in multiple Microsoft products, allows context-dependent attackers to cause a denial of service (engine hang and restart) via a crafted… | MEDIUM 5.0EPSS 12.9% | 13 May 2008 |
| CVE-2008-1434 | Use-after-free vulnerability in Microsoft Word in Office 2000 and XP SP3, 2003 SP2 and SP3, and 2007 Office System SP1 and earlier allows remote attackers to execute arbitrary code via an HTML document with a large number of Cascading Style Sheets (CSS)… | HIGH 9.3EPSS 30.9% | 13 May 2008 |
| CVE-2008-1091 | Unspecified vulnerability in Microsoft Word in Office 2000 and XP SP3, 2003 SP2 and SP3, and 2007 Office System SP1 and earlier allows remote attackers to execute arbitrary code via a Rich Text Format (.rtf) file with a malformed string that triggers a… | HIGH 9.3EPSS 40.5% | 13 May 2008 |
| CVE-2008-0119 | Unspecified vulnerability in Microsoft Publisher in Office 2000 and XP SP3, 2003 SP2 and SP3, and 2007 SP1 and earlier allows remote attackers to execute arbitrary code via a Publisher file with crafted object header data that triggers memory… | HIGH 9.3EPSS 30.9% | 13 May 2008 |
| CVE-2008-2168 | Cross-site scripting (XSS) vulnerability in Apache 2.2.6 and earlier allows remote attackers to inject arbitrary web script or HTML via UTF-7 encoded URLs that are not properly handled when displaying the 403 Forbidden error page. | EXPLOIT ✓MEDIUM 4.3EPSS 54.9% | 13 May 2008 |
| CVE-2008-2167 | Cross-site scripting (XSS) vulnerability in ZyXEL ZyWALL 100 allows remote attackers to inject arbitrary web script or HTML via the Referer header, which is not properly handled in a 404 Error page. | EXPLOIT ✓MEDIUM 4.3EPSS 16.8% | 13 May 2008 |
| CVE-2008-0166 | OpenSSL 0.9.8c-1 up to versions before 0.9.8g-9 on Debian-based operating systems uses a random number generator that generates predictable numbers, which makes it easier for remote attackers to conduct brute force guessing attacks against cryptographic… | EXPLOIT ×3 ✓HIGH 7.5EPSS 70.7% | 13 May 2008 |
| CVE-2008-2161 | Buffer overflow in TFTP Server SP 1.4 and 1.5 on Windows, and possibly other versions, allows remote attackers to execute arbitrary code via a long TFTP error packet. | EXPLOIT ✓HIGH 10.0EPSS 65.3% | 12 May 2008 |
| CVE-2008-2160 | Multiple unspecified vulnerabilities in the JPEG (GDI+) and GIF image processing in Microsoft Windows CE 5.0 allow remote attackers to execute arbitrary code via crafted (1) JPEG and (2) GIF images. | HIGH 9.3EPSS 18.0% | 12 May 2008 |
| CVE-2008-2144 | Multiple unspecified vulnerabilities in Solaris print service for Sun Solaris 8, 9, and 10 allow remote attackers to cause a denial of service or execute arbitrary code via unknown vectors. | HIGH 10.0EPSS 16.4% | 12 May 2008 |
| CVE-2008-2138 | Oracle Application Server (OracleAS) Portal 10g allows remote attackers to bypass intended access restrictions and read the contents of /dav_portal/portal/ by sending a request containing a trailing "%0A" (encoded line feed), then using the session ID… | EXPLOIT ✓MEDIUM 5.0EPSS 15.5% | 12 May 2008 |
| CVE-2008-1802 | Buffer overflow in the process_redirect_pdu (rdp.c) function in rdesktop 1.5.0 allows remote attackers to execute arbitrary code via a Remote Desktop Protocol (RDP) redirect request with modified length fields. | EXPLOIT ✓HIGH 9.3EPSS 13.0% | 12 May 2008 |
| CVE-2008-1801 | Integer underflow in the iso_recv_msg function (iso.c) in rdesktop 1.5.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a Remote Desktop Protocol (RDP) request with a small length field. | EXPLOIT ✓HIGH 9.3EPSS 13.1% | 12 May 2008 |
| CVE-2008-2005 | The SuiteLink Service (aka slssvc.exe) in WonderWare SuiteLink before 2.0 Patch 01, as used in WonderWare InTouch 8.0, allows remote attackers to cause a denial of service (NULL pointer dereference and service shutdown) and possibly execute arbitrary… | EXPLOIT ✓MEDIUM 5.0EPSS 16.3% | 6 May 2008 |
| CVE-2008-0599 | The init_request_info function in sapi/cgi/cgi_main.c in PHP before 5.2.6 does not properly consider operator precedence when calculating the length of PATH_TRANSLATED, which might allow remote attackers to execute arbitrary code via a crafted URI. | CRITICAL 9.8EPSS 10.9% | 5 May 2008 |
| CVE-2008-2069 | Buffer overflow in Novell GroupWise 7 allows remote attackers to cause a denial of service or execute arbitrary code via a long argument in a mailto: URI. | EXPLOIT ✓HIGH 9.3EPSS 33.4% | 2 May 2008 |
| CVE-2008-2044 | includes/library.php in netOffice Dwins 1.3 p2 compares the demoSession variable to the 'true' string literal instead of the true boolean literal, which allows remote attackers to bypass authentication and execute arbitrary code by setting this variable… | EXPLOIT ✓HIGH 7.5EPSS 11.4% | 1 May 2008 |
| CVE-2007-6339 | The Akamai Download Manager (aka DLM or dlmanager) ActiveX control (DownloadManagerV2.ocx) before 2.2.3.5 allows remote attackers to force the download and execution of arbitrary code via unspecified "undocumented object parameters." | MEDIUM 6.8EPSS 11.0% | 1 May 2008 |
| CVE-2008-2040 | Stack-based buffer overflow in the HTTP::getAuthUserPass function (core/common/http.cpp) in Peercast 0.1218 and gnome-peercast allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a Basic Authentication… | EXPLOIT ✓HIGH 7.5EPSS 14.9% | 30 April 2008 |
| CVE-2008-2031 | VicFTPS 5.0 allows remote attackers to cause a denial of service (crash) via a crafted LIST command, which triggers a NULL pointer dereference. | EXPLOIT ✓MEDIUM 5.0EPSS 46.3% | 30 April 2008 |
| CVE-2008-1996 | licq before 1.3.6 allows remote attackers to cause a denial of service (file-descriptor exhaustion and application crash) via a large number of connections. | EXPLOIT ✓MEDIUM 5.0EPSS 11.2% | 28 April 2008 |
| CVE-2008-1965 | Argument injection vulnerability in the cai: URI handler in rcplauncher in IBM Lotus Expeditor Client for Desktop 6.1.1 and 6.1.2, as used by Lotus Symphony and possibly other products, allows remote attackers to execute arbitrary code by injecting a… | EXPLOIT ✓HIGH 9.3EPSS 10.7% | 25 April 2008 |
| CVE-2008-1963 | PHP remote file inclusion vulnerability in includes/functions.php in Quate Grape Web Statistics 0.2a allows remote attackers to execute arbitrary PHP code via a URL in the location parameter. | EXPLOIT ✓HIGH 7.5EPSS 39.0% | 25 April 2008 |
| CVE-2008-1933 | Absolute path traversal vulnerability in a certain ActiveX control in Zune allows user-assisted remote attackers to overwrite arbitrary files via the SaveToFile method. | EXPLOIT ✓MEDIUM 4.3EPSS 13.9% | 25 April 2008 |
| CVE-2008-1765 | Buffer overflow in Adobe Photoshop Album Starter Edition 3.2, and possibly After Effects CS3, allows user-assisted remote attackers and physically proximate attackers to execute arbitrary code via a BMP file with an invalid image header. | EXPLOIT ✓HIGH 9.3EPSS 20.0% | 23 April 2008 |
| CVE-2007-6255 | Buffer overflow in the Microsoft HeartbeatCtl ActiveX control in HRTBEAT.OCX allows remote attackers to execute arbitrary code via the Host argument to an unspecified method. | HIGH 9.3EPSS 30.1% | 23 April 2008 |
| CVE-2008-1914 | Stack-based buffer overflow in the AntServer module (AntServer.exe) in BigAnt IM Server in BigAnt Messenger 2.2 allows remote attackers to execute arbitrary code via a long URI in a request to TCP port 6080. | EXPLOIT ×5 ✓HIGH 10.0EPSS 73.7% | 22 April 2008 |
| CVE-2008-1912 | Stack-based buffer overflow in DivX Player 6.7 build 6.7.0.22 and earlier allows user-assisted remote attackers to cause a denial of service (application crash) or execute arbitrary code via a long subtitle in a .SRT file. | EXPLOIT ×2 ✓HIGH 9.3EPSS 11.7% | 22 April 2008 |
| CVE-2008-1903 | PHP remote file inclusion vulnerability in news_show.php in Newanz NewsOffice 1.0 and 1.1, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the newsoffice_directory parameter. | EXPLOIT ✓HIGH 7.5EPSS 39.2% | 22 April 2008 |
| CVE-2008-1898 | A certain ActiveX control in WkImgSrv.dll 7.03.0616.0, as distributed in Microsoft Works 7 and Microsoft Office 2003 and 2007, allows remote attackers to execute arbitrary code or cause a denial of service (browser crash) via an invalid… | EXPLOIT ×3 ✓HIGH 9.3EPSS 52.0% | 21 April 2008 |
| CVE-2008-1436 | Microsoft Windows XP Professional SP2, Vista, and Server 2003 and 2008 does not properly assign activities to the (1) NetworkService and (2) LocalService accounts, which might allow context-dependent attackers to gain privileges by using one service… | EXPLOIT ✓HIGH 9.0EPSS 36.8% | 21 April 2008 |
| CVE-2008-1881 | Stack-based buffer overflow in the ParseSSA function (modules/demux/subtitle.c) in VLC 0.8.6e allows remote attackers to execute arbitrary code via a long subtitle in an SSA file. | EXPLOIT ×2 ✓MEDIUM 6.8EPSS 11.8% | 17 April 2008 |
| CVE-2008-1878 | Stack-based buffer overflow in the demux_nsf_send_chunk function in src/demuxers/demux_nsf.c in xine-lib 1.1.12 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long NSF title. | EXPLOIT ✓HIGH 7.5EPSS 15.0% | 17 April 2008 |
| CVE-2008-1876 | PHP remote file inclusion vulnerability in index.php in VisualPic 0.3.1 allows remote attackers to execute arbitrary PHP code via a URL in the _CONFIG[files][functions_page] parameter. | EXPLOIT ✓MEDIUM 6.8EPSS 25.3% | 17 April 2008 |
| CVE-2008-0320 | Heap-based buffer overflow in the OLE importer in OpenOffice.org before 2.4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an OLE file with a crafted DocumentSummaryInformation stream. | EXPLOIT ✓HIGH 9.3EPSS 56.9% | 17 April 2008 |
| CVE-2008-0892 | The replication monitor CGI script (repl-monitor-cgi.pl) in Red Hat Administration Server, as used by Red Hat Directory Server 8.0 EL4 and EL5, allows remote attackers to execute arbitrary commands. | HIGH 9.0EPSS 14.0% | 16 April 2008 |
| CVE-2008-1842 | Integer signedness error in ovspmd.exe in HP OpenView Network Node Manager (OV NNM) 8.01, and 7.53 and earlier, allows remote attackers to cause a denial of service (daemon crash) or execute arbitrary code via a long request to TCP port 8886 that begins… | EXPLOIT ✓HIGH 10.0EPSS 12.2% | 16 April 2008 |
| CVE-2008-1776 | PHP remote file inclusion vulnerability in modules/basicfog/basicfogfactory.class.php in PhpBlock A8.4 allows remote attackers to execute arbitrary PHP code via a URL in the PATH_TO_CODE parameter. | EXPLOIT ✓MEDIUM 6.8EPSS 24.4% | 14 April 2008 |
| CVE-2008-1773 | PHP remote file inclusion vulnerability in includes/header.inc.php in Dragoon 0.1 allows remote attackers to execute arbitrary PHP code via a URL in the root parameter. | EXPLOIT ✓MEDIUM 6.8EPSS 24.4% | 14 April 2008 |
| CVE-2008-1100 | Buffer overflow in the cli_scanpe function in libclamav (libclamav/pe.c) for ClamAV 0.92 and 0.92.1 allows remote attackers to execute arbitrary code via a crafted Upack PE file. | HIGH 10.0EPSS 10.9% | 14 April 2008 |
| CVE-2008-0927 | dhost.exe in Novell eDirectory 8.7.3 before sp10 and 8.8.2 allows remote attackers to cause a denial of service (CPU consumption) via an HTTP request with (1) multiple Connection headers or (2) a Connection header with multiple comma-separated values. | EXPLOIT ✓MEDIUM 5.0EPSS 70.0% | 14 April 2008 |
| CVE-2008-1724 | Stack-based buffer overflow in the IActiveXTransfer.FileTransfer method in the SecureTransport FileTransfer ActiveX control in vcst_en.dll 1.0.0.5 in Tumbleweed SecureTransport Server before 4.6.1 Hotfix 20 allows remote attackers to execute arbitrary… | EXPLOIT ×2 ✓HIGH 9.3EPSS 35.1% | 11 April 2008 |
| CVE-2008-1721 | Integer signedness error in the zlib extension module in Python 2.5.2 and earlier allows remote attackers to execute arbitrary code via a negative signed integer, which triggers insufficient memory allocation and a buffer overflow. | EXPLOIT ✓HIGH 7.5EPSS 22.6% | 10 April 2008 |
| CVE-2007-6019 | Adobe Flash Player 9.0.115.0 and earlier, and 8.0.39.0 and earlier, allows remote attackers to execute arbitrary code via an SWF file with a modified DeclareFunction2 Actionscript tag, which prevents an object from being instantiated properly. | EXPLOIT ✓HIGH 9.3EPSS 59.8% | 9 April 2008 |
| CVE-2007-0071 | Integer overflow in Adobe Flash Player 9.0.115.0 and earlier, and 8.0.39.0 and earlier, allows remote attackers to execute arbitrary code via a crafted SWF file with a negative Scene Count value, which passes a signed comparison, is used as an offset of… | HIGH 9.3EPSS 92.5% | 9 April 2008 |
| CVE-2008-1709 | Buffer overflow in Microsoft Visual InterDev 6.0 (SP6) allows user-assisted attackers to execute arbitrary code via a Studio Solution (.SLN) file with a long malformed Project line beginning with a 'Project("{}") =' sequence, probably a different vector… | EXPLOIT ×2 ✓HIGH 9.3EPSS 13.0% | 9 April 2008 |
| CVE-2008-1090 | Unspecified vulnerability in Microsoft Visio 2002 SP2, 2003 SP2 and SP3, and 2007 up to SP1 allows user-assisted remote attackers to execute arbitrary code via a crafted .DXF file, aka "Visio Memory Validation Vulnerability." | HIGH 9.3EPSS 32.1% | 8 April 2008 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.