Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
The year’s CVE activity with KEV, EPSS and exploit data as a PDF: heatmaps, a vendor treemap, and the lists worth checking against your estate.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
396,088 CVEs1,717 in CISA KEV17,157 with EPSS ≥ 10%25,049 with a public exploitUpdated 22 September 2026
17,157 results · page 332 of 344
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2002-0559 | Buffer overflows in PL/SQL module 3.0.9.8.2 in Oracle 9i Application Server 1.0.2.x allow remote attackers to cause a denial of service or execute arbitrary code via (1) a long help page request without a dadname, which overflows the resulting HTTP… | HIGH 7.5EPSS 13.1% | 3 July 2002 |
| CVE-2002-0540 | Nortel CVX 1800 is installed with a default "public" community string, which allows remote attackers to read usernames and passwords and modify the CVX configuration. | EXPLOIT ✓HIGH 7.5EPSS 19.9% | 3 July 2002 |
| CVE-2002-0392 | Apache 1.3 through 1.3.24, and Apache 2.0 through 2.0.36, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a chunk-encoded HTTP request that causes Apache to use an incorrect size. | EXPLOIT ×3 ✓HIGH 7.5EPSS 94.9% | 3 July 2002 |
| CVE-2002-0372 | Microsoft Windows Media Player versions 6.4 and 7.1 and Media Player for Windows XP allow remote attackers to bypass Internet Explorer's (IE) security mechanisms and run code via an executable .wma media file with a license installation requirement… | HIGH 7.5EPSS 14.4% | 3 July 2002 |
| CVE-2002-0371 | Buffer overflow in gopher client for Microsoft Internet Explorer 5.1 through 6.0, Proxy Server 2.0, or ISA Server 2000 allows remote attackers to execute arbitrary code via a gopher:// URL that redirects the user to a real or simulated gopher server… | EXPLOIT ✓HIGH 7.5EPSS 54.4% | 3 July 2002 |
| CVE-2002-0364 | Buffer overflow in the chunked encoding transfer mechanism in IIS 4.0 and 5.0 allows attackers to execute arbitrary code via the processing of HTR request sessions, aka "Heap Overrun in HTR Chunked Encoding Could Enable Web Server Compromise." | HIGH 7.5EPSS 31.0% | 3 July 2002 |
| CVE-2002-0187 | Cross-site scripting vulnerability in the SQLXML component of Microsoft SQL Server 2000 allows an attacker to execute arbitrary script via the root parameter as part of an XML SQL query, aka "Script Injection via XML Tag." | EXPLOIT ✓HIGH 7.5EPSS 13.9% | 3 July 2002 |
| CVE-2002-0186 | Buffer overflow in the SQLXML ISAPI extension of Microsoft SQL Server 2000 allows remote attackers to execute arbitrary code via data queries with a long content-type parameter, aka "Unchecked Buffer in SQLXML ISAPI Extension." | EXPLOIT ✓HIGH 7.5EPSS 55.5% | 3 July 2002 |
| CVE-2002-0379 | Buffer overflow in University of Washington imap server (uw-imapd) imap-2001 (imapd 2001.315) and imap-2001a (imapd 2001.315) with legacy RFC 1730 support, and imapd 2000.287 and earlier, allows remote authenticated users to execute arbitrary code via a… | EXPLOIT ×2 ✓HIGH 7.5EPSS 19.4% | 25 June 2002 |
| CVE-2002-0325 | Directory traversal vulnerability in BadBlue before 1.6.1 allows remote attackers to read arbitrary files via a ... | EXPLOIT ✓MEDIUM 5.0EPSS 37.8% | 25 June 2002 |
| CVE-2002-0613 | dnstools.php for DNSTools 2.0 beta 4 and earlier allows remote attackers to bypass authentication and gain privileges by setting the user_logged_in or user_dnstools_administrator parameters. | EXPLOIT ✓HIGH 10.0EPSS 11.3% | 18 June 2002 |
| CVE-2002-0606 | Buffer overflow in 3Cdaemon 2.0 FTP server allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via long commands such as login. | EXPLOIT ✓HIGH 7.5EPSS 10.6% | 18 June 2002 |
| CVE-2002-0599 | Blahz-DNS 0.2 and earlier allows remote attackers to bypass authentication and modify configuration by directly requesting CGI programs such as dostuff.php instead of going through the login screen. | EXPLOIT ✓HIGH 10.0EPSS 11.5% | 18 June 2002 |
| CVE-2002-0597 | LANMAN service on Microsoft Windows 2000 allows remote attackers to cause a denial of service (CPU/memory exhaustion) via a stream of malformed data to microsoft-ds port 445. | EXPLOIT ×2 ✓MEDIUM 5.0EPSS 46.6% | 18 June 2002 |
| CVE-2002-0595 | Buffer overflow in WTRS_UI.EXE (WTX_REMOTE.DLL) for WebTrends Reporting Center 4.0d allows remote attackers to execute arbitrary code via a long HTTP GET request to the /reports/ directory. | EXPLOIT ✓HIGH 7.5EPSS 10.7% | 18 June 2002 |
| CVE-2002-0591 | Directory traversal vulnerability in AOL Instant Messenger (AIM) 4.8 beta and earlier allows remote attackers to create arbitrary files and execute commands via a Direct Connection with an IMG tag with a SRC attribute that specifies the target filename. | EXPLOIT ✓MEDIUM 5.0EPSS 11.6% | 18 June 2002 |
| CVE-2002-0400 | ISC BIND 9 before 9.2.1 allows remote attackers to cause a denial of service (shutdown) via a malformed DNS packet that triggers an error condition that is not properly handled when the rdataset parameter to the dns_message_findtype() function in… | MEDIUM 5.0EPSS 14.2% | 18 June 2002 |
| CVE-2002-0368 | The Store Service in Microsoft Exchange 2000 allows remote attackers to cause a denial of service (CPU consumption) via a mail message with a malformed RFC message attribute, aka "Malformed Mail Attribute can Cause Exchange 2000 to Exhaust CPU Resources." | MEDIUM 5.0EPSS 15.2% | 18 June 2002 |
| CVE-2002-0289 | Buffer overflow in Phusion web server 1.0 allows remote attackers to cause a denial of service and execute arbitrary code via a long HTTP request. | EXPLOIT ×2 ✓MEDIUM 5.0EPSS 13.0% | 31 May 2002 |
| CVE-2002-0285 | Outlook Express 5.5 and 6.0 on Windows treats a carriage return ("CR") in a message header as if it were a valid carriage return/line feed combination (CR/LF), which could allow remote attackers to bypass virus protection and or other filtering… | HIGH 7.5EPSS 12.3% | 31 May 2002 |
| CVE-2002-0283 | Windows XP with port 445 open allows remote attackers to cause a denial of service (CPU consumption) via a flood of TCP SYN packets containing possibly malformed data. | MEDIUM 5.0EPSS 28.4% | 31 May 2002 |
| CVE-2002-0269 | Internet Explorer 5.x and 6 interprets an object as an HTML document even when its MIME Content-Type is text/plain, which could allow remote attackers to execute arbitrary script in documents that the user does not expect, possibly through web… | HIGH 7.5EPSS 11.5% | 29 May 2002 |
| CVE-2002-0263 | Buffer overflow in EasyBoard 2000 1.27 (aka EZboard) allows remote attackers to execute arbitrary code via a long boundary value in a multipart Content-Type header to (1) ezboard.cgi, (2) ezman.cgi, or (3) ezadmin.cgi. | EXPLOIT ✓HIGH 7.5EPSS 13.0% | 29 May 2002 |
| CVE-2002-0252 | Buffer overflow in Apple QuickTime Player 5.01 and 5.02 allows remote web servers to execute arbitrary code via a response containing a long Content-Type MIME header. | EXPLOIT ×2 ✓HIGH 7.5EPSS 10.5% | 29 May 2002 |
| CVE-2002-0242 | Cross-site scripting vulnerability in Internet Explorer 6 earlier allows remote attackers to execute arbitrary script via an Extended HTML Form, whose output from the remote server is not properly cleansed. | HIGH 7.5EPSS 11.4% | 29 May 2002 |
| CVE-2002-0193 | Microsoft Internet Explorer 5.01 and 6.0 allow remote attackers to execute arbitrary code via malformed Content-Disposition and Content-Type header fields that cause the application for the spoofed file type to pass the file back to the operating system… | EXPLOIT ✓HIGH 7.5EPSS 33.3% | 29 May 2002 |
| CVE-2002-0191 | Microsoft Internet Explorer 5.01, 5.5 and 6.0 allows remote attackers to view arbitrary files that contain the "{" character via script containing the cssText property of the stylesheet object, aka "Local Information Disclosure through HTML Object"… | EXPLOIT ✓MEDIUM 5.0EPSS 29.0% | 29 May 2002 |
| CVE-2002-0190 | Microsoft Internet Explorer 5.01, 5.5 and 6.0 allows remote attackers to execute arbitrary code under fewer security restrictions via a malformed web page that requires NetBIOS connectivity, aka "Zone Spoofing through Malformed Web Page" vulnerability. | HIGH 7.5EPSS 24.0% | 29 May 2002 |
| CVE-2002-0189 | Cross-site scripting vulnerability in Internet Explorer 6.0 allows remote attackers to execute scripts in the Local Computer zone via a URL that exploits a local HTML resource file, aka the "Cross-Site Scripting in Local HTML Resource" vulnerability. | EXPLOIT ✓HIGH 7.5EPSS 13.6% | 29 May 2002 |
| CVE-2002-0188 | Microsoft Internet Explorer 5.01 and 6.0 allow remote attackers to execute arbitrary code via malformed Content-Disposition and Content-Type header fields that cause the application for the spoofed file type to pass the file back to the operating system… | HIGH 7.5EPSS 16.3% | 29 May 2002 |
| CVE-2002-0155 | Buffer overflow in Microsoft MSN Chat ActiveX Control, as used in MSN Messenger 4.5 and 4.6, and Exchange Instant Messenger 4.5 and 4.6, allows remote attackers to execute arbitrary code via a long ResDLL parameter in the MSNChat OCX. | HIGH 7.5EPSS 24.1% | 29 May 2002 |
| CVE-2002-0033 | Heap-based buffer overflow in cfsd_calloc function of Solaris cachefsd allows remote attackers to execute arbitrary code via a request with a long directory and cache name. | EXPLOIT ✓HIGH 10.0EPSS 23.1% | 29 May 2002 |
| CVE-2002-1056 | Microsoft Outlook 2000 and 2002, when configured to use Microsoft Word as the email editor, does not block scripts that are used while editing email messages in HTML or Rich Text Format (RTF), which could allow remote attackers to execute arbitrary… | HIGH 7.5EPSS 18.5% | 16 May 2002 |
| CVE-2002-0228 | Microsoft MSN Messenger allows remote attackers to use Javascript that references an ActiveX object to obtain sensitive information such as display names and web site navigation, and possibly more when the user is connected to certain Microsoft sites… | MEDIUM 5.0EPSS 19.9% | 16 May 2002 |
| CVE-2002-0224 | The MSDTC (Microsoft Distributed Transaction Service Coordinator) for Microsoft Windows 2000, Microsoft IIS 5.0 and SQL Server 6.5 through SQL 2000 0.0 allows remote attackers to cause a denial of service (crash or hang) via malformed (random) input. | MEDIUM 5.0EPSS 26.7% | 16 May 2002 |
| CVE-2002-0201 | Cyberstop Web Server for Windows 0.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long HTTP GET request, possibly triggering a buffer overflow. | EXPLOIT ✓MEDIUM 5.0EPSS 21.1% | 16 May 2002 |
| CVE-2002-0154 | Buffer overflows in extended stored procedures for Microsoft SQL Server 7.0 and 2000 allow remote attackers to cause a denial of service or execute arbitrary code via a database query with certain long arguments. | HIGH 7.5EPSS 24.9% | 16 May 2002 |
| CVE-2002-1592 | The ap_log_rerror function in Apache 2.0 through 2.035, when a CGI application encounters an error, sends error messages to the client that include the full path for the server, which allows remote attackers to obtain sensitive information. | MEDIUM 5.0EPSS 12.5% | 6 May 2002 |
| CVE-2002-0153 | Internet Explorer 5.1 for Macintosh allows remote attackers to bypass security checks and invoke local AppleScripts within a specific HTML element, aka the "Local Applescript Invocation" vulnerability. | EXPLOIT ✓HIGH 7.5EPSS 17.7% | 22 April 2002 |
| CVE-2002-0152 | Buffer overflow in various Microsoft applications for Macintosh allows remote attackers to cause a denial of service (crash) or execute arbitrary code by invoking the file:// directive with a large number of / characters, which affects Internet Explorer… | HIGH 7.5EPSS 17.4% | 22 April 2002 |
| CVE-2002-0150 | Buffer overflow in Internet Information Server (IIS) 4.0, 5.0, and 5.1 allows remote attackers to spoof the safety check for HTTP headers and cause a denial of service or execute arbitrary code via HTTP header field values. | HIGH 7.5EPSS 49.5% | 22 April 2002 |
| CVE-2002-0149 | Buffer overflow in ASP Server-Side Include Function in IIS 4.0, 5.0 and 5.1 allows remote attackers to cause a denial of service and possibly execute arbitrary code via long file names. | HIGH 7.5EPSS 62.7% | 22 April 2002 |
| CVE-2002-0148 | Cross-site scripting vulnerability in Internet Information Server (IIS) 4.0, 5.0 and 5.1 allows remote attackers to execute arbitrary script as other users via an HTTP error page. | EXPLOIT ✓HIGH 7.5EPSS 64.5% | 22 April 2002 |
| CVE-2002-0147 | Buffer overflow in the ASP data transfer mechanism in Internet Information Server (IIS) 4.0, 5.0, and 5.1 allows remote attackers to cause a denial of service or execute code, aka "Microsoft-discovered variant of Chunked Encoding buffer overrun." | HIGH 7.5EPSS 61.8% | 22 April 2002 |
| CVE-2002-0079 | Buffer overflow in the chunked encoding transfer mechanism in Internet Information Server (IIS) 4.0 and 5.0 Active Server Pages allows attackers to cause a denial of service or execute arbitrary code. | EXPLOIT ×4 ✓HIGH 7.5EPSS 77.3% | 22 April 2002 |
| CVE-2002-0075 | Cross-site scripting vulnerability for Internet Information Server (IIS) 4.0, 5.0 and 5.1 allows remote attackers to execute arbitrary script as other web users via the error message used in a URL redirect (""302 Object Moved") message. | HIGH 7.5EPSS 33.8% | 22 April 2002 |
| CVE-2002-0074 | Cross-site scripting vulnerability in Help File search facility for Internet Information Server (IIS) 4.0, 5.0 and 5.1 allows remote attackers to embed scripts into another user's session. | HIGH 7.5EPSS 33.8% | 22 April 2002 |
| CVE-2002-0073 | The FTP service in Internet Information Server (IIS) 4.0, 5.0 and 5.1 allows attackers who have established an FTP session to cause a denial of service via a specially crafted status request containing glob characters. | MEDIUM 5.0EPSS 56.4% | 22 April 2002 |
| CVE-2002-0072 | The w3svc.dll ISAPI filter in Front Page Server Extensions and ASP.NET for Internet Information Server (IIS) 4.0, 5.0, and 5.1 does not properly handle the error condition when a long URL is provided, which allows remote attackers to cause a denial of… | MEDIUM 5.0EPSS 56.6% | 22 April 2002 |
| CVE-2002-0071 | Buffer overflow in the ism.dll ISAPI extension that implements HTR scripting in Internet Information Server (IIS) 4.0 and 5.0 allows attackers to cause a denial of service or execute arbitrary code via HTR requests with long variable names. | HIGH 7.5EPSS 33.6% | 22 April 2002 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.