CVE tracker — Exploitation, versions & score history

Scroll across the table to compare exploitation and severity.

Matching CVEs and exploitation evidence. CVSS measures reported severity. Unknown scores are not zero.
CVE / vulnerability	Exploitation	CVSS
CVE-2016-3298 Microsoft Internet Explorer Messaging API Information Disclosure Vulnerability n/a n/a Versions & vendor guidance →	Known exploitedCISA KEV	6.5Medium
CVE-2016-3235 Microsoft Office OLE DLL Side Loading Vulnerability n/a n/a Versions & vendor guidance →	Known exploitedCISA KEV	7.8High
CVE-2016-3088 Apache ActiveMQ Improper Input Validation Vulnerability n/a n/a Versions & vendor guidance →	Known exploitedCISA KEV	9.8Critical
CVE-2016-3081 Apache Struts Command Injection Vulnerability n/a n/a Versions & vendor guidance →	Known exploitedCISA KEV	8.1High
CVE-2016-2388 SAP NetWeaver Information Disclosure Vulnerability n/a n/a Versions & vendor guidance →	Known exploitedCISA KEV	5.3Medium
CVE-2016-2386 SAP NetWeaver SQL Injection Vulnerability n/a n/a Versions & vendor guidance →	Known exploitedCISA KEV	9.8Critical
CVE-2016-20017 D-Link DSL-2750B Devices Command Injection Vulnerability n/a n/a Versions & vendor guidance →	Known exploitedCISA KEV	9.8Critical
CVE-2016-1646 Google Chromium V8 Out-of-Bounds Read Vulnerability n/a n/a Versions & vendor guidance →	Known exploitedCISA KEV	8.8High
CVE-2016-1555 NETGEAR Multiple WAP Devices Command Injection Vulnerability n/a n/a Versions & vendor guidance →	Known exploitedCISA KEV	9.8Critical
CVE-2016-11021 D-Link DCS-930L Devices OS Command Injection Vulnerability n/a n/a Versions & vendor guidance →	Known exploitedCISA KEV	7.2High
CVE-2016-1019 Adobe Flash Player Arbitrary Code Execution Vulnerability n/a n/a Versions & vendor guidance →	Known exploitedCISA KEV	7.8High
CVE-2016-10174 NETGEAR WNR2000v5 Router Buffer Overflow Vulnerability n/a n/a Versions & vendor guidance →	Known exploitedCISA KEV	9.8Critical
CVE-2016-1010 Adobe Flash Player and AIR Integer Overflow Vulnerability n/a n/a Versions & vendor guidance →	Known exploitedCISA KEV	8.8High
CVE-2016-10033 PHPMailer Command Injection Vulnerability n/a n/a Versions & vendor guidance →	Known exploitedCISA KEV	9.8Critical
CVE-2016-0984 Adobe Flash Player and AIR Use-After-Free Vulnerability n/a n/a Versions & vendor guidance →	Known exploitedCISA KEV	8.8High
CVE-2016-0752 Ruby on Rails Directory Traversal Vulnerability n/a n/a Versions & vendor guidance →	Known exploitedCISA KEV	7.5High
CVE-2016-0189 Microsoft Internet Explorer Memory Corruption Vulnerability n/a n/a Versions & vendor guidance →	Known exploitedCISA KEV	7.5High
CVE-2016-0185 Microsoft Windows Media Center Remote Code Execution Vulnerability n/a n/a Versions & vendor guidance →	Known exploitedCISA KEV	7.8High
CVE-2016-0167 Microsoft Win32k Privilege Escalation Vulnerability n/a n/a Versions & vendor guidance →	Known exploitedCISA KEV	7.8High
CVE-2016-0165 Microsoft Win32k Privilege Escalation Vulnerability n/a n/a Versions & vendor guidance →	Known exploitedCISA KEV	7.8High
CVE-2016-0162 Microsoft Internet Explorer Information Disclosure Vulnerability n/a n/a Versions & vendor guidance →	Known exploitedCISA KEV	4.3Medium
CVE-2016-0151 Microsoft Windows CSRSS Security Feature Bypass Vulnerability n/a n/a Versions & vendor guidance →	Known exploitedCISA KEV	7.8High
CVE-2016-0099 Microsoft Windows Secondary Logon Service Privilege Escalation Vulnerability n/a n/a Versions & vendor guidance →	Known exploitedCISA KEV	7.8High
CVE-2016-0040 Microsoft Windows Kernel Privilege Escalation Vulnerability n/a n/a Versions & vendor guidance →	Known exploitedCISA KEV	7.8High
CVE-2016-0034 Microsoft Silverlight Runtime Remote Code Execution Vulnerability n/a n/a Versions & vendor guidance →	Known exploitedCISA KEV	8.8High

Data sources, freshness & score definitions

The full downloaded KEV catalog is tracked, alongside CVEs found in monitored sources. This is not the entire CVE universe. CVE record enrichment rotates in bounded batches; missing fields remain unknown.

CISA KEV: checked 13 Nov 2026, 00:20 Jerusalem · 1779 records

CVE Program: checked 13 Nov 2026, 00:20 Jerusalem · 117 records · 3 records unavailable

FIRST EPSS: checked 13 Nov 2026, 00:20 Jerusalem · 2223 records

CVSS describes reported technical severity. EPSS estimates exploitation probability in the next 30 days. KEV inclusion records known exploitation, not whether your own systems are exposed.