CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
400,152 CVEs
1,730 on KEV
17,275 EPSS ≥ 10%
25,087 with exploits
synced 2026-10-01
25,087 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2013-0019 EXP | Use-after-free vulnerability in Microsoft Internet Explorer 7 through 10 allows remote attackers to execute arbitrary code via a crafted web site that… | Patch early | 9.3 high | 34.9% | 2013-02-13 |
| CVE-2016-2233 EXP | Stack-based buffer overflow in the inbound_cap_ls function in common/inbound.c in HexChat 2.10.2 allows remote IRC servers to cause a denial of servic… | Patch early | 7.5 high | 34.9% | 2017-01-18 |
| CVE-2007-2221 EXP | Unspecified vulnerability in the mdsauth.dll COM object in Microsoft Windows Media Server in the Microsoft Internet Explorer 5.01 SP4 on Windows 2000… | Patch early | 9.3 high | 34.9% | 2007-05-08 |
| CVE-2011-3360 EXP | Untrusted search path vulnerability in Wireshark 1.4.x before 1.4.9 and 1.6.x before 1.6.2 allows local users to gain privileges via a Trojan horse Lu… | Patch early | 9.3 high | 34.9% | 2011-09-20 |
| CVE-2017-11282 EXP | Adobe Flash Player has an exploitable memory corruption vulnerability in the MP4 atom parser. Successful exploitation could lead to arbitrary code exe… | Patch early | 9.8 critical | 34.8% | 2017-12-01 |
| CVE-2008-0118 EXP | Unspecified vulnerability in Microsoft Office 2000 SP3, XP SP3, 2003 SP2, Excel Viewer 2003 up to SP3, and Office 2004 for Mac allows user-assisted re… | Patch early | 9.3 high | 34.8% | 2008-03-11 |
| CVE-2004-1769 EXP | The "Allow cPanel users to reset their password via email" feature in cPanel 9.1.0 build 34 and earlier, including 8.x, allows remote attackers to exe… | Patch early | 10.0 high | 34.8% | 2004-03-11 |
| CVE-2006-6334 EXP | Heap-based buffer overflow in the SendChannelData function in wfica.ocx in Citrix Presentation Server Client before 9.230 for Windows allows remote ma… | Patch early | 6.8 medium | 34.8% | 2006-12-08 |
| CVE-2003-0866 EXP | The Catalina org.apache.catalina.connector.http package in Tomcat 4.0.x up to 4.0.3 allows remote attackers to cause a denial of service via several r… | Patch early | 5.0 medium | 34.8% | 2003-11-17 |
| CVE-2010-3747 EXP | An ActiveX control in RealNetworks RealPlayer 11.0 through 11.1, RealPlayer SP 1.0 through 1.1.4, and RealPlayer Enterprise 2.1.2 does not properly in… | Patch early | 9.3 high | 34.8% | 2010-10-19 |
| CVE-2014-1303 EXP | Heap-based buffer overflow in Apple Safari 7.0.2 allows remote attackers to execute arbitrary code and bypass a sandbox protection mechanism via unspe… | Patch early | 10.0 high | 34.8% | 2014-03-26 |
| CVE-2016-9150 EXP | Buffer overflow in the management web interface in Palo Alto Networks PAN-OS before 5.0.20, 5.1.x before 5.1.13, 6.0.x before 6.0.15, 6.1.x before 6.1… | Patch early | 9.8 critical | 34.8% | 2016-11-19 |
| CVE-2004-2221 EXP | Buffer overflow in SoftCart.exe in Mercantec SoftCart 4.00b allows remote attackers to execute arbitrary code via a long parameter in an HTTP GET requ… | Patch early | 7.5 high | 34.8% | 2004-12-31 |
| CVE-2008-2683 EXP | The BIDIB.BIDIBCtrl.1 ActiveX control in BIDIB.ocx 10.9.3.0 in Black Ice Barcode SDK 5.01 allows remote attackers to force the download and storage of… | Patch early | 9.3 high | 34.8% | 2008-06-12 |
| CVE-2019-9880 EXP | An issue was discovered in the WPGraphQL 0.2.3 plugin for WordPress. By querying the 'users' RootQuery, it is possible, for an unauthenticated attacke… | Patch early | 9.1 critical | 34.8% | 2019-06-10 |
| CVE-2015-2177 EXP | Siemens SIMATIC S7-300 CPU devices allow remote attackers to cause a denial of service (defect-mode transition) via crafted packets on (1) TCP port 10… | Patch early | 7.5 high | 34.7% | 2015-03-07 |
| CVE-2019-16451 EXP | Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier, 2017.011.30155 and earlier version, 2017.011.30152 and ear… | Patch early | 9.8 critical | 34.7% | 2019-12-19 |
| CVE-2001-1186 EXP | Microsoft IIS 5.0 allows remote attackers to cause a denial of service via an HTTP request with a content-length value that is larger than the size of… | Patch early | 5.0 medium | 34.7% | 2001-12-11 |
| CVE-2014-1770 EXP | Use-after-free vulnerability in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code via crafted JavaScript code… | Patch early | 9.3 high | 34.7% | 2014-05-22 |
| CVE-2017-5869 EXP | Directory traversal vulnerability in the file import feature in Nuxeo Platform 6.0, 7.1, 7.2, and 7.3 allows remote authenticated users to upload and… | Patch early | 8.8 high | 34.6% | 2017-03-24 |
| CVE-2019-8048 EXP | Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015… | Patch early | 9.8 critical | 34.6% | 2019-08-20 |
| CVE-2007-4006 EXP | Buffer overflow in Mike Dubman Windows RSH daemon (rshd) 1.7 has unknown impact and remote attack vectors, aka ZD-00000034. NOTE: this information is… | Patch early | 6.8 medium | 34.5% | 2007-07-26 |
| CVE-2015-2463 EXP | Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Go… | Patch early | 9.3 high | 34.5% | 2015-08-15 |
| CVE-2015-6152 EXP | Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web si… | Patch early | 9.3 high | 34.4% | 2015-12-09 |
| CVE-2009-0595 EXP | PHP remote file inclusion vulnerability in skysilver/login.tpl.php in phpSkelSite 1.4, when register_globals is enabled and magic_quotes_gpc is disabl… | Patch early | 5.1 medium | 34.4% | 2009-02-16 |
| CVE-2003-0227 EXP | The logging capability for unicast and multicast transmissions in the ISAPI extension for Microsoft Windows Media Services in Microsoft Windows NT 4.0… | Patch early | 5.0 medium | 34.4% | 2003-06-09 |
| CVE-2006-3961 EXP | Buffer overflow in McSubMgr ActiveX control (mcsubmgr.dll) in McAfee Security Center 6.0.23 for Internet Security Suite 2006, Wireless Home Network Se… | Patch early | 6.8 medium | 34.4% | 2006-08-01 |
| CVE-2017-16930 EXP | The remote management interface on the Claymore Dual GPU miner 10.1 allows an unauthenticated remote attacker to execute arbitrary code due to a stack… | Patch early | 9.8 critical | 34.3% | 2017-12-05 |
| CVE-2013-0928 EXP | The NetWorker command processor in rrobotd.exe in the Device Manager in EMC AlphaStor 4.0 before build 800 allows remote attackers to execute arbitrar… | Patch early | 9.3 high | 34.3% | 2013-01-21 |
| CVE-2010-0476 EXP | The SMB client in Microsoft Windows Server 2003 SP2, Vista Gold, SP1, and SP2, and Windows Server 2008 Gold and SP2 allows remote SMB servers and man-… | Patch early | 10.0 high | 34.3% | 2010-04-14 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt