CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
400,359 CVEs
1,730 on KEV
17,275 EPSS ≥ 10%
25,087 with exploits
synced 2026-10-01
25,087 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2010-2620 EXP | Open&Compact FTP Server (Open-FTPD) 1.2 and earlier allows remote attackers to bypass authentication by sending (1) LIST, (2) RETR, (3) STOR, or other… | Patch early | 9.3 high | 29.6% | 2010-07-02 |
| CVE-2006-6917 EXP | Multiple buffer overflows in Computer Associates (CA) BrightStor ARCserve Backup R11.5 Server before SP2 allows remote attackers to execute arbitrary… | Patch early | 10.0 high | 29.5% | 2006-12-31 |
| CVE-2012-6664 EXP | Multiple directory traversal vulnerabilities in the TFTP Server in Distinct Intranet Servers 3.10 and earlier allow remote attackers to read or write… | Patch early | 9.1 critical | 29.5% | 2024-06-21 |
| CVE-2024-55661 EXP | Laravel Pulse is a real-time application performance monitoring tool and dashboard for Laravel applications. A vulnerability has been discovered in La… | Patch early | 8.8 high | 29.5% | 2024-12-13 |
| CVE-2004-1856 EXP | devices_update_printer_fw_upload.hts in HP Web JetAdmin 7.5.2546, when no password is set, allows remote attackers to upload arbitrary files to the pr… | Patch early | 5.0 medium | 29.5% | 2004-03-24 |
| CVE-2015-7647 EXP | Adobe Flash Player before 18.0.0.255 and 19.x before 19.0.0.226 on Windows and OS X and before 11.2.202.540 on Linux allows attackers to execute arbit… | Patch early | 10.0 high | 29.5% | 2015-10-18 |
| CVE-2015-7648 EXP | Adobe Flash Player before 18.0.0.255 and 19.x before 19.0.0.226 on Windows and OS X and before 11.2.202.540 on Linux allows attackers to execute arbit… | Patch early | 10.0 high | 29.5% | 2015-10-18 |
| CVE-2003-0240 EXP | The web-based administration capability for various Axis Network Camera products allows remote attackers to bypass access restrictions and modify conf… | Patch early | 10.0 high | 29.5% | 2003-06-09 |
| CVE-2015-2468 EXP | Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office for Mac 2011, Office for Mac 2016, Office Compatibili… | Patch early | 9.3 high | 29.5% | 2015-08-15 |
| CVE-2008-0492 EXP | Stack-based buffer overflow in the Persits.XUpload.2 ActiveX control in XUpload.ocx 3.0.0.4 and earlier in Persits XUpload 3.0 allows remote attackers… | Patch early | 6.8 medium | 29.5% | 2008-01-30 |
| CVE-2009-4487 EXP | nginx 0.7.64 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or… | Patch early | 6.8 medium | 29.5% | 2010-01-13 |
| CVE-2020-14011 EXP | Lansweeper 6.0.x through 7.2.x has a default installation in which the admin password is configured for the admin account, unless "Built-in admin" is… | Patch early | 9.8 critical | 29.5% | 2020-06-15 |
| CVE-2014-1201 EXP | Buffer overflow in the INetViewX ActiveX control in the Lorex Edge LH310 and Edge+ LH320 series with firmware 7-35-28-1B26E, Edge2 LH330 series with f… | Patch early | 10.0 high | 29.5% | 2014-01-15 |
| CVE-2004-0600 EXP | Buffer overflow in the Samba Web Administration Tool (SWAT) in Samba 3.0.2 to 3.0.4 allows remote attackers to execute arbitrary code via an invalid b… | Patch early | 10.0 high | 29.4% | 2004-07-27 |
| CVE-2012-2175 EXP | Buffer overflow in the Attachment_Times method in a certain ActiveX control in dwa85W.dll in IBM Lotus iNotes 8.5.x before 8.5.3 FP2 allows remote att… | Patch early | 9.3 high | 29.4% | 2012-06-20 |
| CVE-2015-8043 EXP | Use-after-free vulnerability in Adobe Flash Player before 18.0.0.261 and 19.x before 19.0.0.245 on Windows and OS X and before 11.2.202.548 on Linux,… | Patch early | 10.0 high | 29.4% | 2015-11-11 |
| CVE-2012-4598 EXP | An unspecified ActiveX control in McAfee Virtual Technician (MVT) before 6.4, and ePO-MVT, allows remote attackers to execute arbitrary code or cause… | Patch early | 9.3 high | 29.4% | 2012-08-22 |
| CVE-2007-3670 EXP | Argument injection vulnerability in Microsoft Internet Explorer, when running on systems with Firefox installed and certain URIs registered, allows re… | Patch early | 4.3 medium | 29.4% | 2007-07-10 |
| CVE-2017-7456 EXP | Moxa MXView 2.8 allows remote attackers to cause a Denial of Service by sending overly long junk payload for the MXView client login credentials. | Patch early | 7.5 high | 29.3% | 2017-04-14 |
| CVE-2017-1130 EXP | IBM Notes 8.5 and 9.0 is vulnerable to a denial of service. If a user is persuaded to click on a malicious link, it would open up many file select dia… | Patch early | 6.5 medium | 29.2% | 2017-09-05 |
| CVE-2007-1403 EXP | Multiple stack-based buffer overflows in an ActiveX control in SwDir.dll 10.1.4.20 in Macromedia Shockwave allow remote attackers to cause a denial of… | Patch early | 7.5 high | 29.2% | 2007-03-10 |
| CVE-2006-2373 EXP | The Server Message Block (SMB) driver (MRXSMB.SYS) in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 and earlier allows local users t… | Patch early | 10.0 high | 29.2% | 2006-06-13 |
| CVE-2012-2915 EXP | Stack-based buffer overflow in Lattice Semiconductor PAC-Designer 6.2.1344 allows remote attackers to execute arbitrary code via a long string in a Va… | Patch early | 9.3 high | 29.2% | 2012-05-21 |
| CVE-2009-1699 EXP | The XSL stylesheet implementation in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 do… | Patch early | 7.5 high | 29.1% | 2009-06-10 |
| CVE-2005-1344 EXP | Buffer overflow in htdigest in Apache 2.0.52 may allow attackers to execute arbitrary code via a long realm argument. NOTE: since htdigest is normall… | Patch early | 7.5 high | 29.1% | 2005-05-02 |
| CVE-2015-1730 EXP | Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web sit… | Patch early | 9.3 high | 29.1% | 2015-06-10 |
| CVE-2017-11517 EXP | Stack-based buffer overflow in GCoreServer.exe in the server in Geutebrueck Gcore 1.3.8.42 and 1.4.2.37 allows remote attackers to execute arbitrary c… | Patch early | 9.8 critical | 29.1% | 2017-07-21 |
| CVE-2007-1211 EXP | Unspecified kernel GDI functions in Microsoft Windows 2000 SP4; XP SP2; and Server 2003 Gold, SP1, and SP2 allows user-assisted remote attackers to ca… | Patch early | 7.1 high | 29.1% | 2007-04-04 |
| CVE-2019-7274 EXP | Optergy Proton/Enterprise devices allow Authenticated File Upload with Code Execution as root. | Patch early | 9.8 critical | 29% | 2019-07-01 |
| CVE-1999-0009 EXP | Inverse query buffer overflow in BIND 4.9 and BIND 8 Releases. | Patch early | 10.0 high | 29% | 1998-04-08 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt