CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
400,405 CVEs
1,730 on KEV
17,275 EPSS ≥ 10%
25,087 with exploits
synced 2026-10-01
25,087 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2006-0287 EXP | Unspecified vulnerability in the Oracle HTTP Server component of Oracle Database Server 10.1.0.5 and Application Server 10.1.2.0.2 has unspecified imp… | Patch early | 10.0 high | 29% | 2006-01-18 |
| CVE-2006-3469 EXP | Format string vulnerability in time.cc in MySQL Server 4.1 before 4.1.21 and 5.0 before 1 April 2006 allows remote authenticated users to cause a deni… | Patch early | 4.0 medium | 29% | 2006-07-21 |
| CVE-2010-4538 EXP | Buffer overflow in the sect_enttec_dmx_da function in epan/dissectors/packet-enttec.c in Wireshark 1.4.2 allows remote attackers to cause a denial of… | Patch early | 9.3 high | 29% | 2011-01-07 |
| CVE-2002-0191 EXP | Microsoft Internet Explorer 5.01, 5.5 and 6.0 allows remote attackers to view arbitrary files that contain the "{" character via script containing the… | Patch early | 5.0 medium | 29% | 2002-05-29 |
| CVE-2018-14058 EXP | Pimcore before 5.3.0 allows SQL Injection via the REST web service API. | Patch early | 6.5 medium | 29% | 2018-08-17 |
| CVE-2007-5387 EXP | PHP remote file inclusion vulnerability in active/components/xmlrpc/client.php in Pindorama 0.1 allows remote attackers to execute arbitrary PHP code… | Patch early | 6.8 medium | 28.9% | 2007-10-12 |
| CVE-2008-1069 EXP | Multiple PHP remote file inclusion vulnerabilities in Quantum Game Library 0.7.2c allow remote attackers to execute arbitrary PHP code via a URL in th… | Patch early | 6.8 medium | 28.9% | 2008-02-28 |
| CVE-2013-3238 EXP | phpMyAdmin 3.5.x before 3.5.8 and 4.x before 4.0.0-rc3 allows remote authenticated users to execute arbitrary code via a /e\x00 sequence, which is not… | Patch early | 6.0 medium | 28.9% | 2013-04-26 |
| CVE-2018-7182 EXP | The ctl_getitem method in ntpd in ntp-4.2.8p6 before 4.2.8p11 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted… | Patch early | 7.5 high | 28.8% | 2018-03-06 |
| CVE-2016-6897 EXP | Cross-site request forgery (CSRF) vulnerability in the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6 al… | Patch early | 6.5 medium | 28.8% | 2017-01-18 |
| CVE-2009-0950 EXP | Stack-based buffer overflow in Apple iTunes before 8.2 allows remote attackers to execute arbitrary code or cause a denial of service (application cra… | Patch early | 9.3 high | 28.8% | 2009-06-02 |
| CVE-2014-6035 EXP | Directory traversal vulnerability in the FileCollector servlet in ZOHO ManageEngine OpManager 11.4, 11.3, and earlier allows remote attackers to write… | Patch early | 7.5 high | 28.8% | 2014-12-04 |
| CVE-2003-0990 EXP | The parseAddress code in (1) SquirrelMail 1.4.0 and (2) GPG Plugin 1.1 allows remote attackers to execute commands via shell metacharacters in the "To… | Patch early | 7.5 high | 28.8% | 2004-01-20 |
| CVE-2008-0533 EXP | Multiple cross-site scripting (XSS) vulnerabilities in securecgi-bin/CSuserCGI.exe in User-Changeable Password (UCP) before 4.2 in Cisco Secure Access… | Patch early | 4.3 medium | 28.8% | 2008-03-14 |
| CVE-2013-5015 EXP | SQL injection vulnerability in the management console in Symantec Endpoint Protection Manager (SEPM) 11.0 before 11.0.7405.1424 and 12.1 before 12.1.4… | Patch early | 6.5 medium | 28.8% | 2014-02-14 |
| CVE-2019-6225 EXP | A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 12.1.3, macOS Mojave 10.14.3, tvOS 12.1.2. A malicious ap… | Patch early | 7.8 high | 28.8% | 2019-03-05 |
| CVE-2007-4954 EXP | PHP remote file inclusion vulnerability in admin.joom12pic.php in the joom12Pic (com_joom12pic) 1.0 component for Joomla! allows remote attackers to e… | Patch early | 6.8 medium | 28.7% | 2007-09-18 |
| CVE-2007-5271 EXP | Multiple PHP remote file inclusion vulnerabilities in Trionic Cite CMS 1.2 rev9 and earlier allow remote attackers to execute arbitrary PHP code via a… | Patch early | 6.8 medium | 28.7% | 2007-10-08 |
| CVE-2007-5592 EXP | Multiple PHP remote file inclusion vulnerabilities in awzMB 4.2 beta 1 and earlier allow remote attackers to execute arbitrary PHP code via a URL in t… | Patch early | 6.8 medium | 28.7% | 2007-10-19 |
| CVE-2017-0901 EXP | RubyGems version 2.6.12 and earlier fails to validate specification names, allowing a maliciously crafted gem to potentially overwrite any file on the… | Patch early | 7.5 high | 28.7% | 2017-08-31 |
| CVE-2006-0058 EXP | Signal handler race condition in Sendmail 8.13.x before 8.13.6 allows remote attackers to execute arbitrary code by triggering timeouts in a way that… | Patch early | 7.6 high | 28.7% | 2006-03-22 |
| CVE-2018-6849 EXP | In the WebRTC component in DuckDuckGo 4.2.0, after visiting a web site that attempts to gather complete client information (such as https://ip.voidsec… | Patch early | 4.3 medium | 28.7% | 2018-04-01 |
| CVE-2010-0817 EXP | Cross-site scripting (XSS) vulnerability in _layouts/help.aspx in Microsoft SharePoint Server 2007 12.0.0.6421 and possibly earlier, and SharePoint Se… | Patch early | 4.3 medium | 28.7% | 2010-04-29 |
| CVE-2008-4384 EXP | Multiple stack-based buffer overflows in MGI Software LPViewer ActiveX control (LPControl.dll), as acquired by Roxio and iseemedia, allow remote attac… | Patch early | 9.3 high | 28.7% | 2008-10-07 |
| CVE-2006-1540 EXP | MSO.DLL in Microsoft Office 2000, Office XP (2002), and Office 2003 allows user-assisted attackers to cause a denial of service and execute arbitrary… | Patch early | 9.3 high | 28.6% | 2006-03-30 |
| CVE-2011-4642 EXP | mappy.py in Splunk Web in Splunk 4.2.x before 4.2.5 does not properly restrict use of the mappy command to access Python classes, which allows remote… | Patch early | 4.6 medium | 28.6% | 2012-01-03 |
| CVE-2011-2950 EXP | Heap-based buffer overflow in qcpfformat.dll in RealNetworks RealPlayer 11.0 through 11.1 and 14.0.0 through 14.0.5 and RealPlayer SP 1.0 through 1.1.… | Patch early | 9.3 high | 28.6% | 2011-08-18 |
| CVE-2004-1782 EXP | athenareg.php in Athena Web Registration allows remote attackers to execute arbitrary commands via shell metacharacters in the pass parameter. | Patch early | 7.5 high | 28.6% | 2004-12-31 |
| CVE-2013-6720 EXP | Directory traversal vulnerability in download.php in the Passive Capture Application (PCA) web console in IBM Tealeaf CX 7.x, 8.x through 8.6, 8.7 bef… | Patch early | 5.5 medium | 28.6% | 2014-03-06 |
| CVE-2011-5164 EXP | Stack-based buffer overflow in VanDyke Software AbsoluteFTP 1.9.6 through 2.2.10 allows remote FTP servers to execute arbitrary code via a crafted fil… | Patch early | 9.3 high | 28.6% | 2012-09-15 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt