CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
400,828 CVEs
1,731 on KEV
17,275 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-02
25,091 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2018-19571 EXP | GitLab CE/EE, versions 8.18 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an SSRF vulnerability in webhooks… | Patch early | 7.7 high | 28.2% | 2019-07-10 |
| CVE-2011-0041 EXP | Integer overflow in gdiplus.dll in GDI+ in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 G… | Patch early | 9.3 high | 28.2% | 2011-04-13 |
| CVE-2003-1566 EXP | Microsoft Internet Information Services (IIS) 5.0 does not log requests that use the TRACK method, which allows remote attackers to obtain sensitive i… | Patch early | 5.0 medium | 28.1% | 2009-01-15 |
| CVE-2014-1912 EXP | Buffer overflow in the socket.recvfrom_into function in Modules/socketmodule.c in Python 2.5 before 2.7.7, 3.x before 3.3.4, and 3.4.x before 3.4rc1 a… | Patch early | 7.5 high | 28.1% | 2014-03-01 |
| CVE-2011-1137 EXP | Integer overflow in the mod_sftp (aka SFTP) module in ProFTPD 1.3.3d and earlier allows remote attackers to cause a denial of service (memory consumpt… | Patch early | 5.0 medium | 28.1% | 2011-03-11 |
| CVE-2001-0875 EXP | Internet Explorer 5.5 and 6.0 allows remote attackers to cause the File Download dialogue box to misrepresent the name of the file in the dialogue in… | Patch early | 7.5 high | 28.1% | 2001-11-26 |
| CVE-2009-0689 EXP | Array index error in the (1) dtoa implementation in dtoa.c (aka pdtoa.c) and the (2) gdtoa (aka new dtoa) implementation in gdtoa/misc.c in libc, as u… | Patch early | 6.8 medium | 28.1% | 2009-07-01 |
| CVE-2020-35606 EXP | Arbitrary command execution can occur in Webmin through 1.962. Any user authorized for the Package Updates module can execute arbitrary commands with… | Patch early | 8.8 high | 28% | 2020-12-21 |
| CVE-2018-12327 EXP | Stack-based buffer overflow in ntpq and ntpdc of NTP version 4.2.8p11 allows an attacker to achieve code execution or escalate to higher privileges vi… | Patch early | 9.8 critical | 28% | 2018-06-20 |
| CVE-2008-3263 EXP | The IAX2 protocol implementation in Asterisk Open Source 1.0.x, 1.2.x before 1.2.30, and 1.4.x before 1.4.21.2; Business Edition A.x.x, B.x.x before B… | Patch early | 7.8 high | 28% | 2008-07-22 |
| CVE-2013-0726 EXP | Stack-based buffer overflow in the ERM_convert_to_correct_webpath function in ermapper_u.dll in ERDAS ER Viewer before 13.00.0001 allows remote attack… | Patch early | 9.3 high | 28% | 2013-05-05 |
| CVE-2006-1236 EXP | Buffer overflow in the SetUp function in socket/request.c in CrossFire 1.9.0 allows remote attackers to execute arbitrary code via a long setup sound… | Patch early | 7.5 high | 28% | 2006-03-15 |
| CVE-2019-8982 EXP | com/wavemaker/studio/StudioService.java in WaveMaker Studio 6.6 mishandles the studioService.download?method=getContent&inUrl= value, leading to discl… | Patch early | 9.6 critical | 28% | 2019-02-21 |
| CVE-2001-0239 EXP | Microsoft Internet Security and Acceleration (ISA) Server 2000 Web Proxy allows remote attackers to cause a denial of service via a long web request w… | Patch early | 7.5 high | 28% | 2001-07-02 |
| CVE-2010-1225 EXP | The memory-management implementation in the Virtual Machine Monitor (aka VMM or hypervisor) in Microsoft Virtual PC 2007 Gold and SP1, Virtual Server… | Patch early | 9.3 high | 28% | 2010-04-01 |
| CVE-2018-7171 EXP | Directory traversal vulnerability in Twonky Server 7.0.11 through 8.5 allows remote attackers to share the contents of arbitrary directories via a ..… | Patch early | 7.5 high | 27.9% | 2018-03-30 |
| CVE-2001-0341 EXP | Buffer overflow in Microsoft Visual Studio RAD Support sub-component of FrontPage Server Extensions allows remote attackers to execute arbitrary comma… | Patch early | 7.5 high | 27.9% | 2001-07-21 |
| CVE-2007-5056 EXP | Eval injection vulnerability in adodb-perf-module.inc.php in ADOdb Lite 1.42 and earlier, as used in products including CMS Made Simple, SAPID CMF, Jo… | Patch early | 6.8 medium | 27.9% | 2007-09-24 |
| CVE-1999-0002 EXP | Buffer overflow in NFS mountd gives root access to remote attackers, mostly in Linux systems. | Patch early | 10.0 high | 27.9% | 1998-10-12 |
| CVE-2010-4741 EXP | Stack-based buffer overflow in MDMUtil.dll in MDMTool.exe in MDM Tool before 2.3 in Moxa Device Manager allows remote MDM Gateways to execute arbitrar… | Patch early | 9.3 high | 27.8% | 2011-02-18 |
| CVE-2017-14335 EXP | On Beijing Hanbang Hanbanggaoke devices, because user-controlled input is not sufficiently sanitized, sending a PUT request to /ISAPI/Security/users/1… | Patch early | 7.5 high | 27.8% | 2017-09-12 |
| CVE-2010-2330 EXP | Stack-based buffer overflow in iSharer File Sharing Wizard 1.5.0 allows remote attackers to cause a denial of service (crash) and possibly execute arb… | Patch early | 9.3 high | 27.8% | 2010-06-18 |
| CVE-2009-0184 EXP | Multiple buffer overflows in the torrent parsing implementation in Free Download Manager (FDM) 2.5 Build 758 and 3.0 Build 844 allow remote attackers… | Patch early | 9.3 high | 27.8% | 2009-02-03 |
| CVE-2010-4566 EXP | The web authentication form in the NT4 authentication component in Citrix Access Gateway Enterprise Edition 9.2-49.8 and earlier, and the NTLM authent… | Patch early | 9.3 high | 27.8% | 2011-01-14 |
| CVE-2008-1145 EXP | Directory traversal vulnerability in WEBrick in Ruby 1.8 before 1.8.5-p115 and 1.8.6-p114, and 1.9 through 1.9.0-1, when running on systems that suppo… | Patch early | 5.0 medium | 27.8% | 2008-03-04 |
| CVE-2020-28976 EXP | The Canto plugin 1.3.0 for WordPress contains a blind SSRF vulnerability. It allows an unauthenticated attacker can make a request to any internal and… | Patch early | 5.3 medium | 27.8% | 2020-11-30 |
| CVE-2008-2752 EXP | Microsoft Word 2000 9.0.2812 and 2003 11.8106.8172 does not properly handle unordered lists, which allows user-assisted remote attackers to cause a de… | Patch early | 7.1 high | 27.8% | 2008-06-18 |
| CVE-2007-5628 EXP | PHP remote file inclusion vulnerability in src/scripture.php in The Online Web Library Site (TOWels) 0.1 allows remote attackers to execute arbitrary… | Patch early | 6.8 medium | 27.8% | 2007-10-23 |
| CVE-2007-6038 EXP | PHP remote file inclusion vulnerability in xajax_functions.php in the JUser (com_juser) 1.0.14 component for Joomla! allows remote attackers to execut… | Patch early | 6.8 medium | 27.8% | 2007-11-20 |
| CVE-2013-7389 EXP | Multiple cross-site scripting (XSS) vulnerabilities in D-Link DIR-645 Router (Rev. A1) with firmware before 1.04B11 allow remote attackers to inject a… | Patch early | 4.3 medium | 27.8% | 2014-07-07 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt