CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
400,888 CVEs
1,731 on KEV
17,275 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-02
25,091 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2008-4033 EXP | Cross-domain vulnerability in Microsoft XML Core Services 3.0 through 6.0, as used in Microsoft Expression Web, Office, Internet Explorer, and other p… | Patch early | 4.3 medium | 27.7% | 2008-11-12 |
| CVE-2015-3036 EXP | Stack-based buffer overflow in the run_init_sbus function in the KCodes NetUSB module for the Linux kernel, as used in certain NETGEAR products, TP-LI… | Patch early | 10.0 high | 27.7% | 2015-05-21 |
| CVE-2015-5118 EXP | Heap-based buffer overflow in Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481… | Patch early | 10.0 high | 27.7% | 2015-07-09 |
| CVE-2018-1189 EXP | Dell EMC Isilon versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, and 8.0.0.0 - 8.0.0.6, versions 7.2.1.x, and version 7.1.1.11 is affected by a… | Patch early | 4.8 medium | 27.7% | 2018-03-26 |
| CVE-2015-2467 EXP | Microsoft Office 2007 SP3 allows remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office Memory Corruption Vulnerabil… | Patch early | 9.3 high | 27.7% | 2015-08-15 |
| CVE-2015-2520 EXP | Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel for Mac 2011 and 2016, Office Compatibility Pack SP3, and Excel Viewer allow remote attackers to execu… | Patch early | 9.3 high | 27.7% | 2015-09-09 |
| CVE-2015-2521 EXP | Microsoft Excel 2007 SP3, Excel 2010 SP2, Office Compatibility Pack SP3, and Excel Viewer allow remote attackers to execute arbitrary code via a craft… | Patch early | 9.3 high | 27.7% | 2015-09-09 |
| CVE-2018-9032 EXP | An authentication bypass vulnerability on D-Link DIR-850L Wireless AC1200 Dual Band Gigabit Cloud Router (Hardware Version : A1, B1; Firmware Version… | Patch early | 9.8 critical | 27.7% | 2018-03-27 |
| CVE-2007-2353 EXP | Apache Axis 1.0 allows remote attackers to obtain sensitive information by requesting a non-existent WSDL file, which reveals the installation path in… | Patch early | 5.0 medium | 27.7% | 2007-04-30 |
| CVE-2001-0722 EXP | Internet Explorer 5.5 and 6.0 allows remote attackers to read and modify user cookies via Javascript in an about: URL, aka the "First Cookie Handling… | Patch early | 6.4 medium | 27.6% | 2001-12-06 |
| CVE-2019-25024 EXP | OpenRepeater (ORP) before 2.2 allows unauthenticated command injection via shell metacharacters in the functions/ajax_system.php post_service paramete… | Patch early | 9.8 critical | 27.6% | 2021-02-19 |
| CVE-2005-3116 EXP | Stack-based buffer overflow in a shared library as used by the Volume Manager daemon (vmd) in VERITAS NetBackup Enterprise Server 5.0 MP1 to MP5 and 5… | Patch early | 10.0 high | 27.6% | 2005-11-18 |
| CVE-2007-5574 EXP | PHP remote file inclusion vulnerability in djpage.php in PHPDJ 0.5 allows remote attackers to execute arbitrary PHP code via a URL in the page paramet… | Patch early | 6.8 medium | 27.6% | 2007-10-18 |
| CVE-2008-1876 EXP | PHP remote file inclusion vulnerability in index.php in VisualPic 0.3.1 allows remote attackers to execute arbitrary PHP code via a URL in the _CONFIG… | Patch early | 6.8 medium | 27.6% | 2008-04-17 |
| CVE-2008-4830 EXP | Insecure method vulnerability in the KWEdit ActiveX control in SAP GUI 6.40 Patch 29 (KWEDIT.DLL 6400.1.1.41) and 7.10 Patch 5 (KWEDIT.DLL 7100.1.1.43… | Patch early | 9.3 high | 27.6% | 2009-04-16 |
| CVE-2016-3388 EXP | Microsoft Internet Explorer 10 and 11 and Microsoft Edge do not properly restrict access to private namespaces, which allows remote attackers to gain… | Patch early | 5.3 medium | 27.6% | 2016-10-14 |
| CVE-2013-3686 EXP | cgi-bin/operator/param in AirLive WL2600CAM and possibly other camera models allows remote attackers to obtain the administrator password via a list a… | Patch early | 10.0 high | 27.6% | 2013-10-11 |
| CVE-2015-7254 EXP | Directory traversal vulnerability on Huawei HG532e, HG532n, and HG532s devices allows remote attackers to read arbitrary files via a .. (dot dot) in a… | Patch early | 5.0 medium | 27.5% | 2015-11-07 |
| CVE-2007-6015 EXP | Stack-based buffer overflow in the send_mailslot function in nmbd in Samba 3.0.0 through 3.0.27a, when the "domain logons" option is enabled, allows r… | Patch early | 9.3 high | 27.5% | 2007-12-13 |
| CVE-2020-14209 EXP | Dolibarr before 11.0.5 allows low-privilege users to upload files of dangerous types, leading to arbitrary code execution. This occurs because .pht an… | Patch early | 8.8 high | 27.5% | 2020-09-02 |
| CVE-2017-1002000 EXP | Vulnerability in wordpress plugin mobile-friendly-app-builder-by-easytouch v3.0, The code in file ./mobile-friendly-app-builder-by-easytouch/server/im… | Patch early | 9.8 critical | 27.4% | 2017-09-14 |
| CVE-2001-0951 EXP | Windows 2000 allows remote attackers to cause a denial of service (CPU consumption) by flooding Internet Key Exchange (IKE) UDP port 500 with packets… | Patch early | 5.0 medium | 27.4% | 2001-12-07 |
| CVE-2019-11013 EXP | Nimble Streamer 3.0.2-2 through 3.5.4-9 has a ../ directory traversal vulnerability. Successful exploitation could allow an attacker to traverse the f… | Patch early | 6.5 medium | 27.4% | 2019-08-22 |
| CVE-2022-24632 EXP | An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. It is directory traversal during file download via the BrowseFil… | Patch early | 5.3 medium | 27.4% | 2023-05-29 |
| CVE-2012-4356 EXP | Multiple directory traversal vulnerabilities in Sielco Sistemi Winlog Pro SCADA before 2.07.17 and Winlog Lite SCADA before 2.07.17 allow remote attac… | Patch early | 4.3 medium | 27.4% | 2012-08-19 |
| CVE-2006-5379 EXP | The accelerated rendering functionality of NVIDIA Binary Graphics Driver (binary blob driver) For Linux v8774 and v8762, and probably on other operati… | Patch early | 7.5 high | 27.4% | 2006-10-18 |
| CVE-2017-16562 EXP | The UserPro plugin before 4.9.17.1 for WordPress, when used on a site with the "admin" username, allows remote attackers to bypass authentication and… | Patch early | 9.8 critical | 27.4% | 2017-11-10 |
| CVE-2003-0543 EXP | Integer overflow in OpenSSL 0.9.6 and 0.9.7 allows remote attackers to cause a denial of service (crash) via an SSL client certificate with certain AS… | Patch early | 5.0 medium | 27.4% | 2003-11-17 |
| CVE-2000-0169 EXP | Batch files in the Oracle web listener ows-bin directory allow remote attackers to execute commands via a malformed URL that includes '?&'. | Patch early | 7.5 high | 27.4% | 2000-03-15 |
| CVE-2010-0103 EXP | UsbCharger.dll in the Energizer DUO USB battery charger software contains a backdoor that is implemented through the Arucer.dll file in the %WINDIR%\s… | Patch early | 9.3 high | 27.3% | 2010-03-10 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt