CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
400,888 CVEs
1,733 on KEV
17,286 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-02
25,091 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2010-0103 EXP | UsbCharger.dll in the Energizer DUO USB battery charger software contains a backdoor that is implemented through the Arucer.dll file in the %WINDIR%\s… | Patch early | 9.3 high | 27.3% | 2010-03-10 |
| CVE-2002-0640 EXP | Buffer overflow in sshd in OpenSSH 2.3.1 through 3.3 may allow remote attackers to execute arbitrary code via a large number of responses during chall… | Patch early | 10.0 high | 27.3% | 2002-07-03 |
| CVE-2002-0936 EXP | The Java Server Pages (JSP) engine in Tomcat allows web page owners to cause a denial of service (engine crash) on the web server via a JSP page that… | Patch early | 5.0 medium | 27.3% | 2002-10-04 |
| CVE-2012-3001 EXP | Mutiny Standard before 4.5-1.12 allows remote attackers to execute arbitrary commands via the network-interface menu, related to a "command injection… | Patch early | 8.5 high | 27.3% | 2012-10-22 |
| CVE-2001-1325 EXP | Internet Explorer 5.0 and 5.5, and Outlook Express 5.0 and 5.5, allow remote attackers to execute scripts when Active Scripting is disabled by includi… | Patch early | 7.5 high | 27.3% | 2001-04-20 |
| CVE-2003-0809 EXP | Internet Explorer 5.01 through 6.0 does not properly handle object tags returned from a Web server during XML data binding, which allows remote attack… | Patch early | 7.5 high | 27.3% | 2003-11-17 |
| CVE-2010-3138 EXP | Untrusted search path vulnerability in the Indeo Codec in iac25_32.ax in Microsoft Windows XP SP3 allows local users to gain privileges via a Trojan h… | Patch early | 9.3 high | 27.3% | 2010-08-27 |
| CVE-2008-4699 EXP | Insecure method vulnerability in the ActiveX control (PAWWeb11.ocx) in Peachtree Accounting 2004 allows remote attackers to execute arbitrary programs… | Patch early | 9.3 high | 27.2% | 2008-10-22 |
| CVE-2019-13063 EXP | Within Sahi Pro 8.0.0, an attacker can send a specially crafted URL to include any victim files on the system via the script parameter on the Script_v… | Patch early | 7.5 high | 27.2% | 2019-09-23 |
| CVE-2011-5057 EXP | Apache Struts 2.3.1.2 and earlier, 2.3.19-2.3.23, provides interfaces that do not properly restrict access to collections such as the session and requ… | Patch early | 5.0 medium | 27.2% | 2012-01-08 |
| CVE-2010-4367 EXP | awstats.cgi in AWStats before 7.0 accepts a configdir parameter in the URL, which allows remote attackers to execute arbitrary commands via a crafted… | Patch early | 7.5 high | 27.2% | 2010-12-02 |
| CVE-2010-1248 EXP | Buffer overflow in Microsoft Office Excel 2002 SP3 and Office 2004 for Mac allows remote attackers to execute arbitrary code via an Excel file with a… | Patch early | 9.3 high | 27.2% | 2010-06-08 |
| CVE-2012-1465 EXP | Stack-based buffer overflow in the HTTP Server in NetMechanica NetDecision before 4.6.1 allows remote attackers to cause a denial of service (applicat… | Patch early | 4.3 medium | 27.1% | 2012-03-19 |
| CVE-2018-7750 EXP | transport.py in the SSH server implementation of Paramiko before 1.17.6, 1.18.x before 1.18.5, 2.0.x before 2.0.8, 2.1.x before 2.1.5, 2.2.x before 2.… | Patch early | 9.8 critical | 27.1% | 2018-03-13 |
| CVE-2013-3522 EXP | SQL injection vulnerability in index.php/ajax/api/reputation/vote in vBulletin 5.0.0 Beta 11, 5.0.0 Beta 28, and earlier allows remote authenticated u… | Patch early | 6.5 medium | 27.1% | 2013-05-10 |
| CVE-2002-1567 EXP | Cross-site scripting (XSS) vulnerability in Apache Tomcat 4.1 allows remote attackers to execute arbitrary web script and steal cookies via a URL with… | Patch early | 6.8 medium | 27.1% | 2003-10-06 |
| CVE-2017-18357 EXP | Shopware before 5.3.4 has a PHP Object Instantiation issue via the sort parameter to the loadPreviewAction() method of the Shopware_Controllers_Backen… | Patch early | 6.5 medium | 27.1% | 2019-01-15 |
| CVE-2005-0468 EXP | Heap-based buffer overflow in the env_opt_add function in telnet.c for various BSD-based Telnet clients allows remote attackers to execute arbitrary c… | Patch early | 7.5 high | 27.1% | 2005-05-02 |
| CVE-2018-14665 EXP | A flaw was found in xorg-x11-server before 1.20.3. An incorrect permission check for -modulepath and -logfile options when starting Xorg. X server all… | Patch early | 6.6 medium | 27% | 2018-10-25 |
| CVE-2013-6719 EXP | delivery.php in the Passive Capture Application (PCA) web console in IBM Tealeaf CX 7.x, 8.x through 8.6, 8.7 before FP2, and 8.8 before FP2 allows re… | Patch early | 6.0 medium | 27% | 2014-03-06 |
| CVE-2009-1551 EXP | Multiple PHP remote file inclusion vulnerabilities in Qt quickteam 2 allow remote attackers to execute arbitrary PHP code via a URL in the (1) qte_web… | Patch early | 7.5 high | 27% | 2009-05-06 |
| CVE-2019-16405 EXP | Centreon Web before 2.8.30, 18.10.x before 18.10.8, 19.04.x before 19.04.5 and 19.10.x before 19.10.2 allows Remote Code Execution by an administrator… | Patch early | 7.2 high | 27% | 2019-11-21 |
| CVE-2025-11001 EXP | 7-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code o… | Patch early | 7.8 high | 27% | 2025-11-19 |
| CVE-1999-1484 EXP | Buffer overflow in MSN Setup BBS 4.71.0.10 ActiveX control (setupbbs.ocx) allows a remote attacker to execute arbitrary commands via the methods (1) v… | Patch early | 7.5 high | 27% | 1999-09-24 |
| CVE-2006-5296 EXP | PowerPoint in Microsoft Office 2003 does not properly handle a container object whose position value exceeds the record length, which allows user-assi… | Patch early | 4.3 medium | 27% | 2006-10-16 |
| CVE-2004-0386 EXP | Buffer overflow in the HTTP parser for MPlayer 1.0pre3 and earlier, 0.90, and 0.91 allows remote attackers to execute arbitrary code via a long Locati… | Patch early | 10.0 high | 27% | 2004-05-04 |
| CVE-2003-0686 EXP | Buffer overflow in PAM SMB module (pam_smb) 1.1.6 and earlier, when authenticating to a remote service, allows remote attackers to execute arbitrary c… | Patch early | 7.5 high | 27% | 2003-10-20 |
| CVE-2010-4804 EXP | The Android browser in Android before 2.3.4 allows remote attackers to obtain SD card contents via crafted content:// URIs, related to (1) BrowserActi… | Patch early | 4.3 medium | 27% | 2011-06-09 |
| CVE-2016-4203 EXP | Adobe Reader and Acrobat before 11.0.17, Acrobat and Acrobat Reader DC Classic before 15.006.30198, and Acrobat and Acrobat Reader DC Continuous befor… | Patch early | 9.8 critical | 26.9% | 2016-07-13 |
| CVE-2020-35314 EXP | A remote code execution vulnerability in the installUpdateThemePluginAction function in index.php in WonderCMS 3.1.3, allows remote attackers to uploa… | Patch early | 9.8 critical | 26.9% | 2021-04-20 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt