CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
400,921 CVEs
1,733 on KEV
17,286 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-02
25,091 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2024-24724 EXP | Gibbon through 26.0.00 allows /modules/School%20Admin/messengerSettings.php Server Side Template Injection leading to Remote Code Execution because in… | Patch early | 9.8 critical | 26.1% | 2024-04-03 |
| CVE-2016-0985 EXP | Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0… | Patch early | 8.8 high | 26.1% | 2016-02-10 |
| CVE-2014-2314 EXP | Directory traversal vulnerability in the Issue Collector plugin in Atlassian JIRA before 6.0.4 allows remote attackers to create arbitrary files via u… | Patch early | 4.3 medium | 26.1% | 2014-03-09 |
| CVE-2012-5692 EXP | Unspecified vulnerability in admin/sources/base/core.php in Invision Power Board (aka IPB or IP.Board) 3.1.x through 3.3.x has unknown impact and remo… | Patch early | 10.0 high | 26% | 2012-10-31 |
| CVE-2013-2097 EXP | ZPanel through 10.1.0 has Remote Command Execution | Patch early | 7.8 high | 26% | 2020-02-12 |
| CVE-2011-2179 EXP | Multiple cross-site scripting (XSS) vulnerabilities in config.c in config.cgi in (1) Nagios 3.2.3 and (2) Icinga before 1.4.1 allow remote attackers t… | Patch early | 4.3 medium | 26% | 2011-06-14 |
| CVE-2018-0708 EXP | Command injection vulnerability in networking of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated users to run a… | Patch early | 8.8 high | 26% | 2018-07-17 |
| CVE-2016-1011 EXP | Use-after-free vulnerability in Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.6… | Patch early | 8.8 high | 26% | 2016-04-09 |
| CVE-2003-0107 EXP | Buffer overflow in the gzprintf function in zlib 1.1.4, when zlib is compiled without vsnprintf or when long inputs are truncated using vsnprintf, all… | Patch early | 7.5 high | 26% | 2003-03-07 |
| CVE-1999-0045 EXP | List of arbitrary files on Web host via nph-test-cgi script. | Patch early | 7.5 high | 26% | 1996-12-10 |
| CVE-2019-1913 EXP | Multiple vulnerabilities in the web management interface of Cisco Small Business 220 Series Smart Switches could allow an unauthenticated, remote atta… | Patch early | 9.8 critical | 25.9% | 2019-08-07 |
| CVE-2003-0908 EXP | The Utility Manager in Microsoft Windows 2000 executes winhlp32.exe with system privileges, which allows local users to execute arbitrary code via a "… | Patch early | 7.2 high | 25.9% | 2004-06-01 |
| CVE-2018-15152 EXP | Authentication bypass vulnerability in portal/account/register.php in versions of OpenEMR before 5.0.1.4 allows a remote attacker to access (1) portal… | Patch early | 9.1 critical | 25.9% | 2018-08-15 |
| CVE-2019-19368 EXP | A Reflected Cross Site Scripting was discovered in the Login page of Rumpus FTP Web File Manager 8.2.9.1. An attacker can exploit it by sending a craf… | Patch early | 6.1 medium | 25.9% | 2019-12-16 |
| CVE-2000-0830 EXP | annclist.exe in webTV for Windows allows remote attackers to cause a denial of service by via a large, malformed UDP packet to ports 22701 through 227… | Patch early | 5.0 medium | 25.9% | 2000-11-14 |
| CVE-2024-24494 EXP | Cross Site Scripting vulnerability in Daily Habit Tracker v.1.0 allows a remote attacker to execute arbitrary code via the day, exercise, pray, read_b… | Patch early | 6.1 medium | 25.9% | 2024-02-08 |
| CVE-2019-16072 EXP | An OS command injection vulnerability in the discover_and_manage CGI script in NETSAS Enigma NMS 65.0.0 and prior allows an attacker to execute arbitr… | Patch early | 9.8 critical | 25.9% | 2020-03-20 |
| CVE-2009-1523 EXP | Directory traversal vulnerability in the HTTP server in Mort Bay Jetty 5.1.14, 6.x before 6.1.17, and 7.x through 7.0.0.M2 allows remote attackers to… | Patch early | 5.0 medium | 25.8% | 2009-05-05 |
| CVE-2006-3081 EXP | mysqld in MySQL 4.1.x before 4.1.18, 5.0.x before 5.0.19, and 5.1.x before 5.1.6 allows remote authorized users to cause a denial of service (crash) v… | Patch early | 4.0 medium | 25.8% | 2006-06-19 |
| CVE-1999-0236 EXP | ScriptAlias directory in NCSA and Apache httpd allowed attackers to read CGI programs. | Patch early | 7.5 high | 25.8% | 1997-01-01 |
| CVE-2008-4800 EXP | The DebugDiag ActiveX control in CrashHangExt.dll, possibly 1.0, in Microsoft Debug Diagnostic Tool allows remote attackers to cause a denial of servi… | Patch early | 5.0 medium | 25.8% | 2008-10-31 |
| CVE-2009-0692 EXP | Stack-based buffer overflow in the script_write_params method in client/dhclient.c in ISC DHCP dhclient 4.1 before 4.1.0p1, 4.0 before 4.0.1p1, 3.1 be… | Patch early | 10.0 high | 25.8% | 2009-07-14 |
| CVE-2019-13359 EXP | In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.836, a cwpsrv-xxx cookie allows a normal user to craft and upload a session file to the /tmp d… | Patch early | 7.5 high | 25.8% | 2019-07-16 |
| CVE-2021-25162 EXP | A remote execution of arbitrary commands vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6… | Patch early | 8.1 high | 25.8% | 2021-03-30 |
| CVE-2002-1712 EXP | Microsoft Windows 2000 allows remote attackers to cause a denial of service (memory consumption) by sending a flood of empty TCP/IP packets with the A… | Patch early | 5.0 medium | 25.8% | 2002-12-31 |
| CVE-2002-1131 EXP | Cross-site scripting vulnerabilities in SquirrelMail 1.2.7 and earlier allows remote attackers to execute script as other web users via (1) addressboo… | Patch early | 7.5 high | 25.8% | 2002-10-04 |
| CVE-2004-0479 EXP | Internet Explorer 6 allows remote attackers to cause a denial of service (crash) via Javascript that creates a new popup window and disables the image… | Patch early | 5.0 medium | 25.8% | 2004-07-07 |
| CVE-2011-3315 EXP | Directory traversal vulnerability in Cisco Unified Communications Manager (CUCM) 5.x and 6.x before 6.1(5)SU2, 7.x before 7.1(5b)SU2, and 8.x before 8… | Patch early | 7.8 high | 25.7% | 2011-10-27 |
| CVE-2005-3745 EXP | Cross-site scripting (XSS) vulnerability in Apache Struts 1.2.7, and possibly other versions allows remote attackers to inject arbitrary web script or… | Patch early | 4.3 medium | 25.7% | 2005-11-22 |
| CVE-2018-4935 EXP | Adobe Flash Player versions 29.0.0.113 and earlier have an exploitable out-of-bounds write vulnerability. Successful exploitation could lead to arbitr… | Patch early | 8.8 high | 25.7% | 2018-05-19 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt