CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
400,941 CVEs
1,733 on KEV
17,286 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-02
25,091 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2013-3568 EXP | Cross-site request forgery (CSRF) vulnerability in Cisco Linksys WRT110 allows remote attackers to hijack the authentication of users for requests tha… | Patch early | 8.8 high | 25.1% | 2020-02-06 |
| CVE-2006-7210 EXP | Microsoft Windows 2000, XP, and Server 2003 allows remote attackers to cause a denial of service (cpu consumption) via a PNG image with crafted (1) Wi… | Patch early | 5.0 medium | 25.1% | 2007-06-27 |
| CVE-2017-11906 EXP | Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, and Windows… | Patch early | 5.3 medium | 25.1% | 2017-12-12 |
| CVE-2003-0411 EXP | Sun ONE Application Server 7.0 for Windows 2000/XP allows remote attackers to obtain JSP source code via a request that uses the uppercase ".JSP" exte… | Patch early | 7.5 high | 25.1% | 2003-06-30 |
| CVE-2012-1226 EXP | Multiple directory traversal vulnerabilities in Dolibarr CMS 3.2.0 Alpha allow remote attackers to read arbitrary files and possibly execute arbitrary… | Patch early | 7.5 high | 25.1% | 2012-02-21 |
| CVE-2004-0557 EXP | Multiple buffer overflows in the st_wavstartread function in wav.c for Sound eXchange (SoX) 12.17.2 through 12.17.4 allow remote attackers to execute… | Patch early | 10.0 high | 25.1% | 2004-08-06 |
| CVE-2016-1001 EXP | Heap-based buffer overflow in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577… | Patch early | 8.8 high | 25.1% | 2016-03-12 |
| CVE-2014-5006 EXP | Directory traversal vulnerability in ZOHO ManageEngine Desktop Central (DC) before 9 build 90055 allows remote attackers to execute arbitrary code via… | Patch early | 7.5 high | 25.1% | 2014-10-21 |
| CVE-2017-2930 EXP | Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable memory corruption vulnerability due to a concurrency error when manipulating a… | Patch early | 8.8 high | 25.1% | 2017-01-11 |
| CVE-2018-12617 EXP | qmp_guest_file_read in qga/commands-posix.c and qga/commands-win32.c in qemu-ga (aka QEMU Guest Agent) in QEMU 2.12.50 has an integer overflow causing… | Patch early | 7.5 high | 25.1% | 2018-06-21 |
| CVE-2013-3115 EXP | Microsoft Internet Explorer 7 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf… | Patch early | 9.3 high | 25% | 2013-07-10 |
| CVE-2013-3145 EXP | Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web sit… | Patch early | 9.3 high | 25% | 2013-07-10 |
| CVE-2013-3147 EXP | Microsoft Internet Explorer 6 through 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craft… | Patch early | 9.3 high | 25% | 2013-07-10 |
| CVE-2013-3148 EXP | Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf… | Patch early | 9.3 high | 25% | 2013-07-10 |
| CVE-2013-3149 EXP | Microsoft Internet Explorer 7 and 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted w… | Patch early | 9.3 high | 25% | 2013-07-10 |
| CVE-2013-3150 EXP | Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web sit… | Patch early | 9.3 high | 25% | 2013-07-10 |
| CVE-2013-3153 EXP | Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf… | Patch early | 9.3 high | 25% | 2013-07-10 |
| CVE-2013-3161 EXP | Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted… | Patch early | 9.3 high | 25% | 2013-07-10 |
| CVE-2013-3162 EXP | Microsoft Internet Explorer 7 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf… | Patch early | 9.3 high | 25% | 2013-07-10 |
| CVE-2019-3948 EXP | The Amcrest IP2M-841B V2.520.AC00.18.R, Dahua IPC-XXBXX V2.622.0000000.9.R, Dahua IPC HX5X3X and HX4X3X V2.800.0000008.0.R, Dahua DH-IPC HX883X and DH… | Patch early | 7.5 high | 25% | 2019-07-29 |
| CVE-2010-3324 EXP | The toStaticHTML function in Microsoft Internet Explorer 8, and the SafeHTML function in Microsoft Windows SharePoint Services 3.0 SP2, SharePoint Fou… | Patch early | 4.3 medium | 25% | 2010-09-17 |
| CVE-2016-3216 EXP | GDI32.dll in the Graphics component in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 201… | Patch early | 4.3 medium | 25% | 2016-06-16 |
| CVE-2007-1910 EXP | Buffer overflow in wwlib.dll in Microsoft Word 2007 allows remote attackers to cause a denial of service (application crash) and possibly execute arbi… | Patch early | 6.8 medium | 24.9% | 2007-04-10 |
| CVE-2020-35948 EXP | An issue was discovered in the XCloner Backup and Restore plugin before 4.2.13 for WordPress. It gave authenticated attackers the ability to modify ar… | Patch early | 9.9 critical | 24.9% | 2021-01-01 |
| CVE-2011-1965 EXP | Tcpip.sys in the TCP/IP stack in Microsoft Windows 7 Gold and SP1 and Windows Server 2008 R2 and R2 SP1 does not properly implement URL-based QoS, whi… | Patch early | 7.1 high | 24.9% | 2011-08-10 |
| CVE-2012-1205 EXP | PHP remote file inclusion vulnerability in relocate-upload.php in Relocate Upload plugin before 0.20 for WordPress allows remote attackers to execute… | Patch early | 7.5 high | 24.9% | 2012-02-24 |
| CVE-2010-2561 EXP | Microsoft XML Core Services (aka MSXML) 3.0 does not properly handle HTTP responses, which allows remote attackers to execute arbitrary code or cause… | Patch early | 9.3 high | 24.9% | 2010-08-11 |
| CVE-2004-0084 EXP | Buffer overflow in the ReadFontAlias function in XFree86 4.1.0 to 4.3.0, when using the CopyISOLatin1Lowered function, allows local or remote authenti… | Patch early | 10.0 high | 24.9% | 2004-03-03 |
| CVE-2019-1914 EXP | A vulnerability in the web management interface of Cisco Small Business 220 Series Smart Switches could allow an authenticated, remote attacker to per… | Patch early | 7.2 high | 24.9% | 2019-08-07 |
| CVE-1999-0725 EXP | When IIS is run with a default language of Chinese, Korean, or Japanese, it allows a remote attacker to view the source code of certain files, a.k.a.… | Patch early | 7.1 high | 24.9% | 1999-08-19 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt