CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
401,069 CVEs
1,733 on KEV
17,290 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-04
12,664 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2008-4434 EXP | Stack-based buffer overflow in (1) uTorrent 1.7.7 build 8179 and earlier and (2) BitTorrent 6.0.3 build 8642 and earlier allows remote attackers to ca… | Patch early | 9.3 high | 11% | 2008-10-03 |
| CVE-2020-13144 EXP | Studio in Open edX Ironwood 2.5, when CodeJail is not used, allows a user to go to the "Create New course>New section>New subsection>New unit>Add new… | Patch early | 8.8 high | 11% | 2020-05-18 |
| CVE-2002-0516 EXP | SquirrelMail 1.2.5 and earlier allows authenticated SquirrelMail users to execute arbitrary commands by modifying the THEME variable in a cookie. | Patch early | 10.0 high | 11% | 2002-08-12 |
| CVE-2020-11060 EXP | In GLPI before 9.4.6, an attacker can execute system commands by abusing the backup functionality. Theoretically, this vulnerability can be exploited… | Patch early | 7.4 high | 10.9% | 2020-05-12 |
| CVE-2006-4656 EXP | PHP remote file inclusion vulnerability in admin/editeur/spaw_control.class.php in Web Provence SL_Site 1.0 and earlier allows remote attackers to exe… | Patch early | 7.5 high | 10.9% | 2006-09-09 |
| CVE-2010-3145 EXP | Untrusted search path vulnerability in the BitLocker Drive Encryption API, as used in sdclt.exe in Backup Manager in Microsoft Windows Vista SP1 and S… | Patch early | 9.3 high | 10.9% | 2010-08-27 |
| CVE-2009-0367 EXP | The Python AI module in Wesnoth 1.4.x and 1.5 before 1.5.11 allows remote attackers to escape the sandbox and execute arbitrary code by using a whitel… | Patch early | 9.3 high | 10.9% | 2009-03-05 |
| CVE-2010-0049 EXP | Use-after-free vulnerability in WebKit in Apple Safari before 4.0.5 allows remote attackers to execute arbitrary code or cause a denial of service (ap… | Patch early | 9.3 high | 10.9% | 2010-03-15 |
| CVE-2009-3250 EXP | The saveForwardAttachments procedure in the Compose Mail functionality in vtiger CRM 5.0.4 allows remote authenticated users to execute arbitrary code… | Patch early | 9.0 high | 10.9% | 2009-09-18 |
| CVE-2000-0059 EXP | PHP3 with safe_mode enabled does not properly filter shell metacharacters from commands that are executed by popen, which could allow remote attackers… | Patch early | 10.0 high | 10.9% | 2000-01-04 |
| CVE-2007-5709 EXP | Stack-based buffer overflow in Sony SonicStage CONNECT Player (CP) 4.3 allows remote attackers to execute arbitrary code via a long file name in an M3… | Patch early | 9.3 high | 10.9% | 2007-10-30 |
| CVE-2005-0862 EXP | Multiple PHP remote file inclusion vulnerabilities in PHPOpenChat 3.0.1 and earlier allow remote attackers to execute arbitrary PHP code via the phpbb… | Patch early | 7.5 high | 10.9% | 2005-05-02 |
| CVE-2004-0777 EXP | Format string vulnerability in the auth_debug function in Courier-IMAP 1.6.0 through 2.2.1 and 3.x through 3.0.3, when login debugging (DEBUG_LOGIN) i… | Patch early | 7.5 high | 10.9% | 2004-10-20 |
| CVE-2018-12053 EXP | Arbitrary File Deletion exists in PHP Scripts Mall Schools Alert Management Script via the img parameter in delete_img.php by using directory traversa… | Patch early | 7.5 high | 10.9% | 2018-06-08 |
| CVE-2009-1800 EXP | Stack-based buffer overflow in the Chinagames CGAgent ActiveX control 1.x in CGAgent.dll, as distributed in Chinagames iGame 2009, allows remote attac… | Patch early | 7.5 high | 10.9% | 2009-05-28 |
| CVE-2003-0849 EXP | Buffer overflow in net.c for cfengine 2.x before 2.0.8 allows remote attackers to execute arbitrary code via certain packets with modified length valu… | Patch early | 7.5 high | 10.9% | 2003-11-17 |
| CVE-2009-2254 EXP | Zen Cart 1.3.8a, 1.3.8, and earlier does not require administrative authentication for admin/sqlpatch.php, which allows remote attackers to execute ar… | Patch early | 7.5 high | 10.9% | 2009-06-30 |
| CVE-2000-0191 EXP | Axis StorPoint CD allows remote attackers to access administrator URLs without authentication via a .. (dot dot) attack. | Patch early | 10.0 high | 10.9% | 2000-02-29 |
| CVE-2021-25681 EXP | AdTran Personal Phone Manager 10.8.1 software is vulnerable to an issue that allows for exfiltration of data over DNS. This could allow for exposed Ad… | Patch early | 7.5 high | 10.9% | 2021-04-20 |
| CVE-2004-2291 EXP | Microsoft Windows Internet Explorer 5.5 and 6.0 allows remote attackers to execute arbitrary code via an embedded script that uses Shell Helper object… | Patch early | 7.5 high | 10.9% | 2004-12-31 |
| CVE-2014-8656 EXP | The Compal Broadband Networks (CBN) CH6640E and CG6640E Wireless Gateway 1.0 with firmware CH6640-3.5.11.7-NOSH have a default password of (1) admin f… | Patch early | 10.0 high | 10.9% | 2014-11-06 |
| CVE-2016-8371 EXP | The web server in Phoenix Contact ILC PLCs can be accessed without authenticating even if the authentication mechanism is enabled. | Patch early | 7.3 high | 10.9% | 2018-04-05 |
| CVE-2016-8380 EXP | The web server in Phoenix Contact ILC PLCs allows access to read and write PLC variables without authentication. | Patch early | 7.3 high | 10.9% | 2018-04-05 |
| CVE-2009-3382 EXP | layout/base/nsCSSFrameConstructor.cpp in the browser engine in Mozilla Firefox 3.0.x before 3.0.15 does not properly handle first-letter frames, which… | Patch early | 10.0 high | 10.8% | 2009-10-29 |
| CVE-2009-2753 EXP | Multiple buffer overflows in the authentication functionality in librpc.dll in the Informix Storage Manager (ISM) Portmapper service (aka portmap.exe)… | Patch early | 10.0 high | 10.8% | 2010-03-05 |
| CVE-2015-6567 EXP | Wolf CMS before 0.8.3.1 allows unrestricted file upload and PHP Code Execution because admin/plugin/file_manager/browse/ (aka the filemanager) does no… | Patch early | 8.8 high | 10.8% | 2017-04-14 |
| CVE-2005-3243 EXP | Multiple buffer overflows in Ethereal 0.10.12 and earlier might allow remote attackers to execute arbitrary code via unknown vectors in the (1) SLIMP3… | Patch early | 7.5 high | 10.8% | 2005-10-27 |
| CVE-2017-3006 EXP | Adobe Thor versions 3.9.5.353 and earlier have a vulnerability related to the use of improper resource permissions during the installation of Creative… | Patch early | 8.8 high | 10.8% | 2017-04-12 |
| CVE-2001-1130 EXP | Sdbsearch.cgi in SuSE Linux 6.0-7.2 could allow remote attackers to execute arbitrary commands by uploading a keylist.txt file that contains filenames… | Patch early | 7.5 high | 10.8% | 2001-08-02 |
| CVE-2007-6485 EXP | Multiple PHP remote file inclusion vulnerabilities in Centreon 1.4.1 (aka Oreon 1.4) allow remote attackers to execute arbitrary PHP code via a URL in… | Patch early | 7.5 high | 10.8% | 2007-12-20 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt