CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
401,071 CVEs
1,733 on KEV
17,290 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-04
12,664 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2005-1628 EXP | apage.cgi in WebAPP 0.9.9.2.1, and possibly earlier versions, allows remote attackers to execute arbitrary commands via shell metacharacters in the f… | Patch early | 7.5 high | 10.6% | 2005-05-17 |
| CVE-2017-17095 EXP | tools/pal2rgb.c in pal2rgb in LibTIFF 4.0.9 allows remote attackers to cause a denial of service (TIFFSetupStrips heap-based buffer overflow and appli… | Patch early | 8.8 high | 10.6% | 2017-12-02 |
| CVE-2014-0683 EXP | The web management interface on the Cisco RV110W firewall with firmware 1.2.0.9 and earlier, RV215W router with firmware 1.1.0.5 and earlier, and CVR1… | Patch early | 10.0 high | 10.6% | 2014-03-06 |
| CVE-2000-0287 EXP | The BizDB CGI script bizdb-search.cgi allows remote attackers to execute arbitrary commands via shell metacharacters in the dbname parameter. | Patch early | 10.0 high | 10.6% | 2000-04-12 |
| CVE-2019-10969 EXP | Moxa EDR 810, all versions 5.1 and prior, allows an authenticated attacker to abuse the ping feature to execute unauthorized commands on the router, w… | Patch early | 7.2 high | 10.6% | 2019-10-08 |
| CVE-2015-4117 EXP | Vesta Control Panel before 0.9.8-14 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the backup parameter t… | Patch early | 8.8 high | 10.6% | 2018-02-28 |
| CVE-2001-1112 EXP | Buffer overflow in EFTP 2.0.7.337 allows remote attackers to execute arbitrary code by uploading a .lnk file containing a large number of characters. | Patch early | 7.5 high | 10.6% | 2001-09-12 |
| CVE-2002-0606 EXP | Buffer overflow in 3Cdaemon 2.0 FTP server allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via long c… | Patch early | 7.5 high | 10.6% | 2002-06-18 |
| CVE-2010-5301 EXP | Stack-based buffer overflow in Kolibri 2.0 allows remote attackers to execute arbitrary code via a long URI in a HEAD request. | Patch early | 7.5 high | 10.6% | 2014-06-13 |
| CVE-2013-6618 EXP | jsdm/ajax/port.php in J-Web in Juniper Junos before 10.4R13, 11.4 before 11.4R7, 12.1 before 12.1R5, 12.2 before 12.2R3, and 12.3 before 12.3R1 allows… | Patch early | 9.0 high | 10.6% | 2013-11-05 |
| CVE-2018-1756 EXP | IBM Security Identity Governance and Intelligence 5.2.3.2 and 5.2.4 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL… | Patch early | 7.5 high | 10.6% | 2018-09-07 |
| CVE-2002-1489 EXP | Buffer overflow in PlanetDNS PlanetWeb 1.14 and earlier allows remote attackers to execute arbitrary code via (1) an HTTP GET request with a long URL… | Patch early | 7.5 high | 10.6% | 2003-04-02 |
| CVE-2015-3205 EXP | libmimedir allows remote attackers to execute arbitrary code via a VCF file with two NULL bytes at the end of the file, related to "free" function cal… | Patch early | 7.5 high | 10.6% | 2015-06-16 |
| CVE-2021-27890 EXP | SQL Injection vulnerablity in MyBB before 1.8.26 via theme properties included in theme XML files. | Patch early | 8.8 high | 10.6% | 2021-03-15 |
| CVE-2009-2446 EXP | Multiple format string vulnerabilities in the dispatch_command function in libmysqld/sql_parse.cc in mysqld in MySQL 4.0.0 through 5.0.83 allow remote… | Patch early | 8.5 high | 10.6% | 2009-07-13 |
| CVE-2000-1053 EXP | Allaire JRun 2.3.3 server allows remote attackers to compile and execute JSP code by inserting it via a cross-site scripting (CSS) attack and directly… | Patch early | 10.0 high | 10.6% | 2000-12-11 |
| CVE-2007-1699 EXP | Multiple PHP remote file inclusion vulnerabilities in the SWmenu (com_swmenupro and com_swmenufree) 4.0 component for Mambo and Joomla! allow remote a… | Patch early | 10.0 high | 10.6% | 2007-03-27 |
| CVE-2019-9831 EXP | The AirMore application through 1.6.1 for Android allows remote attackers to cause a denial of service (system hang) via many simultaneous /?Key=Phone… | Patch early | 7.5 high | 10.6% | 2019-03-15 |
| CVE-2005-4556 EXP | PHP remote file include vulnerability in IceWarp Web Mail 5.5.1, as used by Merak Mail Server 8.3.0r and VisNetic Mail Server version 8.3.0 build 1, w… | Patch early | 7.5 high | 10.6% | 2005-12-28 |
| CVE-2015-6568 EXP | Wolf CMS before 0.8.3.1 allows unrestricted file rename and PHP Code Execution because admin/plugin/file_manager/browse/ (aka the filemanager) does no… | Patch early | 8.8 high | 10.6% | 2017-04-14 |
| CVE-2011-3575 EXP | Stack-based buffer overflow in the NSFComputeEvaluateExt function in Nnotes.dll in IBM Lotus Domino 8.5.2 allows remote authenticated users to execute… | Patch early | 9.0 high | 10.5% | 2011-09-19 |
| CVE-2018-12520 EXP | An issue was discovered in ntopng 3.4 before 3.4.180617. The PRNG involved in the generation of session IDs is not seeded at program startup. This res… | Patch early | 8.1 high | 10.5% | 2018-07-05 |
| CVE-2006-0720 EXP | Stack-based buffer overflow in Nullsoft Winamp 5.12 and 5.13 allows user-assisted attackers to cause a denial of service (crash) and possibly execute… | Patch early | 7.6 high | 10.5% | 2006-02-23 |
| CVE-2002-0252 EXP | Buffer overflow in Apple QuickTime Player 5.01 and 5.02 allows remote web servers to execute arbitrary code via a response containing a long Content-T… | Patch early | 7.5 high | 10.5% | 2002-05-29 |
| CVE-2006-6478 EXP | Multiple SQL injection vulnerabilities in AnnonceScriptHP 2.0 allow remote attackers to execute arbitrary SQL commands via the (1) id parameter in (a)… | Patch early | 7.5 high | 10.5% | 2006-12-12 |
| CVE-2006-0468 EXP | CommuniGate Pro Core Server before 5.0.7 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via LDAP mes… | Patch early | 7.5 high | 10.5% | 2006-01-30 |
| CVE-2000-0690 EXP | Auction Weaver CGI script 1.02 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the fromfile parameter. | Patch early | 10.0 high | 10.5% | 2000-10-20 |
| CVE-2008-4587 EXP | Insecure method vulnerability in the MSVNClientDownloadManager61Lib.DownloadManager.1 ActiveX control (ISDM.exe 6.1.100.61372) in Macrovision FLEXnet… | Patch early | 9.3 high | 10.5% | 2008-10-15 |
| CVE-2022-46552 EXP | D-Link DIR-846 Firmware FW100A53DBR was discovered to contain a remote command execution (RCE) vulnerability via the lan(0)_dhcps_staticlist parameter… | Patch early | 8.8 high | 10.5% | 2023-02-02 |
| CVE-2019-8518 EXP | Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, watchOS 5.2, Safari 12.1,… | Patch early | 8.8 high | 10.5% | 2019-12-18 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt