CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
400,959 CVEs
1,733 on KEV
17,286 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-03
25,091 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2011-4542 EXP | Hastymail2 2.1.1 before RC2 allows remote attackers to execute arbitrary commands via the (1) rs or (2) rsargs[] parameter in a mailbox Drafts action… | Patch early | 7.5 high | 24.1% | 2011-11-30 |
| CVE-2011-3625 EXP | Stack-based buffer overflow in the sub_read_line_sami function in subreader.c in MPlayer, as used in SMPlayer 0.6.9, allows remote attackers to cause… | Patch early | 9.3 high | 24.1% | 2014-06-11 |
| CVE-2015-5468 EXP | Directory traversal vulnerability in the WP e-Commerce Shop Styling plugin before 2.6 for WordPress allows remote attackers to read arbitrary files vi… | Patch early | 7.5 high | 24.1% | 2017-05-23 |
| CVE-2024-25830 EXP | F-logic DataCube3 v1.0 is vulnerable to Incorrect Access Control due to an improper directory access restriction. An unauthenticated, remote attacker… | Patch early | 9.8 critical | 24% | 2024-02-29 |
| CVE-2002-1317 EXP | Buffer overflow in Dispatch() routine for XFS font server (fs.auto) on Solaris 2.5.1 through 9 allows remote attackers to cause a denial of service (c… | Patch early | 7.5 high | 24% | 2002-12-11 |
| CVE-2017-8798 EXP | Integer signedness error in MiniUPnP MiniUPnPc v1.4.20101221 through v2.0 allows remote attackers to cause a denial of service or possibly have unspec… | Patch early | 9.8 critical | 24% | 2017-05-11 |
| CVE-2006-3101 EXP | Cross-site scripting (XSS) vulnerability in LogonProxy.cgi in Cisco Secure ACS for UNIX 2.3 allows remote attackers to inject arbitrary web script or… | Patch early | 4.3 medium | 24% | 2006-06-21 |
| CVE-2006-4071 EXP | Sign extension vulnerability in the createBrushIndirect function in the GDI library (gdi32.dll) in Microsoft Windows XP, Server 2003, and possibly oth… | Patch early | 2.6 low | 24% | 2006-08-10 |
| CVE-2016-2819 EXP | Heap-based buffer overflow in Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2 allows remote attackers to execute arbitrary code via forei… | Patch early | 8.8 high | 24% | 2016-06-13 |
| CVE-2002-0461 EXP | Internet Explorer 5.01 through 6 allows remote attackers to cause a denial of service (application crash) via Javascript in a web page that calls loca… | Patch early | 5.0 medium | 24% | 2002-08-12 |
| CVE-2012-5611 EXP | Stack-based buffer overflow in the acl_get function in Oracle MySQL 5.5.19 and other versions through 5.5.28, and 5.1.53 and other versions through 5.… | Patch early | 6.5 medium | 24% | 2012-12-03 |
| CVE-2021-46418 EXP | An unauthorized file creation vulnerability in Telesquare TLR-2855KS6 via PUT method can allow creation of CGI scripts. | Patch early | 7.5 high | 23.9% | 2022-04-07 |
| CVE-2014-8322 EXP | Stack-based buffer overflow in the tcp_test function in aireplay-ng.c in Aircrack-ng before 1.2 RC 1 allows remote attackers to execute arbitrary code… | Patch early | 9.8 critical | 23.9% | 2020-01-31 |
| CVE-2024-27356 EXP | An issue was discovered on certain GL-iNet devices. Attackers can download files such as logs via commands, potentially obtaining critical user inform… | Patch early | 7.5 high | 23.9% | 2024-02-27 |
| CVE-2018-12453 EXP | Type confusion in the xgroupCommand function in t_stream.c in redis-server in Redis before 5.0 allows remote attackers to cause denial-of-service via… | Patch early | 7.5 high | 23.9% | 2018-06-16 |
| CVE-2022-24630 EXP | An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. BrowseFiles.php allows a ?cmd=ssh POST request with an ssh_comma… | Patch early | 7.2 high | 23.9% | 2023-05-29 |
| CVE-2017-5972 EXP | The TCP stack in the Linux kernel 3.x does not properly implement a SYN cookie protection mechanism for the case of a fast network connection, which a… | Patch early | 7.5 high | 23.9% | 2017-02-14 |
| CVE-2007-2293 EXP | Multiple stack-based buffer overflows in the process_sdp function in chan_sip.c of the SIP channel T.38 SDP parser in Asterisk before 1.4.3 allow remo… | Patch early | 7.6 high | 23.9% | 2007-04-26 |
| CVE-2004-0552 EXP | Sophos Small Business Suite 1.00 on Windows does not properly handle files whose names contain reserved MS-DOS device names such as (1) LPT1, (2) COM1… | Patch early | 7.5 high | 23.9% | 2004-11-03 |
| CVE-2003-0015 EXP | Double-free vulnerability in CVS 1.11.4 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via a mal… | Patch early | 7.5 high | 23.9% | 2003-02-07 |
| CVE-2012-1661 EXP | ESRI ArcMap 9 and ArcGIS 10.0.2.3200 and earlier does not properly prompt users before executing embedded VBA macros, which allows user-assisted remot… | Patch early | 9.3 high | 23.8% | 2012-07-12 |
| CVE-2010-2745 EXP | Microsoft Windows Media Player (WMP) 9 through 12 does not properly deallocate objects during a browser reload action, which allows user-assisted remo… | Patch early | 9.3 high | 23.8% | 2010-10-13 |
| CVE-2020-9467 EXP | Piwigo 2.10.1 has stored XSS via the file parameter in a /ws.php request because of the pwg.images.setInfo function. | Patch early | 5.4 medium | 23.8% | 2020-03-26 |
| CVE-2015-0081 EXP | Windows Text Services (WTS) in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Win… | Patch early | 9.3 high | 23.8% | 2015-03-11 |
| CVE-2012-5469 EXP | The Portable phpMyAdmin plugin before 1.3.1 for WordPress allows remote attackers to bypass authentication and obtain phpMyAdmin console access via a… | Patch early | 7.5 high | 23.7% | 2012-12-20 |
| CVE-2019-9624 EXP | Webmin 1.900 allows remote attackers to execute arbitrary code by leveraging the "Java file manager" and "Upload and Download" privileges to upload a… | Patch early | 7.8 high | 23.7% | 2019-03-07 |
| CVE-2017-17058 EXP | The WooCommerce plugin through 3.x for WordPress has a Directory Traversal Vulnerability via a /wp-content/plugins/woocommerce/templates/emails/plain/… | Patch early | 7.5 high | 23.7% | 2017-11-29 |
| CVE-2020-24219 EXP | An issue was discovered on URayTech IPTV/H.264/H.265 video encoders through 1.97. Attackers can send crafted unauthenticated HTTP requests to exploit… | Patch early | 7.5 high | 23.6% | 2020-10-06 |
| CVE-2001-0205 EXP | Directory traversal vulnerability in AOLserver 3.2 and earlier allows remote attackers to read arbitrary files by inserting "..." into the requested p… | Patch early | 5.0 medium | 23.6% | 2001-05-03 |
| CVE-2014-8147 EXP | The resolveImplicitLevels function in common/ubidi.c in the Unicode Bidirectional Algorithm implementation in ICU4C in International Components for Un… | Patch early | 7.5 high | 23.6% | 2015-05-25 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt