CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
401,074 CVEs
1,733 on KEV
17,290 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-04
12,664 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2001-0113 EXP | statsconfig.pl in OmniHTTPd 2.07 allows remote attackers to execute arbitrary commands via the mostbrowsers parameter, whose value is used as part of… | Patch early | 10.0 high | 10.4% | 2001-03-12 |
| CVE-2018-10123 EXP | p910nd on Inteno IOPSYS 2.0 through 4.2.0 allows remote attackers to read, or append data to, arbitrary files via requests on TCP port 9100. | Patch early | 8.8 high | 10.4% | 2018-05-16 |
| CVE-2011-1613 EXP | Unspecified vulnerability in Cisco Wireless LAN Controller (WLC) software 6.0 before 6.0.200.0, 7.0 before 7.0.98.216, and 7.0.1xx before 7.0.112.0 al… | Patch early | 7.8 high | 10.4% | 2011-05-03 |
| CVE-2018-4222 EXP | An issue was discovered in certain Apple products. iOS before 11.4 is affected. Safari before 11.1.1 is affected. iCloud before 7.5 on Windows is affe… | Patch early | 8.8 high | 10.4% | 2018-06-08 |
| CVE-2003-0729 EXP | Buffer overflow in Tellurian TftpdNT 1.8 allows remote attackers to execute arbitrary code via a TFTP request with a long filename. | Patch early | 7.5 high | 10.4% | 2003-10-20 |
| CVE-2005-0643 EXP | Buffer overflow in McAfee Scan Engine 4320 with DAT version before 4357 allows remote attackers to execute arbitrary code via crafted LHA files. | Patch early | 7.5 high | 10.4% | 2005-05-02 |
| CVE-2004-1254 EXP | WinRAR 3.40, and possibly earlier versions, allows remote attackers to execute arbitrary code via a ZIP file containing a file with a long filename, p… | Patch early | 10.0 high | 10.4% | 2005-01-10 |
| CVE-2008-0434 EXP | Format string vulnerability in the AXIMilter module in AXIGEN Mail Server 5.0.2 allows remote attackers to execute arbitrary code via format string sp… | Patch early | 9.3 high | 10.4% | 2008-01-23 |
| CVE-2019-9833 EXP | The Screen Stream application through 3.0.15 for Android allows remote attackers to cause a denial of service via many simultaneous /start-stop reques… | Patch early | 7.5 high | 10.3% | 2019-03-15 |
| CVE-2009-1671 EXP | Multiple buffer overflows in the Deployment Toolkit ActiveX control in deploytk.dll 6.0.130.3 in Sun Java SE Runtime Environment (aka JRE) 6 Update 13… | Patch early | 9.3 high | 10.3% | 2009-05-18 |
| CVE-2008-4910 EXP | The BasicService in Sun Java Web Start allows remote attackers to execute arbitrary programs on a client machine via a file:// URL argument to the sho… | Patch early | 10.0 high | 10.3% | 2008-11-04 |
| CVE-2012-3814 EXP | Unrestricted file upload vulnerability in font-upload.php in the Font Uploader plugin 1.2.4 for WordPress allows remote attackers to execute arbitrary… | Patch early | 7.5 high | 10.3% | 2012-06-27 |
| CVE-2015-2281 EXP | Stack-based buffer overflow in collectoragent.exe in Fortinet Single Sign On (FSSO) before build 164 allows remote attackers to execute arbitrary code… | Patch early | 7.5 high | 10.3% | 2015-03-19 |
| CVE-2007-0900 EXP | Multiple PHP remote file inclusion vulnerabilities in TagIt! Tagboard 2.1.B Build 2 and earlier, when register_globals is enabled, allow remote attack… | Patch early | 7.5 high | 10.3% | 2007-02-13 |
| CVE-2009-1020 EXP | Unspecified vulnerability in the Network Foundation component in Oracle Database 9.2.0.8, 9.2.0.8DV, 10.1.0.5, 10.2.0.4, and 11.1.0.7 allows remote au… | Patch early | 9.0 high | 10.3% | 2009-07-14 |
| CVE-2007-3334 EXP | Multiple heap-based buffer overflows in the (1) Communications Server (iigcc.exe) and (2) Data Access Server (iigcd.exe) components for Ingres Databas… | Patch early | 10.0 high | 10.3% | 2007-06-21 |
| CVE-2005-0129 EXP | The Quick Buttons feature in Konversation 0.15 allows remote attackers to execute certain IRC commands via a channel name containing "%" variables, wh… | Patch early | 7.5 high | 10.3% | 2005-04-14 |
| CVE-2005-3404 EXP | Multiple PHP file inclusion vulnerabilities in ATutor 1.4.1 through 1.5.1-pl1 allow remote attackers to include arbitrary files via the section parame… | Patch early | 7.5 high | 10.3% | 2005-11-01 |
| CVE-2002-1560 EXP | index.php in gBook 1.4 allows remote attackers to bypass authentication and gain administrative privileges by setting the login parameter to true. | Patch early | 10.0 high | 10.3% | 2003-03-31 |
| CVE-2005-2250 EXP | Buffer overflow in Bluetooth FTP client (BTFTP) in Nokia Affix 2.1.2 and 3.2.0 allows remote attackers to execute arbitrary code via a long filename i… | Patch early | 7.5 high | 10.3% | 2005-07-13 |
| CVE-2009-1916 EXP | dig.php in GScripts.net DNS Tools allows remote attackers to execute arbitrary commands via shell metacharacters in the ns parameter. | Patch early | 10.0 high | 10.3% | 2009-06-04 |
| CVE-2008-4138 EXP | PHP remote file inclusion vulnerability in skin_shop/standard/3_plugin_twindow/twindow_notice.php in TECHNOTE 7 allows remote attackers to execute arb… | Patch early | 10.0 high | 10.3% | 2008-09-24 |
| CVE-2018-4314 EXP | A use after free issue was addressed with improved memory management. This issue affected versions prior to iOS 12, tvOS 12, Safari 12, iTunes 12.9 fo… | Patch early | 8.8 high | 10.3% | 2019-04-03 |
| CVE-2013-3612 EXP | Dahua DVR appliances have a hardcoded password for (1) the root account and (2) an unspecified "backdoor" account, which makes it easier for remote at… | Patch early | 10.0 high | 10.3% | 2013-09-17 |
| CVE-2017-8770 EXP | There is LFD (local file disclosure) on BE126 WIFI repeater 1.0 devices that allows attackers to read the entire filesystem on the device via a crafte… | Patch early | 7.5 high | 10.3% | 2017-09-20 |
| CVE-2011-3495 EXP | Multiple directory traversal vulnerabilities in service.exe in Measuresoft ScadaPro 4.0.0 and earlier allow remote attackers to read, modify, or delet… | Patch early | 10.0 high | 10.3% | 2011-09-16 |
| CVE-2006-4670 EXP | Multiple PHP remote file inclusion vulnerabilities in PhotoKorn Gallery 1.52 and earlier allow remote attackers to execute arbitrary PHP code via a UR… | Patch early | 7.5 high | 10.3% | 2006-09-09 |
| CVE-2006-5518 EXP | Multiple PHP remote file inclusion vulnerabilities in Christopher Fowler (Rhode Island) RSSonate allow remote attackers to execute arbitrary PHP code… | Patch early | 7.5 high | 10.3% | 2006-10-26 |
| CVE-2007-0167 EXP | Multiple PHP file inclusion vulnerabilities in WGS-PPC (aka PPC Search Engine), as distributed with other aliases, allow remote attackers to execute a… | Patch early | 7.5 high | 10.3% | 2007-01-10 |
| CVE-2013-6884 EXP | The write-blocker in CRU Ditto Forensic FieldStation with firmware before 2013Oct15a has a default "ditto" username and password, which allows remote… | Patch early | 10.0 high | 10.3% | 2014-01-07 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt