CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
401,014 CVEs
1,733 on KEV
17,286 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-03
25,091 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2023-48292 EXP | The XWiki Admin Tools Application provides tools to help the administration of XWiki. Starting in version 4.4 and prior to version 4.5.1, a cross site… | Patch early | 9.6 critical | 22.9% | 2023-11-20 |
| CVE-2017-8652 EXP | Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to disclose information due to the way that… | Patch early | 6.5 medium | 22.9% | 2017-08-08 |
| CVE-2000-0887 EXP | named in BIND 8.2 through 8.2.2-P6 allows remote attackers to cause a denial of service by making a compressed zone transfer (ZXFR) request and perfor… | Patch early | 5.0 medium | 22.9% | 2000-12-19 |
| CVE-2021-44596 EXP | Wondershare LTD Dr. Fone as of 2021-12-06 version is affected by Remote code execution. Due to software design flaws an unauthenticated user can commu… | Patch early | 9.8 critical | 22.9% | 2022-04-29 |
| CVE-2025-24071 EXP | Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an unauthorized attacker to perform spoofing over a network… | Patch early | 6.5 medium | 22.9% | 2025-03-11 |
| CVE-2007-5133 EXP | Microsoft Windows Explorer (explorer.exe) allows user-assisted remote attackers to cause a denial of service (CPU consumption) via a certain PNG file… | Patch early | 7.1 high | 22.9% | 2007-09-27 |
| CVE-2022-28117 EXP | A Server-Side Request Forgery (SSRF) in feed_parser class of Navigate CMS v2.9.4 allows remote attackers to force the application to make arbitrary re… | Patch early | 4.9 medium | 22.9% | 2022-04-28 |
| CVE-2019-8195 EXP | Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and earlier, an… | Patch early | 9.8 critical | 22.9% | 2019-10-17 |
| CVE-2019-8196 EXP | Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and earlier, an… | Patch early | 9.8 critical | 22.9% | 2019-10-17 |
| CVE-2010-3131 EXP | Untrusted search path vulnerability in Mozilla Firefox before 3.5.12 and 3.6.x before 3.6.9, Thunderbird before 3.0.7 and 3.1.x before 3.1.3, and SeaM… | Patch early | 9.3 high | 22.9% | 2010-08-26 |
| CVE-2017-0781 EXP | A remote code execution vulnerability in the Android system (bluetooth). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.… | Patch early | 8.8 high | 22.9% | 2017-09-14 |
| CVE-2014-1775 EXP | Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf… | Patch early | 9.3 high | 22.8% | 2014-06-11 |
| CVE-2014-1803 EXP | Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf… | Patch early | 9.3 high | 22.8% | 2014-06-11 |
| CVE-2014-2757 EXP | Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf… | Patch early | 9.3 high | 22.8% | 2014-06-11 |
| CVE-2002-0624 EXP | Buffer overflow in the password encryption function of Microsoft SQL Server 2000, including Microsoft SQL Server Desktop Engine (MSDE) 2000, allows re… | Patch early | 7.5 high | 22.8% | 2002-07-23 |
| CVE-2016-0051 EXP | The WebDAV client in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Win… | Patch early | 7.8 high | 22.8% | 2016-02-10 |
| CVE-2007-1531 EXP | Microsoft Windows XP and Vista overwrites ARP table entries included in gratuitous ARP, which allows remote attackers to cause a denial of service (lo… | Patch early | 5.0 medium | 22.8% | 2007-03-20 |
| CVE-2015-8617 EXP | Format string vulnerability in the zend_throw_or_error function in Zend/zend_execute_API.c in PHP 7.x before 7.0.1 allows remote attackers to execute… | Patch early | 9.8 critical | 22.8% | 2016-01-19 |
| CVE-2016-1013 EXP | Use-after-free vulnerability in Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.6… | Patch early | 8.8 high | 22.8% | 2016-04-09 |
| CVE-2018-6871 EXP | LibreOffice before 5.4.5 and 6.x before 6.0.1 allows remote attackers to read arbitrary files via =WEBSERVICE calls in a document, which use the COM.M… | Patch early | 9.8 critical | 22.8% | 2018-02-09 |
| CVE-2007-3958 EXP | Microsoft Windows Explorer (explorer.exe) allows user-assisted remote attackers to cause a denial of service via a certain GIF file, as demonstrated b… | Patch early | 7.1 high | 22.8% | 2007-07-24 |
| CVE-2008-2631 EXP | The WordClient interface in Alt-N Technologies MDaemon 9.6.5 allows remote attackers to cause a denial of service (NULL pointer dereference and applic… | Patch early | 5.0 medium | 22.8% | 2008-06-10 |
| CVE-2013-3144 EXP | Microsoft Internet Explorer 8 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf… | Patch early | 9.3 high | 22.8% | 2013-07-10 |
| CVE-2013-3151 EXP | Microsoft Internet Explorer 8 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf… | Patch early | 9.3 high | 22.8% | 2013-07-10 |
| CVE-2018-18777 EXP | Directory traversal vulnerability in Microstrategy Web, version 7, in "/WebMstr7/servlet/mstrWeb" (in the parameter subpage) allows remote authenticat… | Patch early | 4.3 medium | 22.8% | 2018-11-01 |
| CVE-2008-2789 EXP | SQL injection vulnerability in pages/index.php in BASIC-CMS allows remote attackers to execute arbitrary SQL commands via the page_id parameter. | Patch early | 7.5 high | 22.8% | 2008-06-20 |
| CVE-2006-3513 EXP | danim.dll in Microsoft Internet Explorer 6 allows remote attackers to cause a denial of service (application crash) by accessing the Data property of… | Patch early | 5.0 medium | 22.7% | 2006-07-11 |
| CVE-2021-40380 EXP | An issue was discovered on Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, and TN540 devices. cameralist.cgi and setcamera.cgi disclose credential… | Patch early | 7.5 high | 22.7% | 2021-09-01 |
| CVE-2021-40381 EXP | An issue was discovered on Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, and TN540 devices. index_MJpeg.cgi allows video access. | Patch early | 7.5 high | 22.7% | 2021-09-01 |
| CVE-2021-40382 EXP | An issue was discovered on Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, and TN540 devices. mjpegStreamer.cgi allows video screenshot access. | Patch early | 7.5 high | 22.7% | 2021-09-01 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt