CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
401,014 CVEs
1,733 on KEV
17,286 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-03
25,091 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2013-1349 EXP | Eval injection vulnerability in ajax.php in openSIS 4.5 through 5.2 allows remote attackers to execute arbitrary PHP code via the modname parameter. | Patch early | 7.5 high | 22.7% | 2013-12-09 |
| CVE-2016-9565 EXP | MagpieRSS, as used in the front-end component in Nagios Core before 4.2.2 might allow remote attackers to read or write to arbitrary files by spoofing… | Patch early | 9.8 critical | 22.7% | 2016-12-15 |
| CVE-2014-7864 EXP | Multiple SQL injection vulnerabilities in the FailOverHelperServlet (aka FailServlet) servlet in ZOHO ManageEngine OpManager 8 through 11.5 build 1140… | Patch early | 7.5 high | 22.7% | 2015-02-04 |
| CVE-2014-4076 EXP | Microsoft Windows Server 2003 SP2 allows local users to gain privileges via a crafted IOCTL call to (1) tcpip.sys or (2) tcpip6.sys, aka "TCP/IP Eleva… | Patch early | 7.2 high | 22.7% | 2014-11-11 |
| CVE-2012-0896 EXP | Absolute path traversal vulnerability in download.php in the Count Per Day module before 3.1.1 for WordPress allows remote attackers to read arbitrary… | Patch early | 5.0 medium | 22.7% | 2012-01-20 |
| CVE-2001-0932 EXP | Buffer overflow in Cooolsoft PowerFTP Server 2.03 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long… | Patch early | 7.5 high | 22.6% | 2001-11-28 |
| CVE-2008-1721 EXP | Integer signedness error in the zlib extension module in Python 2.5.2 and earlier allows remote attackers to execute arbitrary code via a negative sig… | Patch early | 7.5 high | 22.6% | 2008-04-10 |
| CVE-2006-1043 EXP | Stack-based buffer overflow in Microsoft Visual Studio 6.0 and Microsoft Visual InterDev 6.0 allows user-assisted attackers to execute arbitrary code… | Patch early | 5.1 medium | 22.6% | 2006-03-07 |
| CVE-2024-21320 EXP | Windows Themes Spoofing Vulnerability | Patch early | 6.5 medium | 22.6% | 2024-01-09 |
| CVE-2013-2419 EXP | Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0… | Patch early | 5.0 medium | 22.6% | 2013-04-17 |
| CVE-2009-2655 EXP | mshtml.dll in Microsoft Internet Explorer 7 and 8 on Windows XP SP3 allows remote attackers to cause a denial of service (application crash) by callin… | Patch early | 4.3 medium | 22.6% | 2009-08-03 |
| CVE-2017-8683 EXP | Windows graphics on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows… | Patch early | 5.5 medium | 22.6% | 2017-09-13 |
| CVE-1999-0668 EXP | The scriptlet.typelib ActiveX control is marked as "safe for scripting" for Internet Explorer, which allows a remote attacker to execute arbitrary com… | Patch early | 5.1 medium | 22.6% | 1999-08-21 |
| CVE-2019-17124 EXP | Kramer VIAware 2.5.0719.1034 has Incorrect Access Control. | Patch early | 9.8 critical | 22.5% | 2019-10-09 |
| CVE-2018-19126 EXP | PrestaShop 1.6.x before 1.6.1.23 and 1.7.x before 1.7.4.4 allows remote attackers to execute arbitrary code via a file upload. | Patch early | 9.8 critical | 22.5% | 2018-11-09 |
| CVE-2004-0519 EXP | Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.2 allow remote attackers to execute arbitrary script as other users and possib… | Patch early | 6.8 medium | 22.5% | 2004-08-18 |
| CVE-2002-1496 EXP | Heap-based buffer overflow in Null HTTP Server 0.5.0 and earlier allows remote attackers to execute arbitrary code via a negative value in the Content… | Patch early | 7.5 high | 22.5% | 2003-04-02 |
| CVE-2008-0090 EXP | A certain ActiveX control in npUpload.dll in DivX Player 6.6.0 allows remote attackers to cause a denial of service (Internet Explorer 7 crash) via a… | Patch early | 5.0 medium | 22.5% | 2008-01-04 |
| CVE-2020-8947 EXP | functions_netflow.php in Artica Pandora FMS 7.0 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the index.php?ope… | Patch early | 7.2 high | 22.5% | 2020-02-12 |
| CVE-2003-0526 EXP | Cross-site scripting (XSS) vulnerability in Microsoft Internet Security and Acceleration (ISA) Server 2000 allows remote attackers to inject arbitrary… | Patch early | 6.8 medium | 22.5% | 2003-08-18 |
| CVE-2017-0085 EXP | Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to obtain sensitive informatio… | Patch early | 4.3 medium | 22.5% | 2017-03-17 |
| CVE-2017-0091 EXP | Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to obtain sensitive informatio… | Patch early | 4.3 medium | 22.5% | 2017-03-17 |
| CVE-2017-0092 EXP | Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to obtain sensitive informatio… | Patch early | 4.3 medium | 22.5% | 2017-03-17 |
| CVE-2017-0111 EXP | Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to obtain sensitive informatio… | Patch early | 4.3 medium | 22.5% | 2017-03-17 |
| CVE-2017-0112 EXP | Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to obtain sensitive informatio… | Patch early | 4.3 medium | 22.5% | 2017-03-17 |
| CVE-2017-0113 EXP | Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to obtain sensitive informatio… | Patch early | 4.3 medium | 22.5% | 2017-03-17 |
| CVE-2017-0114 EXP | Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to obtain sensitive informatio… | Patch early | 4.3 medium | 22.5% | 2017-03-17 |
| CVE-2017-0115 EXP | Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to obtain sensitive informatio… | Patch early | 4.3 medium | 22.5% | 2017-03-17 |
| CVE-2017-0116 EXP | Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to obtain sensitive informatio… | Patch early | 4.3 medium | 22.5% | 2017-03-17 |
| CVE-2017-0117 EXP | Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to obtain sensitive informatio… | Patch early | 4.3 medium | 22.5% | 2017-03-17 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt