CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
398,503 CVEs
1,726 on KEV
17,265 EPSS ≥ 10%
25,086 with exploits
synced 2026-09-27
12,661 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2015-7858 EXP | SQL injection vulnerability in Joomla! 3.2 before 3.4.4 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, a different… | Patch early | 7.5 high | 85.6% | 2015-10-29 |
| CVE-2003-0533 EXP | Stack-based buffer overflow in certain Active Directory service functions in LSASRV.DLL of the Local Security Authority Subsystem Service (LSASS) in M… | Patch early | 7.5 high | 85.5% | 2004-06-01 |
| CVE-2004-0330 EXP | Buffer overflow in Serv-U ftp before 5.0.0.4 allows remote authenticated users to execute arbitrary code via a long time zone argument to the MDTM com… | Patch early | 10.0 high | 85.5% | 2004-11-23 |
| CVE-2023-39362 EXP | Cacti is an open source operational monitoring and fault management framework. In Cacti 1.2.24, under certain conditions, an authenticated privileged… | Patch early | 7.2 high | 85.4% | 2023-09-05 |
| CVE-2005-2086 EXP | PHP remote file inclusion vulnerability in viewtopic.php in phpBB 2.0.15 and earlier allows remote attackers to execute arbitrary PHP code. | Patch early | 7.5 high | 85.4% | 2005-07-05 |
| CVE-2009-0075 EXP | Microsoft Internet Explorer 7 does not properly handle errors during attempted access to deleted objects, which allows remote attackers to execute arb… | Patch early | 9.3 high | 85.3% | 2009-02-10 |
| CVE-1999-1053 EXP | guestbook.pl cleanses user-inserted SSI commands by removing text between "<!--" and "-->" separators, which allows remote attackers to execute arbitr… | Patch early | 7.5 high | 85.2% | 1999-09-13 |
| CVE-2001-0499 EXP | Buffer overflow in Transparent Network Substrate (TNS) Listener in Oracle 8i 8.1.7 and earlier allows remote attackers to gain privileges via a long a… | Patch early | 10.0 high | 85.2% | 2001-07-21 |
| CVE-2006-5478 EXP | Multiple stack-based buffer overflows in Novell eDirectory 8.8.x before 8.8.1 FTF1, and 8.x up to 8.7.3.8, and Novell NetMail before 3.52e FTF2, allow… | Patch early | 7.5 high | 85.1% | 2006-10-24 |
| CVE-2006-3439 EXP | Buffer overflow in the Server Service in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 allows remote attackers, including anonymous… | Patch early | 10.0 high | 85% | 2006-08-09 |
| CVE-2003-0772 EXP | Multiple buffer overflows in WS_FTP 3 and 4 allow remote authenticated users to cause a denial of service and possibly execute arbitrary code via long… | Patch early | 7.5 high | 84.9% | 2003-09-22 |
| CVE-2002-0649 EXP | Multiple buffer overflows in the Resolution Service for Microsoft SQL Server 2000 and Microsoft Desktop Engine 2000 (MSDE) allow remote attackers to c… | Patch early | 7.5 high | 84.8% | 2002-08-12 |
| CVE-2015-6132 EXP | Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Go… | Patch early | 7.2 high | 84.7% | 2015-12-09 |
| CVE-2005-2278 EXP | Stack-based buffer overflow in the IMAP daemon (imapd) in MailEnable Professional 1.54 allows remote authenticated users to execute arbitrary code via… | Patch early | 7.2 high | 84.6% | 2005-07-18 |
| CVE-2013-6955 EXP | webman/imageSelector.cgi in Synology DiskStation Manager (DSM) 4.0 before 4.0-2259, 4.2 before 4.2-3243, and 4.3 before 4.3-3810 Update 1 allows remot… | Patch early | 10.0 high | 84.6% | 2014-01-09 |
| CVE-2003-0201 EXP | Buffer overflow in the call_trans2open function in trans2.c for Samba 2.2.x before 2.2.8a, 2.0.10 and earlier 2.0.x versions, and Samba-TNG before 0.3… | Patch early | 10.0 high | 84.5% | 2003-05-05 |
| CVE-2018-1000006 EXP | GitHub Electron versions 1.8.2-beta.3 and earlier, 1.7.10 and earlier, 1.6.15 and earlier has a vulnerability in the protocol handler, specifically El… | Patch early | 8.8 high | 84.5% | 2018-01-24 |
| CVE-2017-14495 EXP | Memory leak in dnsmasq before 2.78, when the --add-mac, --add-cpe-id or --add-subnet option is specified, allows remote attackers to cause a denial of… | Patch early | 7.5 high | 84.3% | 2017-10-03 |
| CVE-2014-0556 EXP | Heap-based buffer overflow in Adobe Flash Player before 13.0.0.244 and 14.x and 15.x before 15.0.0.152 on Windows and OS X and before 11.2.202.406 on… | Patch early | 10.0 high | 84.3% | 2014-09-10 |
| CVE-2010-3563 EXP | Unspecified vulnerability in the Deployment component in Oracle Java SE and Java for Business 6 Update 21 allows remote attackers to affect confidenti… | Patch early | 10.0 high | 84.3% | 2010-10-19 |
| CVE-2014-6037 EXP | Directory traversal vulnerability in the agentUpload servlet in ZOHO ManageEngine EventLog Analyzer 9.0 build 9002 and 8.2 build 8020 allows remote at… | Patch early | 7.5 high | 84.2% | 2014-10-26 |
| CVE-2021-24155 EXP | The WordPress Backup and Migrate Plugin – Backup Guard WordPress plugin before 1.6.0 did not ensure that the imported files are of the SGBP format and… | Patch early | 7.2 high | 84.1% | 2021-04-05 |
| CVE-2007-2175 EXP | Apple QuickTime Java extensions (QTJava.dll), as used in Safari and other browsers, and when Java is enabled, allows remote attackers to execute arbit… | Patch early | 7.6 high | 83.8% | 2007-04-24 |
| CVE-2009-2265 EXP | Multiple directory traversal vulnerabilities in FCKeditor before 2.6.4.1 allow remote attackers to create executable files in arbitrary directories vi… | Patch early | 7.5 high | 83.7% | 2009-07-05 |
| CVE-2008-6508 EXP | Directory traversal vulnerability in the AuthCheck filter in the Admin Console in Openfire 3.6.0a and earlier allows remote attackers to bypass authen… | Patch early | 7.5 high | 83.7% | 2009-03-23 |
| CVE-2005-3252 EXP | Stack-based buffer overflow in the Back Orifice (BO) preprocessor for Snort before 2.4.3 allows remote attackers to execute arbitrary code via a craft… | Patch early | 7.5 high | 83.6% | 2005-10-18 |
| CVE-2016-10073 EXP | The from method in library/core/class.email.php in Vanilla Forums before 2.3.1 allows remote attackers to spoof the email domain in sent messages and… | Patch early | 7.5 high | 83.6% | 2017-05-23 |
| CVE-2008-3257 EXP | Stack-based buffer overflow in the Apache Connector (mod_wl) in Oracle WebLogic Server (formerly BEA WebLogic Server) 10.3 and earlier allows remote a… | Patch early | 10.0 high | 83.6% | 2008-07-22 |
| CVE-2007-4560 EXP | clamav-milter in ClamAV before 0.91.2, when run in black hole mode, allows remote attackers to execute arbitrary commands via shell metacharacters tha… | Patch early | 7.6 high | 83.5% | 2007-08-28 |
| CVE-2010-2075 EXP | UnrealIRCd 3.2.8.1, as distributed on certain mirror sites from November 2009 through June 2010, contains an externally introduced modification (Troja… | Patch early | 7.5 high | 83.5% | 2010-06-15 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt