CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
398,503 CVEs
1,726 on KEV
17,265 EPSS ≥ 10%
25,086 with exploits
synced 2026-09-27
10,151 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2014-2424 EXP | Unspecified vulnerability in the Oracle Event Processing component in Oracle Fusion Middleware 11.1.1.7.0 allows remote authenticated users to affect… | Patch early | 4.0 medium | 47.4% | 2014-04-16 |
| CVE-2005-1815 EXP | Multiple buffer overflows in Hummingbird Connectivity inetD 10.0.0.1 and 9.0.0.4 allows attackers to cause a denial of service and possibly execute ar… | Patch early | 5.0 medium | 47.2% | 2005-06-01 |
| CVE-2007-2199 EXP | PHP remote file inclusion vulnerability in lib/pcltar.lib.php (aka pcltar.php) in the PclTar module 1.3 and 1.3.1 for Vincent Blavet PhpConcept Librar… | Patch early | 6.8 medium | 46.9% | 2007-04-24 |
| CVE-2012-6274 EXP | BigAntSoft BigAnt IM Message Server does not require authentication for file uploading, which allows remote attackers to create arbitrary files under… | Patch early | 5.0 medium | 46.9% | 2013-02-24 |
| CVE-2007-5186 EXP | PHP remote file inclusion vulnerability in index.php in Segue CMS 1.8.4 and earlier, when register_globals is disabled, allows remote attackers to exe… | Patch early | 6.8 medium | 46.8% | 2007-10-03 |
| CVE-2011-0096 EXP | The MHTML protocol handler in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, R2,… | Patch early | 6.1 medium | 46.8% | 2011-01-31 |
| CVE-2000-0505 EXP | The Apache 1.3.x HTTP server for Windows platforms allows remote attackers to list directory contents by requesting a URL containing a large number of… | Patch early | 5.0 medium | 46.7% | 2000-05-31 |
| CVE-2006-5028 EXP | Directory traversal vulnerability in filemanager/filemanager.php in SWsoft Plesk 7.5 Reload and Plesk 7.6 for Microsoft Windows allows remote attacker… | Patch early | 5.0 medium | 46.6% | 2006-09-27 |
| CVE-2002-0597 EXP | LANMAN service on Microsoft Windows 2000 allows remote attackers to cause a denial of service (CPU/memory exhaustion) via a stream of malformed data t… | Patch early | 5.0 medium | 46.6% | 2002-06-18 |
| CVE-2007-5842 EXP | Multiple PHP remote file inclusion vulnerabilities in Vortex Portal 1.0.42 allow remote attackers to execute arbitrary PHP code via a URL in the cfgPr… | Patch early | 6.8 medium | 46.5% | 2007-11-06 |
| CVE-2005-0581 EXP | Multiple buffer overflows in Computer Associates (CA) License Client and Server 0.1.0.15 allow remote attackers to execute arbitrary code via (1) cert… | Patch early | 4.6 medium | 46.3% | 2005-05-02 |
| CVE-2008-2031 EXP | VicFTPS 5.0 allows remote attackers to cause a denial of service (crash) via a crafted LIST command, which triggers a NULL pointer dereference. NOTE:… | Patch early | 5.0 medium | 46.3% | 2008-04-30 |
| CVE-2019-15276 EXP | A vulnerability in the web interface of Cisco Wireless LAN Controller Software could allow a low-privileged, authenticated, remote attacker to cause a… | Patch early | 6.5 medium | 46.3% | 2019-11-26 |
| CVE-2014-2671 EXP | Microsoft Windows Media Player (WMP) 11.0.5721.5230 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecif… | Patch early | 6.8 medium | 46.3% | 2014-03-31 |
| CVE-2006-3835 EXP | Apache Tomcat 5 before 5.5.17 allows remote attackers to list directories via a semicolon (;) preceding a filename with a mapped extension, as demonst… | Patch early | 5.0 medium | 46.2% | 2006-07-25 |
| CVE-2003-0042 EXP | Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, allows remote attackers to list directories even with an index.html or other file p… | Patch early | 5.0 medium | 46% | 2003-02-07 |
| CVE-2015-6127 EXP | Windows Media Center in Microsoft Windows Vista SP2, Windows 7 SP1, Windows 8, and Windows 8.1 allows remote attackers to read arbitrary files via a c… | Patch early | 4.3 medium | 46% | 2015-12-09 |
| CVE-2023-4168 EXP | A vulnerability was found in Templatecookie Adlisting 2.14.0. It has been classified as problematic. Affected is an unknown function of the file /ad-l… | Patch early | 4.3 medium | 46% | 2023-08-05 |
| CVE-2007-5098 EXP | Multiple PHP remote file inclusion vulnerabilities in DFD Cart 1.1.4 and earlier, when register_globals is enabled, allow remote attackers to execute… | Patch early | 6.8 medium | 46% | 2007-09-26 |
| CVE-2019-9692 EXP | class.showtime2_image.php in CMS Made Simple (CMSMS) before 2.2.10 does not ensure that a watermark file has a standard image file extension (GIF, JPG… | Patch early | 6.5 medium | 45.9% | 2019-03-11 |
| CVE-2009-0932 EXP | Directory traversal vulnerability in framework/Image/Image.php in Horde before 3.2.4 and 3.3.3 and Horde Groupware before 1.1.5 allows remote attacker… | Patch early | 6.4 medium | 45.8% | 2009-03-17 |
| CVE-2008-4696 EXP | Cross-site scripting (XSS) vulnerability in Opera.dll in Opera before 9.61 allows remote attackers to inject arbitrary web script or HTML via the anch… | Patch early | 4.3 medium | 45.7% | 2008-10-23 |
| CVE-2000-0126 EXP | Sample Internet Data Query (IDQ) scripts in IIS 3 and 4 allow remote attackers to read files via a .. (dot dot) attack. | Patch early | 5.0 medium | 45.7% | 2000-01-26 |
| CVE-2005-1988 EXP | Unknown vulnerability in Internet Explorer 5.0, 5.5, and 6.0 allows remote attackers to execute arbitrary code via a web site or an HTML e-mail contai… | Patch early | 5.1 medium | 45.6% | 2005-08-10 |
| CVE-2017-11885 EXP | Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703 and 1709, Win… | Patch early | 6.6 medium | 45.5% | 2017-12-12 |
| CVE-2007-2484 EXP | PHP remote file inclusion vulnerability in js/wptable-button.php in the wp-Table 1.43 and earlier plugin for WordPress, when register_globals is enabl… | Patch early | 6.8 medium | 45.4% | 2007-05-03 |
| CVE-2004-0595 EXP | The strip_tags function in PHP 4.x up to 4.3.7, and 5.x up to 5.0.0RC3, does not filter null (\0) characters within tag names when restricting input t… | Patch early | 6.8 medium | 45.2% | 2004-07-27 |
| CVE-2019-13344 EXP | An authentication bypass vulnerability in the CRUDLab WP Like Button plugin through 1.6.0 for WordPress allows unauthenticated attackers to change set… | Patch early | 5.3 medium | 45.1% | 2019-07-05 |
| CVE-2007-5009 EXP | PHP remote file inclusion vulnerability in language/lang_german/lang_main_album.php in phpBB Plus 1.53, and 1.53a before 20070922, allows remote attac… | Patch early | 6.8 medium | 45% | 2007-09-20 |
| CVE-2000-0979 EXP | File and Print Sharing service in Windows 95, Windows 98, and Windows Me does not properly check the password for a file share, which allows remote at… | Patch early | 6.4 medium | 45% | 2000-12-19 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt