CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
401,045 CVEs
1,733 on KEV
17,286 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-03
25,091 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2002-2164 EXP | Buffer overflow in Microsoft Outlook Express 5.0, 5.5, and 6.0 allows remote attackers to cause a denial of service (crash) via a long <A HREF> link. | Patch early | 5.0 medium | 21.9% | 2002-12-31 |
| CVE-2010-1938 EXP | Off-by-one error in the __opiereadrec function in readrec.c in libopie in OPIE 2.4.1-test1 and earlier, as used on FreeBSD 6.4 through 8.1-PRERELEASE… | Patch early | 9.3 high | 21.9% | 2010-05-28 |
| CVE-2007-3927 EXP | Multiple buffer overflows in Ipswitch IMail Server 2006 before 2006.21 (1) allow remote attackers to execute arbitrary code via unspecified vectors in… | Patch early | 10.0 high | 21.9% | 2007-07-21 |
| CVE-2012-0016 EXP | Untrusted search path vulnerability in Microsoft Expression Design; Expression Design SP1; and Expression Design 2, 3, and 4 allows local users to gai… | Patch early | 9.3 high | 21.9% | 2012-03-13 |
| CVE-2013-4341 EXP | Multiple cross-site scripting (XSS) vulnerabilities in Moodle through 2.2.11, 2.3.x before 2.3.9, 2.4.x before 2.4.6, and 2.5.x before 2.5.2 allow rem… | Patch early | 4.3 medium | 21.9% | 2013-09-16 |
| CVE-2004-0484 EXP | mshtml.dll in Microsoft Internet Explorer 6.0.2800 allows remote attackers to cause a denial of service (crash) via a table containing a form that cro… | Patch early | 2.6 low | 21.9% | 2004-07-07 |
| CVE-2015-3302 EXP | The TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin) plugin for WordPress before 1.3.9.3 allows remote attackers… | Patch early | 7.5 high | 21.8% | 2017-12-29 |
| CVE-2018-8057 EXP | A SQL Injection vulnerability exists in Western Bridge Cobub Razor 0.8.0 via the channel_name or platform parameter in a /index.php?/manage/channel/ad… | Patch early | 9.8 critical | 21.8% | 2018-03-11 |
| CVE-2017-2985 EXP | Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable use after free vulnerability in the ActionScript 3 BitmapData class. Successful… | Patch early | 8.8 high | 21.8% | 2017-02-15 |
| CVE-2009-1493 EXP | The customDictionaryOpen spell method in the JavaScript API in Adobe Reader 9.1, 8.1.4, 7.1.1, and earlier on Linux and UNIX allows remote attackers t… | Patch early | 6.8 medium | 21.8% | 2009-04-30 |
| CVE-2017-6542 EXP | The ssh_agent_channel_data function in PuTTY before 0.68 allows remote attackers to have unspecified impact via a large length value in an agent proto… | Patch early | 9.8 critical | 21.8% | 2017-03-27 |
| CVE-2022-34047 EXP | An access control issue in Wavlink WN530HG4 M30HG4.V5030.191116 allows attackers to obtain usernames and passwords via view-source:http://IP_ADDRESS/s… | Patch early | 7.5 high | 21.8% | 2022-07-20 |
| CVE-2005-1649 EXP | The IPv6 support in Windows XP SP2, 2003 Server SP1, and Longhorn, with Windows Firewall turned off, allows remote attackers to cause a denial of serv… | Patch early | 5.0 medium | 21.8% | 2005-05-18 |
| CVE-2007-4934 EXP | Multiple PHP remote file inclusion vulnerabilities in phpFFL 1.24 allow remote attackers to execute arbitrary PHP code via a URL in the PHPFFL_FILE_RO… | Patch early | 4.6 medium | 21.7% | 2007-09-18 |
| CVE-2014-1772 EXP | Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted… | Patch early | 9.3 high | 21.7% | 2014-06-11 |
| CVE-2014-1805 EXP | Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf… | Patch early | 9.3 high | 21.7% | 2014-06-11 |
| CVE-2014-2754 EXP | Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web sit… | Patch early | 9.3 high | 21.7% | 2014-06-11 |
| CVE-2006-0544 EXP | urlmon.dll in Microsoft Internet Explorer 7.0 beta 2 (aka 7.0.5296.0) allows remote attackers to cause a denial of service (application crash) and pos… | Patch early | 7.5 high | 21.7% | 2006-02-04 |
| CVE-2008-1067 EXP | Multiple PHP remote file inclusion vulnerabilities in phpQLAdmin 2.2.7 allow remote attackers to execute arbitrary PHP code via a URL in the _SESSION[… | Patch early | 6.8 medium | 21.7% | 2008-02-28 |
| CVE-2004-0989 EXP | Multiple buffer overflows in libXML 2.6.12 and 2.6.13 (libxml2), and possibly other versions, may allow remote attackers to execute arbitrary code via… | Patch early | 10.0 high | 21.7% | 2005-03-01 |
| CVE-2022-46770 EXP | qubes-mirage-firewall (aka Mirage firewall for QubesOS) 0.8.x through 0.8.3 allows guest OS users to cause a denial of service (CPU consumption and lo… | Patch early | 7.5 high | 21.7% | 2022-12-07 |
| CVE-1999-0999 EXP | Microsoft SQL 7.0 server allows a remote attacker to cause a denial of service via a malformed TDS packet. | Patch early | 4.3 medium | 21.7% | 1999-11-19 |
| CVE-2005-3277 EXP | The LPD service in HP-UX 10.20 11.11 (11i) and earlier allows remote attackers to execute arbitrary code via shell metacharacters ("`" or single backq… | Patch early | 10.0 high | 21.7% | 2005-10-21 |
| CVE-2009-1330 EXP | Stack-based buffer overflow in Easy RM to MP3 Converter allows remote attackers to execute arbitrary code via a long filename in a playlist (.pls) fil… | Patch early | 9.3 high | 21.7% | 2009-04-17 |
| CVE-2010-3338 EXP | The Windows Task Scheduler in Microsoft Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 does not properly determine th… | Patch early | 7.2 high | 21.7% | 2010-12-16 |
| CVE-2018-20525 EXP | Roxy Fileman 1.4.5 allows Directory Traversal in copydir.php, copyfile.php, and fileslist.php. | Patch early | 9.1 critical | 21.6% | 2019-03-21 |
| CVE-2006-3511 EXP | Internet Explorer 6 on Windows XP SP2 allows remote attackers to cause a denial of service (crash) by setting the fonts property of the HtmlDlgSafeHel… | Patch early | 5.0 medium | 21.6% | 2006-07-11 |
| CVE-2006-3915 EXP | Microsoft Internet Explorer 6 on Windows XP SP2 allows remote attackers to cause a denial of service (crash) by iterating over any native function, as… | Patch early | 5.0 medium | 21.6% | 2006-07-28 |
| CVE-2013-0249 EXP | Stack-based buffer overflow in the Curl_sasl_create_digest_md5_message function in lib/curl_sasl.c in curl and libcurl 7.26.0 through 7.28.1, when neg… | Patch early | 7.5 high | 21.6% | 2013-03-08 |
| CVE-2011-0222 EXP | WebKit, as used in Apple Safari before 5.0.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and ap… | Patch early | 9.3 high | 21.6% | 2011-07-21 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt