CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
401,058 CVEs
1,733 on KEV
17,286 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-03
25,091 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2017-6548 EXP | Buffer overflows in networkmap on ASUS RT-N56U, RT-N66U, RT-AC66U, RT-N66R, RT-AC66R, RT-AC68U, RT-AC68R, RT-N66W, RT-AC66W, RT-AC87R, RT-AC87U, RT-AC… | Patch early | 9.8 critical | 21.3% | 2017-03-09 |
| CVE-1999-0288 EXP | The WINS server in Microsoft Windows NT 4.0 before SP4 allows remote attackers to cause a denial of service (process termination) via invalid UDP fram… | Patch early | 5.0 medium | 21.3% | 1998-08-01 |
| CVE-2000-0211 EXP | The Windows Media server allows remote attackers to cause a denial of service via a series of client handshake packets that are sent in an improper se… | Patch early | 5.0 medium | 21.3% | 2000-02-23 |
| CVE-2011-0406 EXP | Heap-based buffer overflow in HistorySvr.exe in WellinTech KingView 6.53 allows remote attackers to execute arbitrary code via a long request to TCP p… | Patch early | 10.0 high | 21.3% | 2011-01-11 |
| CVE-2013-0657 EXP | Stack-based buffer overflow in Schneider Electric Interactive Graphical SCADA System (IGSS) 10 and earlier allows remote attackers to execute arbitrar… | Patch early | 10.0 high | 21.3% | 2013-01-21 |
| CVE-2003-0540 EXP | The address parser code in Postfix 1.1.12 and earlier allows remote attackers to cause a denial of service (lock) via (1) a malformed envelope address… | Patch early | 5.0 medium | 21.3% | 2003-08-27 |
| CVE-2010-1173 EXP | The sctp_process_unk_param function in net/sctp/sm_make_chunk.c in the Linux kernel 2.6.33.3 and earlier, when SCTP is enabled, allows remote attacker… | Patch early | 7.1 high | 21.2% | 2010-05-07 |
| CVE-2013-0177 EXP | Multiple cross-site scripting (XSS) vulnerabilities in widget/screen/ModelScreenWidget.java in Apache Open For Business Project (aka OFBiz) 10.04.x be… | Patch early | 3.5 low | 21.2% | 2014-01-30 |
| CVE-2014-5383 EXP | SQL injection vulnerability in AlienVault OSSIM before 4.7.0 allows remote authenticated users to execute arbitrary SQL commands via unspecified vecto… | Patch early | 6.5 medium | 21.2% | 2014-08-21 |
| CVE-2019-9955 EXP | On Zyxel ATP200, ATP500, ATP800, USG20-VPN, USG20W-VPN, USG40, USG40W, USG60, USG60W, USG110, USG210, USG310, USG1100, USG1900, USG2200-VPN, ZyWALL 11… | Patch early | 6.1 medium | 21.2% | 2019-04-22 |
| CVE-2004-0083 EXP | Buffer overflow in ReadFontAlias from dirfile.c of XFree86 4.1.0 through 4.3.0 allows local users and remote attackers to execute arbitrary code via a… | Patch early | 10.0 high | 21.2% | 2004-03-03 |
| CVE-2025-47166 EXP | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | Patch early | 8.8 high | 21.2% | 2025-06-10 |
| CVE-2016-9899 EXP | Use-after-free while manipulating DOM events and removing audio elements due to errors in the handling of node adoption. This vulnerability affects Fi… | Patch early | 9.8 critical | 21.1% | 2018-06-11 |
| CVE-2017-2931 EXP | Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable memory corruption vulnerability related to the parsing of SWF metadata. Success… | Patch early | 8.8 high | 21.1% | 2017-01-11 |
| CVE-2016-4338 EXP | The mysql user parameter configuration script (userparameter_mysql.conf) in the agent in Zabbix before 2.0.18, 2.2.x before 2.2.13, and 3.0.x before 3… | Patch early | 8.1 high | 21.1% | 2017-01-23 |
| CVE-2006-5647 EXP | Sophos Anti-Virus and Endpoint Security before 6.0.5, Anti-Virus for Linux before 5.0.10, and other platforms before 4.11 allows remote attackers to c… | Patch early | 6.4 medium | 21.1% | 2006-11-01 |
| CVE-2022-47874 EXP | Improper Access Control in /tc/rpc in Jedox GmbH Jedox 2020.2.5 allows remote authenticated users to view details of database connections via class 'c… | Patch early | 6.5 medium | 21.1% | 2023-05-02 |
| CVE-2005-2842 EXP | Buffer overflow in dwrcs.exe in DameWare Mini Remote Control before 4.9.0 allows remote attackers to execute arbitrary code via the username. | Patch early | 7.5 high | 21.1% | 2005-09-08 |
| CVE-2021-44595 EXP | Wondershare Dr. Fone Latest version as of 2021-12-06 is vulnerable to Incorrect Access Control. A normal user can send manually crafted packets to the… | Patch early | 8.8 high | 21.1% | 2022-04-29 |
| CVE-2018-0878 EXP | Windows Remote Assistance in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows… | Patch early | 3.1 low | 21.1% | 2018-03-14 |
| CVE-2005-2871 EXP | Buffer overflow in the International Domain Name (IDN) support in Mozilla Firefox 1.0.6 and earlier, and Netscape 8.0.3.3 and 7.2, allows remote attac… | Patch early | 7.5 high | 21.1% | 2005-09-09 |
| CVE-2002-0201 EXP | Cyberstop Web Server for Windows 0.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long HTTP… | Patch early | 5.0 medium | 21.1% | 2002-05-16 |
| CVE-2003-1083 EXP | Stack-based buffer overflow in Monit 1.4 to 4.1 allows remote attackers to execute arbitrary code via a long HTTP request. | Patch early | 10.0 high | 21.1% | 2003-12-31 |
| CVE-2011-4362 EXP | Integer signedness error in the base64_decode function in the HTTP authentication functionality (http_auth.c) in lighttpd 1.4 before 1.4.30 and 1.5 be… | Patch early | 5.0 medium | 21.1% | 2011-12-24 |
| CVE-2020-3956 EXP | VMware Cloud Director 10.0.x before 10.0.0.2, 9.7.0.x before 9.7.0.5, 9.5.0.x before 9.5.0.6, and 9.1.0.x before 9.1.0.4 do not properly handle input… | Patch early | 8.8 high | 21.1% | 2020-05-20 |
| CVE-1999-0153 EXP | Windows 95/NT out of band (OOB) data denial of service through NETBIOS port, aka WinNuke. | Patch early | 5.0 medium | 21.1% | 1997-07-01 |
| CVE-2016-3223 EXP | Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Wind… | Patch early | 8.1 high | 21.1% | 2016-06-16 |
| CVE-2006-6379 EXP | Buffer overflow in the BrightStor Backup Discovery Service in multiple CA products, including ARCserve Backup r11.5 SP1 and earlier, ARCserve Backup 9… | Patch early | 7.5 high | 21.1% | 2006-12-10 |
| CVE-2013-3617 EXP | The XML API in Openbravo ERP 2.5, 3.0, and earlier allows remote authenticated users to read arbitrary files via an XML document with an external enti… | Patch early | 3.5 low | 21.1% | 2013-11-02 |
| CVE-2025-58180 EXP | OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.11.2 contain a vulnerability that… | Patch early | 8.8 high | 21.1% | 2025-09-09 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt