CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
398,514 CVEs
1,726 on KEV
17,265 EPSS ≥ 10%
25,086 with exploits
synced 2026-09-27
12,661 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2009-2288 EXP | statuswml.cgi in Nagios before 3.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) ping or (2) Traceroute… | Patch early | 7.5 high | 83.5% | 2009-07-01 |
| CVE-2001-1583 EXP | lpd daemon (in.lpd) in Solaris 8 and earlier allows remote attackers to execute arbitrary commands via a job request with a crafted control file that… | Patch early | 10.0 high | 83.4% | 2001-12-31 |
| CVE-2014-7863 EXP | The FailOverHelperServlet (aka FailServlet) servlet in ZOHO ManageEngine Applications Manager before 11.9 build 11912, OpManager 8 through 11.5 build… | Patch early | 7.5 high | 83.4% | 2020-02-08 |
| CVE-2021-25094 EXP | The Tatsu WordPress plugin before 3.3.12 add_custom_font action can be used without prior authentication to upload a rogue zip file which is uncompres… | Patch early | 8.1 high | 83.4% | 2022-04-25 |
| CVE-2016-0792 EXP | Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to execute arbitrary code via seria… | Patch early | 8.8 high | 83.3% | 2016-04-07 |
| CVE-2020-7246 EXP | A remote code execution (RCE) vulnerability exists in qdPM 9.1 and earlier. An attacker can upload a malicious PHP code file via the profile photo fun… | Patch early | 8.8 high | 83.2% | 2020-01-21 |
| CVE-2012-5958 EXP | Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP parser in the portable SDK for UPnP Devices (aka lib… | Patch early | 10.0 high | 83.2% | 2013-01-31 |
| CVE-2015-3090 EXP | Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on Linux, Adobe AIR before 17… | Patch early | 10.0 high | 83.2% | 2015-05-13 |
| CVE-2014-0050 EXP | MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to ca… | Patch early | 7.5 high | 83.2% | 2014-04-01 |
| CVE-2009-4006 EXP | Stack-based buffer overflow in the TEA decoding algorithm in RhinoSoft Serv-U FTP server 7.0.0.1, 9.0.0.5, and other versions before 9.1.0.0 allows re… | Patch early | 10.0 high | 82.9% | 2009-11-20 |
| CVE-2016-0041 EXP | Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows… | Patch early | 7.8 high | 82.9% | 2016-02-10 |
| CVE-2019-0539 EXP | A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scri… | Patch early | 7.5 high | 82.9% | 2019-01-08 |
| CVE-2010-4452 EXP | Unspecified vulnerability in the Deployment component in Java Runtime Environment (JRE) in Oracle Java SE and Java for Business 6 Update 23 and earlie… | Patch early | 10.0 high | 82.8% | 2011-02-17 |
| CVE-2019-8942 EXP | WordPress before 4.9.9 and 5.x before 5.0.1 allows remote code execution because an _wp_attached_file Post Meta entry can be changed to an arbitrary s… | Patch early | 8.8 high | 82.7% | 2019-02-20 |
| CVE-2014-4511 EXP | Gitlist before 0.5.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the file name in the URI of a request for a (1)… | Patch early | 7.5 high | 82.7% | 2014-07-22 |
| CVE-2004-0597 EXP | Multiple buffer overflows in libpng 1.2.5 and earlier, as used in multiple products, allow remote attackers to execute arbitrary code via malformed PN… | Patch early | 10.0 high | 82.5% | 2004-11-23 |
| CVE-2009-2765 EXP | httpd.c in httpd in the management GUI in DD-WRT 24 sp1, and other versions before build 12533, allows remote attackers to execute arbitrary commands… | Patch early | 8.3 high | 82.5% | 2009-08-14 |
| CVE-2011-0276 EXP | HP OpenView Performance Insight Server 5.2, 5.3, 5.31, 5.4, and 5.41 contains a "hidden account" in the com.trinagy.security.XMLUserManager Java class… | Patch early | 10.0 high | 82.4% | 2011-02-02 |
| CVE-2025-1098 EXP | A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `mirror-target` and `mirror-host` Ingress ann… | Patch early | 8.8 high | 82.3% | 2025-03-25 |
| CVE-2019-7254 EXP | Linear eMerge E3-Series devices allow File Inclusion. | Patch early | 7.5 high | 82.3% | 2019-07-02 |
| CVE-2011-2140 EXP | Adobe Flash Player before 10.3.183.5 on Windows, Mac OS X, Linux, and Solaris and before 10.3.186.3 on Android, and Adobe AIR before 2.7.1 on Windows… | Patch early | 10.0 high | 82.3% | 2011-08-10 |
| CVE-2007-1036 EXP | The default configuration of JBoss does not restrict access to the (1) console and (2) web management interfaces, which allows remote attackers to byp… | Patch early | 7.5 high | 82.3% | 2007-02-21 |
| CVE-2003-0818 EXP | Multiple integer overflows in Microsoft ASN.1 library (MSASN1.DLL), as used in LSASS.EXE, CRYPT32.DLL, and other Microsoft executables and libraries o… | Patch early | 7.5 high | 82.2% | 2004-03-03 |
| CVE-2020-8163 EXP | The is a code injection vulnerability in versions of Rails prior to 5.0.1 that wouldallow an attacker who controlled the `locals` argument of a `rende… | Patch early | 8.8 high | 82% | 2020-07-02 |
| CVE-2022-1175 EXP | Improper neutralization of user input in GitLab CE/EE versions 14.4 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versions startin… | Patch early | 8.7 high | 82% | 2022-04-04 |
| CVE-2018-0886 EXP | The Credential Security Support Provider protocol (CredSSP) in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Wi… | Patch early | 7.0 high | 82% | 2018-03-14 |
| CVE-2014-8440 EXP | Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR before 15.0.0… | Patch early | 10.0 high | 81.9% | 2014-11-11 |
| CVE-2020-35578 EXP | An issue was discovered in the Manage Plugins page in Nagios XI before 5.8.0. Because the line-ending conversion feature is mishandled during a plugin… | Patch early | 7.2 high | 81.9% | 2021-01-13 |
| CVE-2009-2526 EXP | Microsoft Windows Vista Gold, SP1, and SP2 and Server 2008 Gold and SP2 do not properly validate fields in SMBv2 packets, which allows remote attacker… | Patch early | 7.8 high | 81.9% | 2009-10-14 |
| CVE-2015-6128 EXP | Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 mishandle library loading, which allows local users to gain privile… | Patch early | 7.2 high | 81.9% | 2015-12-09 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt