CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
401,061 CVEs
1,733 on KEV
17,290 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-03
25,091 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2011-1609 EXP | SQL injection vulnerability in Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 6.x before 6.1(5)su2, 7.x before 7.1(5)su1, 8.0 b… | Patch early | 8.5 high | 19.8% | 2011-05-03 |
| CVE-2001-0909 EXP | Buffer overflow in helpctr.exe program in Microsoft Help Center for Windows XP allows remote attackers to execute arbitrary code via a long hcp: URL. | Patch early | 7.5 high | 19.7% | 2001-11-21 |
| CVE-2011-2202 EXP | The rfc1867_post_handler function in main/rfc1867.c in PHP before 5.3.7 does not properly restrict filenames in multipart/form-data POST requests, whi… | Patch early | 6.4 medium | 19.7% | 2011-06-16 |
| CVE-2014-4492 EXP | libnetcore in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 does not verify that certain values have the expected data… | Patch early | 7.5 high | 19.7% | 2015-01-30 |
| CVE-2001-1088 EXP | Microsoft Outlook 8.5 and earlier, and Outlook Express 5 and earlier, with the "Automatically put people I reply to in my address book" option enabled… | Patch early | 7.5 high | 19.7% | 2001-06-05 |
| CVE-2009-1869 EXP | Integer overflow in the ActionScript Virtual Machine 2 (AVM2) abcFile parser in Adobe Flash Player before 9.0.246.0 and 10.x before 10.0.32.18, and Ad… | Patch early | 9.3 high | 19.7% | 2009-07-31 |
| CVE-2016-1002 EXP | Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21… | Patch early | 8.8 high | 19.7% | 2016-03-12 |
| CVE-2002-1426 EXP | HP ProCurve Switch 4000M C.07.23 allows remote attackers to cause a denial of service (crash) via an SNMP write request containing 85 characters, poss… | Patch early | 7.8 high | 19.7% | 2003-04-11 |
| CVE-2007-4916 EXP | Heap-based buffer overflow in the FileFind::FindFile method in (1) MFC42.dll, (2) MFC42u.dll, (3) MFC71.dll, and (4) MFC71u.dll in Microsoft Foundatio… | Patch early | 10.0 high | 19.7% | 2007-09-17 |
| CVE-2016-0964 EXP | Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0… | Patch early | 8.8 high | 19.7% | 2016-02-10 |
| CVE-2016-0965 EXP | Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0… | Patch early | 8.8 high | 19.7% | 2016-02-10 |
| CVE-2016-0967 EXP | Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0… | Patch early | 8.8 high | 19.7% | 2016-02-10 |
| CVE-2007-0247 EXP | squid/src/ftp.c in Squid before 2.6.STABLE7 allows remote FTP servers to cause a denial of service (core dump) via crafted FTP directory listing respo… | Patch early | 5.0 medium | 19.7% | 2007-01-16 |
| CVE-2019-8049 EXP | Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015… | Patch early | 9.8 critical | 19.7% | 2019-08-20 |
| CVE-2016-6175 EXP | Eval injection vulnerability in php-gettext 1.0.12 and earlier allows remote attackers to execute arbitrary PHP code via a crafted plural forms header… | Patch early | 9.8 critical | 19.7% | 2017-02-07 |
| CVE-2010-4282 EXP | Multiple directory traversal vulnerabilities in Pandora FMS before 3.1.1 allow remote attackers to include and execute arbitrary local files via (1) t… | Patch early | 7.5 high | 19.6% | 2010-12-02 |
| CVE-2013-2679 EXP | Multiple cross-site scripting (XSS) vulnerabilities in Cisco Linksys E4200 router with firmware 1.0.05 build 7 allow remote attackers to inject arbitr… | Patch early | 6.1 medium | 19.6% | 2020-02-18 |
| CVE-2019-8385 EXP | An issue was discovered in Thomson Reuters Desktop Extensions 1.9.0.358. An unauthenticated directory traversal and local file inclusion vulnerability… | Patch early | 9.8 critical | 19.6% | 2019-06-05 |
| CVE-2010-1296 EXP | Multiple buffer overflows in Adobe Photoshop CS4 before 11.0.2 allow user-assisted remote attackers to execute arbitrary code via a crafted (1) .ASL,… | Patch early | 9.3 high | 19.6% | 2010-05-27 |
| CVE-2013-7240 EXP | Directory traversal vulnerability in download-file.php in the Advanced Dewplayer plugin 1.2 for WordPress allows remote attackers to read arbitrary fi… | Patch early | 5.0 medium | 19.6% | 2014-01-03 |
| CVE-2009-2762 EXP | wp-login.php in WordPress 2.8.3 and earlier allows remote attackers to force a password reset for the first user in the database, possibly the adminis… | Patch early | 7.5 high | 19.6% | 2009-08-13 |
| CVE-2009-0949 EXP | The ippReadIO function in cups/ipp.c in cupsd in CUPS before 1.3.10 does not properly initialize memory for IPP request packets, which allows remote a… | Patch early | 7.5 high | 19.6% | 2009-06-09 |
| CVE-2016-0951 EXP | Adobe Photoshop CC 2014 before 15.2.4, Photoshop CC 2015 before 16.1.2, and Bridge CC before 6.2 allow attackers to execute arbitrary code or cause a… | Patch early | 9.8 critical | 19.6% | 2016-02-10 |
| CVE-2016-0952 EXP | Adobe Photoshop CC 2014 before 15.2.4, Photoshop CC 2015 before 16.1.2, and Bridge CC before 6.2 allow attackers to execute arbitrary code or cause a… | Patch early | 9.8 critical | 19.6% | 2016-02-10 |
| CVE-2016-0953 EXP | Adobe Photoshop CC 2014 before 15.2.4, Photoshop CC 2015 before 16.1.2, and Bridge CC before 6.2 allow attackers to execute arbitrary code or cause a… | Patch early | 9.8 critical | 19.6% | 2016-02-10 |
| CVE-2011-0364 EXP | The Management Console (webagent.exe) in Cisco Security Agent 5.1, 5.2, and 6.0 before 6.0.2.145 allows remote attackers to create arbitrary files and… | Patch early | 10.0 high | 19.6% | 2011-02-19 |
| CVE-2019-16701 EXP | pfSense through 2.3.4 through 2.4.4-p3 allows Remote Code Injection via a methodCall XML document with a pfsense.exec_php call containing shell metach… | Patch early | 8.8 high | 19.6% | 2019-09-25 |
| CVE-2018-16060 EXP | Mitsubishi Electric Europe B.V. SmartRTU devices allow remote attackers to obtain sensitive information (directory listing and source code) via a dire… | Patch early | 7.5 high | 19.6% | 2021-10-15 |
| CVE-2006-5710 EXP | The Airport driver for certain Orinoco based Airport cards in Darwin kernel 8.8.0 in Apple Mac OS X 10.4.8, and possibly other versions, allows remote… | Patch early | 7.5 high | 19.6% | 2006-11-04 |
| CVE-2004-1306 EXP | Heap-based buffer overflow in winhlp32.exe in Windows NT, Windows 2000 through SP4, Windows XP through SP2, and Windows 2003 allows remote attackers t… | Patch early | 5.1 medium | 19.6% | 2004-12-31 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt