CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
401,069 CVEs
1,733 on KEV
17,290 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-04
25,091 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2000-0168 EXP | Microsoft Windows 9x operating systems allow an attacker to cause a denial of service via a pathname that includes file device names, aka the "DOS Dev… | Patch early | 5.0 medium | 19.6% | 2000-03-04 |
| CVE-2005-1827 EXP | D-Link DSL-504T allows remote attackers to bypass authentication and gain privileges, such as upgrade firmware, restart the router or restore a saved… | Patch early | 7.5 high | 19.5% | 2005-05-26 |
| CVE-2004-1701 EXP | Heap-based buffer overflow in the AuthenticationDialogue function in cfservd for Cfengine 2.0.0 to 2.1.7p1 allows remote attackers to execute arbitrar… | Patch early | 10.0 high | 19.5% | 2004-08-09 |
| CVE-2024-24496 EXP | An issue in Daily Habit Tracker v.1.0 allows a remote attacker to manipulate trackers via the home.php, add-tracker.php, delete-tracker.php, update-tr… | Patch early | 9.8 critical | 19.5% | 2024-02-08 |
| CVE-2006-2726 EXP | PHP remote file inclusion vulnerability in Fastpublish CMS 1.6.9.d allows remote attackers to include arbitrary files via the config[fsBase] parameter… | Patch early | 7.5 high | 19.5% | 2006-06-01 |
| CVE-1999-1577 EXP | Buffer overflow in HHOpen ActiveX control (hhopen.ocx) 1.0.0.1 for Internet Explorer 4.01 and 5 allows remote attackers to execute arbitrary commands… | Patch early | 5.1 medium | 19.5% | 1999-10-31 |
| CVE-2015-3111 EXP | Heap-based buffer overflow in Adobe Photoshop CC before 16.0 (aka 2015.0.0) and Adobe Bridge CC before 6.11 allows attackers to execute arbitrary code… | Patch early | 10.0 high | 19.5% | 2015-06-24 |
| CVE-2020-14947 EXP | OCS Inventory NG 2.7 allows Remote Command Execution via shell metacharacters to require/commandLine/CommandLine.php because mib_file in plugins/main_… | Patch early | 8.8 high | 19.5% | 2020-06-30 |
| CVE-2010-0620 EXP | Directory traversal vulnerability in the SSL Service in EMC HomeBase Server 6.2.x before 6.2.3 and 6.3.x before 6.3.2 allows remote attackers to overw… | Patch early | 9.3 high | 19.5% | 2010-02-25 |
| CVE-2006-3687 EXP | Stack-based buffer overflow in the Universal Plug and Play (UPnP) service in D-Link DI-524, DI-604 Broadband Router, DI-624, D-Link DI-784, WBR-1310 W… | Patch early | 7.5 high | 19.5% | 2006-07-21 |
| CVE-2016-9553 EXP | The Sophos Web Appliance (version 4.2.1.3) is vulnerable to two Remote Command Injection vulnerabilities affecting its web administrative interface. T… | Patch early | 7.2 high | 19.5% | 2017-01-28 |
| CVE-2019-0574 EXP | An elevation of privilege vulnerability exists when the Windows Data Sharing Service improperly handles file operations, aka "Windows Data Sharing Ser… | Patch early | 7.8 high | 19.4% | 2019-01-08 |
| CVE-2016-4275 EXP | Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before 11.2.202.635 on Linux allows attackers to… | Patch early | 8.8 high | 19.4% | 2016-09-14 |
| CVE-2016-4372 EXP | HPE iMC PLAT before 7.2 E0403P04, iMC EAD before 7.2 E0405P05, iMC APM before 7.2 E0401P04, iMC NTA before 7.2 E0401P01, iMC BIMS before 7.2 E0402P02,… | Patch early | 9.8 critical | 19.4% | 2016-07-15 |
| CVE-1999-1578 EXP | Buffer overflow in Registration Wizard ActiveX control (regwizc.dll, InvokeRegWizard) 3.0.0.0 for Internet Explorer 4.01 and 5 allows remote attackers… | Patch early | 5.1 medium | 19.4% | 1999-09-24 |
| CVE-2000-1113 EXP | Buffer overflow in Microsoft Windows Media Player allows remote attackers to execute arbitrary commands via a malformed Active Stream Redirector (.ASX… | Patch early | 7.5 high | 19.4% | 2001-01-09 |
| CVE-2002-1714 EXP | Microsoft Internet Explorer 5.0 through 6.0 allows remote attackers to cause a denial of service (crash) via an object of type "text/html" with the DA… | Patch early | 5.0 medium | 19.4% | 2002-12-31 |
| CVE-2007-4286 EXP | Buffer overflow in the Next Hop Resolution Protocol (NHRP) functionality in Cisco IOS 12.0 through 12.4 allows remote attackers to cause a denial of s… | Patch early | 9.3 high | 19.4% | 2007-08-09 |
| CVE-2010-0108 EXP | Buffer overflow in the cliproxy.objects.1 ActiveX control in the Symantec Client Proxy (CLIproxy.dll) in Symantec AntiVirus 10.0.x, 10.1.x before MR9,… | Patch early | 10.0 high | 19.4% | 2010-02-19 |
| CVE-2019-1119 EXP | A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite Remote Code Execution Vulnerabili… | Patch early | 8.8 high | 19.4% | 2019-07-15 |
| CVE-2025-64459 EXP | An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8. The methods `QuerySet.filter()`, `QuerySet.exclude()`, and `Que… | Patch early | 9.1 critical | 19.4% | 2025-11-05 |
| CVE-2006-4018 EXP | Heap-based buffer overflow in the pefromupx function in libclamav/upx.c in Clam AntiVirus (ClamAV) 0.81 through 0.88.3 allows remote attackers to exec… | Patch early | 7.5 high | 19.4% | 2006-08-08 |
| CVE-2008-3533 EXP | Format string vulnerability in the window_error function in yelp-window.c in yelp in Gnome after 2.19.90 and before 2.24 allows remote attackers to ex… | Patch early | 10.0 high | 19.4% | 2008-08-18 |
| CVE-2019-10008 EXP | Zoho ManageEngine ServiceDesk 9.3 allows session hijacking and privilege escalation because an established guest session is automatically converted in… | Patch early | 8.8 high | 19.4% | 2019-04-24 |
| CVE-2011-1568 EXP | Format string vulnerability in the logText function in shmemmgr9.dll in IGSSdataServer.exe 9.00.00.11074, and 9.00.00.11063 and earlier, in 7-Technolo… | Patch early | 10.0 high | 19.4% | 2011-04-05 |
| CVE-2017-14094 EXP | A vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could allow an attacker to perform remote command execution… | Patch early | 9.8 critical | 19.4% | 2018-01-19 |
| CVE-2010-1119 EXP | Use-after-free vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, Safari before 4.1 on Mac OS X 10.4, and S… | Patch early | 10.0 high | 19.4% | 2010-03-25 |
| CVE-2006-2297 EXP | Heap-based buffer overflow in Microsoft Infotech Storage System Library (itss.dll) allows user-assisted attackers to execute arbitrary code via a craf… | Patch early | 4.0 medium | 19.4% | 2006-05-10 |
| CVE-2002-0379 EXP | Buffer overflow in University of Washington imap server (uw-imapd) imap-2001 (imapd 2001.315) and imap-2001a (imapd 2001.315) with legacy RFC 1730 sup… | Patch early | 7.5 high | 19.4% | 2002-06-25 |
| CVE-2007-2057 EXP | Stack-based buffer overflow in aircrack-ng airodump-ng 0.7 allows remote attackers to execute arbitrary code via crafted 802.11 authentication packets… | Patch early | 10.0 high | 19.4% | 2007-04-18 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt