CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
401,074 CVEs
1,733 on KEV
17,290 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-04
25,091 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2010-1983 EXP | Directory traversal vulnerability in the redTWITTER (com_redtwitter) component 1.0.x including 1.0b11 for Joomla! allows remote attackers to read arbi… | Patch early | 7.5 high | 18.8% | 2010-05-19 |
| CVE-2008-2650 EXP | Directory traversal vulnerability in cmsimple/cms.php in CMSimple 3.1, when register_globals is enabled, allows remote attackers to include and execut… | Patch early | 6.8 medium | 18.8% | 2008-06-10 |
| CVE-2008-1391 EXP | Multiple integer overflows in libc in NetBSD 4.x, FreeBSD 6.x and 7.x, and probably other BSD and Apple Mac OS platforms allow context-dependent attac… | Patch early | 7.5 high | 18.8% | 2008-03-27 |
| CVE-2005-0199 EXP | Integer underflow in the Lists_MakeMask() function in lists.c in ngIRCd before 0.8.2 allows remote attackers to cause a denial of service (application… | Patch early | 9.8 critical | 18.8% | 2005-05-02 |
| CVE-2019-13294 EXP | AROX School-ERP Pro has a command execution vulnerability. import_stud.php and upload_fille.php do not have session control. Therefore an unauthentica… | Patch early | 9.8 critical | 18.8% | 2019-07-04 |
| CVE-2004-0501 EXP | Outlook 2003 allows remote attackers to bypass intended access restrictions and cause Outlook to request a URL from a remote site via an HTML e-mail m… | Patch early | 5.0 medium | 18.7% | 2004-08-18 |
| CVE-2005-1279 EXP | tcpdump 3.8.3 and earlier allows remote attackers to cause a denial of service (infinite loop) via a crafted (1) BGP packet, which is not properly han… | Patch early | 5.0 medium | 18.7% | 2005-05-02 |
| CVE-2018-5782 EXP | A vulnerability in the conferencing component of Mitel Connect ONSITE, versions R1711-PREM and earlier, and Mitel ST 14.2, release GA28 and earlier, c… | Patch early | 9.8 critical | 18.7% | 2018-03-14 |
| CVE-2006-3990 EXP | Multiple PHP remote file inclusion vulnerabilities in Paul M. Jones Savant2, possibly when used with the com_mtree component for Mambo and Joomla!, al… | Patch early | 7.5 high | 18.7% | 2006-08-05 |
| CVE-2012-6495 EXP | Multiple directory traversal vulnerabilities in the (1) twikidraw (action/twikidraw.py) and (2) anywikidraw (action/anywikidraw.py) actions in MoinMoi… | Patch early | 6.0 medium | 18.7% | 2013-01-03 |
| CVE-2010-1353 EXP | Directory traversal vulnerability in the LoginBox Pro (com_loginbox) component for Joomla! allows remote attackers to read arbitrary files via a .. (d… | Patch early | 5.0 medium | 18.7% | 2010-04-12 |
| CVE-2010-1714 EXP | Directory traversal vulnerability in the Arcade Games (com_arcadegames) component 1.0 for Joomla! allows remote attackers to read arbitrary files via… | Patch early | 5.0 medium | 18.7% | 2010-05-04 |
| CVE-2009-4098 EXP | Unrestricted file upload vulnerability in banner-edit.php in OpenX adserver 2.8.1 and earlier allows remote authenticated users with banner / file upl… | Patch early | 6.0 medium | 18.7% | 2009-11-29 |
| CVE-2010-3147 EXP | Untrusted search path vulnerability in wab.exe 6.00.2900.5512 in Windows Address Book in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Wi… | Patch early | 9.3 high | 18.7% | 2010-08-27 |
| CVE-2013-1861 EXP | MariaDB 5.5.x before 5.5.30, 5.3.x before 5.3.13, 5.2.x before 5.2.15, and 5.1.x before 5.1.68, and Oracle MySQL 5.1.69 and earlier, 5.5.31 and earlie… | Patch early | 5.0 medium | 18.7% | 2013-03-28 |
| CVE-2007-4033 EXP | Buffer overflow in the intT1_EnvGetCompletePath function in lib/t1lib/t1env.c in t1lib 5.1.1 allows context-dependent attackers to execute arbitrary c… | Patch early | 7.5 high | 18.7% | 2007-07-27 |
| CVE-2002-1148 EXP | The default servlet (org.apache.catalina.servlets.DefaultServlet) in Tomcat 4.0.4 and 4.1.10 and earlier allows remote attackers to read source code f… | Patch early | 5.0 medium | 18.6% | 2002-10-11 |
| CVE-2010-5278 EXP | Directory traversal vulnerability in manager/controllers/default/resource/tvs.php in MODx Revolution 2.0.2-pl, and possibly earlier, when magic_quotes… | Patch early | 4.3 medium | 18.6% | 2012-10-07 |
| CVE-2012-0007 EXP | The Microsoft Anti-Cross Site Scripting (AntiXSS) Library 3.x and 4.0 does not properly evaluate characters after the detection of a Cascading Style S… | Patch early | 4.3 medium | 18.6% | 2012-01-10 |
| CVE-2011-1564 EXP | Multiple integer overflows in the HMI application in DATAC RealFlex RealWin 2.1 (Build 6.1.10.10) and earlier allow remote attackers to execute arbitr… | Patch early | 10.0 high | 18.6% | 2011-04-05 |
| CVE-2019-0566 EXP | An elevation of privilege vulnerability exists in Microsoft Edge Browser Broker COM object, aka "Microsoft Edge Elevation of Privilege Vulnerability."… | Patch early | 8.8 high | 18.6% | 2019-01-08 |
| CVE-2007-6236 EXP | Microsoft Windows Media Player (WMP) allows remote attackers to cause a denial of service (application crash) via a certain AIFF file that triggers a… | Patch early | 5.0 medium | 18.6% | 2007-12-04 |
| CVE-2009-2994 EXP | Buffer overflow in Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2 might allow attackers to execute arbitrary code via… | Patch early | 9.3 high | 18.6% | 2009-10-19 |
| CVE-2007-5322 EXP | Insecure method vulnerability in the FPOLE.OCX 6.0.8450.0 ActiveX control in Microsoft Visual FoxPro 6.0 allows remote attackers to execute arbitrary… | Patch early | 7.5 high | 18.6% | 2007-10-09 |
| CVE-2010-0520 EXP | Heap-based buffer overflow in QuickTimeAuthoring.qtx in QuickTime in Apple Mac OS X before 10.6.3 allows remote attackers to execute arbitrary code or… | Patch early | 6.8 medium | 18.6% | 2010-03-30 |
| CVE-2018-19877 EXP | login.php in Adiscon LogAnalyzer before 4.1.7 has XSS via the Login Button Referer field. | Patch early | 6.1 medium | 18.6% | 2018-12-05 |
| CVE-2004-1623 EXP | The WAV file property handler in Windows XP SP1 allows remote attackers to cause a denial of service (infinite loop in Explorer) via a WAV file with a… | Patch early | 5.0 medium | 18.6% | 2004-10-22 |
| CVE-2018-4243 EXP | An issue was discovered in certain Apple products. iOS before 11.4 is affected. macOS before 10.13.5 is affected. tvOS before 11.4 is affected. watchO… | Patch early | 7.8 high | 18.5% | 2018-06-08 |
| CVE-2018-20469 EXP | An issue was discovered in Tyto Sahi Pro through 7.x.x and 8.0.0. A parameter in the web reports module is vulnerable to h2 SQL injection. This can be… | Patch early | 9.8 critical | 18.5% | 2019-06-17 |
| CVE-2010-2738 EXP | The Uniscribe (aka new Unicode Script Processor) implementation in USP10.DLL in Microsoft Windows XP SP2 and SP3, Server 2003 SP2, Vista SP1 and SP2,… | Patch early | 9.3 high | 18.5% | 2010-09-15 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt