CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
401,289 CVEs
1,734 on KEV
17,292 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-05
12,664 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2001-0307 EXP | Bajie HTTP JServer 0.78, and other versions before 0.80, allows remote attackers to execute arbitrary commands via shell metacharacters in an HTTP req… | Patch early | 7.5 high | 7.9% | 2001-05-03 |
| CVE-2009-4679 EXP | Directory traversal vulnerability in the inertialFATE iF Portfolio Nexus (com_if_nexus) component 1.5 for Joomla! allows remote attackers to include a… | Patch early | 7.5 high | 7.9% | 2010-03-08 |
| CVE-2016-4469 EXP | Multiple cross-site request forgery (CSRF) vulnerabilities in Apache Archiva 1.3.9 and earlier allow remote attackers to hijack the authentication of… | Patch early | 8.8 high | 7.9% | 2016-07-28 |
| CVE-2007-3266 EXP | Directory traversal vulnerability in webif.cgi in ifnet WEBIF allows remote attackers to include and execute arbitrary local files a .. (dot dot) in t… | Patch early | 9.0 high | 7.9% | 2007-06-19 |
| CVE-2017-9747 EXP | The ieee_archive_p function in bfd/ieee.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, might allow r… | Patch early | 7.8 high | 7.9% | 2017-06-19 |
| CVE-2017-9748 EXP | The ieee_object_p function in bfd/ieee.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, might allow re… | Patch early | 7.8 high | 7.9% | 2017-06-19 |
| CVE-2015-1265 EXP | Multiple unspecified vulnerabilities in Google Chrome before 43.0.2357.65 allow attackers to cause a denial of service or possibly have other impact v… | Patch early | 7.5 high | 7.9% | 2015-05-20 |
| CVE-2002-0330 EXP | Cross-site scripting vulnerability in codeparse.php of Open Bulletin Board (OpenBB) 1.0.0 allows remote attackers to execute arbitrary script and stea… | Patch early | 7.5 high | 7.9% | 2002-06-25 |
| CVE-2005-0305 EXP | CRLF injection vulnerability in users.php in Siteman 1.1.10 and earlier allows remote attackers to add arbitrary users and gain privileges via the lin… | Patch early | 7.5 high | 7.9% | 2005-05-02 |
| CVE-2019-11660 EXP | Privileges manipulation in Micro Focus Data Protector, versions 10.00, 10.01, 10.02, 10.03, 10.04, 10.10, 10.20, 10.30, 10.40. This vulnerability coul… | Patch early | 7.8 high | 7.8% | 2019-09-13 |
| CVE-2006-4824 EXP | PHP remote file inclusion vulnerability in lib/activeutil.php in Quicksilver Forums (QSF) 1.2.1 and earlier allows remote attackers to execute arbitra… | Patch early | 7.5 high | 7.8% | 2006-09-15 |
| CVE-2006-4918 EXP | Multiple PHP remote file inclusion vulnerabilities in Simple Discussion Board 0.1.0 allow remote attackers to execute arbitrary PHP code via a URL in… | Patch early | 7.5 high | 7.8% | 2006-09-21 |
| CVE-2020-12712 EXP | A vulnerability based on insecure user/password encryption in the JOE (job editor) component of SOS JobScheduler 1.12 and 1.13 allows attackers to dec… | Patch early | 7.5 high | 7.8% | 2020-06-11 |
| CVE-2007-0020 EXP | Heap-based buffer overflow in the SFTP protocol handler for Panic Transmit (Transmit.app) up to 3.5.5 allows remote attackers to execute arbitrary cod… | Patch early | 9.3 high | 7.8% | 2007-01-24 |
| CVE-2006-4611 EXP | Buffer overflow in the _tor_resolve function in dsocks.c in dsocks before 1.4 allows remote attackers to execute arbitrary code via unspecified vector… | Patch early | 7.5 high | 7.8% | 2006-09-07 |
| CVE-1999-0101 EXP | Buffer overflow in AIX and Solaris "gethostbyname" library call allows root access through corrupt DNS host names. | Patch early | 10.0 high | 7.8% | 1996-12-10 |
| CVE-2008-4472 EXP | The UpdateEngine class in the LiveUpdate ActiveX control (LiveUpdate16.DLL 17.2.56), as used in Revit Architecture 2009 SP2 and Autodesk Design Review… | Patch early | 9.3 high | 7.8% | 2008-10-07 |
| CVE-2007-1890 EXP | Integer overflow in the msg_receive function in PHP 4 before 4.4.5 and PHP 5 before 5.2.1, on FreeBSD and possibly other platforms, allows context-dep… | Patch early | 7.5 high | 7.8% | 2007-04-06 |
| CVE-2010-3130 EXP | Untrusted search path vulnerability in TechSmith Snagit all versions 10.x and 11.x allows local users, and possibly remote attackers, to execute arbit… | Patch early | 9.3 high | 7.8% | 2010-08-26 |
| CVE-2026-46368 EXP | luci-app-https-dns-proxy through 2025.12.29-5 — an optional LuCI web UI add-on for the https-dns-proxy package, distributed through the OpenWrt commun… | Patch early | 8.8 high | 7.8% | 2026-05-26 |
| CVE-2007-4244 EXP | PHP remote file inclusion vulnerability in langset.php in J! Reactions (com_jreactions) 1.8.1 and earlier, a Joomla! component, allows remote attacker… | Patch early | 7.5 high | 7.8% | 2007-08-08 |
| CVE-2010-3126 EXP | Untrusted search path vulnerability in avast! Free Antivirus version 5.0.594 and earlier allows local users, and possibly remote attackers, to execute… | Patch early | 9.3 high | 7.8% | 2010-08-26 |
| CVE-2010-3137 EXP | Untrusted search path vulnerability in Nullsoft Winamp 5.581, and probably other versions, allows local users, and possibly remote attackers, to execu… | Patch early | 9.3 high | 7.8% | 2010-08-26 |
| CVE-2013-6343 EXP | Multiple buffer overflows in web.c in httpd on the ASUS RT-N56U and RT-AC66U routers with firmware 3.0.0.4.374_979 allow remote attackers to execute a… | Patch early | 10.0 high | 7.8% | 2014-01-22 |
| CVE-2002-0982 EXP | Microsoft SQL Server 2000 SP2, when configured as a distributor, allows attackers to execute arbitrary code via the @scriptfile parameter to the sp_MS… | Patch early | 7.5 high | 7.8% | 2002-09-24 |
| CVE-2018-10608 EXP | SEL AcSELerator Architect version 2.2.24.0 and prior can be exploited when the AcSELerator Architect FTP client connects to a malicious FTP server, wh… | Patch early | 7.5 high | 7.8% | 2018-07-24 |
| CVE-2012-3816 EXP | WinRadius Server 2009 allows remote attackers to cause a denial of service (crash) via a long password in an Access-Request packet. | Patch early | 7.8 high | 7.8% | 2012-06-27 |
| CVE-2008-6178 EXP | Unrestricted file upload vulnerability in editor/filemanager/browser/default/connectors/php/connector.php in FCKeditor 2.2, as used in Falt4 CMS, Nuke… | Patch early | 7.5 high | 7.8% | 2009-02-19 |
| CVE-2019-19142 EXP | Intelbras WRN240 devices do not require authentication to replace the firmware via a POST request to the incoming/Firmware.cfg URI. | Patch early | 7.5 high | 7.8% | 2020-01-17 |
| CVE-2000-0688 EXP | Subscribe Me LITE does not properly authenticate attempts to change the administrator password, which allows remote attackers to gain privileges for t… | Patch early | 7.5 high | 7.8% | 2000-10-20 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt