CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
401,371 CVEs
1,734 on KEV
17,295 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-05
25,091 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-1999-0095 EXP | The debug command in Sendmail is enabled, allowing attackers to execute commands as root. | Patch early | 10.0 high | 16.3% | 1988-10-01 |
| CVE-2010-3142 EXP | Untrusted search path vulnerability in Microsoft Office PowerPoint 2007 allows local users, and possibly remote attackers, to execute arbitrary code a… | Patch early | 9.3 high | 16.3% | 2010-08-27 |
| CVE-2007-4642 EXP | Multiple buffer overflows in Doomsday (aka deng) 1.9.0-beta5.1 and earlier allow remote attackers to execute arbitrary code via a long chat (PKT_CHAT)… | Patch early | 10.0 high | 16.3% | 2007-08-31 |
| CVE-2008-1320 EXP | Multiple buffer overflows in ASG-Sentry Network Manager 7.0.0 and earlier allow remote attackers to execute arbitrary code or cause a denial of servic… | Patch early | 10.0 high | 16.3% | 2008-03-13 |
| CVE-2007-1578 EXP | Multiple integer signedness errors in the NTLM implementation in Atrium MERCUR IMAPD (mcrimap4.exe) 5.00.14, with SP4, allow remote attackers to execu… | Patch early | 10.0 high | 16.3% | 2007-03-21 |
| CVE-2010-2862 EXP | Integer overflow in CoolType.dll in Adobe Reader 8.2.3 and 9.3.3, and Acrobat 9.3.3, allows remote attackers to execute arbitrary code via a TrueType… | Patch early | 9.3 high | 16.3% | 2010-08-05 |
| CVE-2007-2718 EXP | Cross-site scripting (XSS) vulnerability in the WebMail system in Stalker CommuniGate Pro 5.1.8 and earlier, when using Microsoft Internet Explorer, a… | Patch early | 4.3 medium | 16.3% | 2007-05-16 |
| CVE-2017-11151 EXP | A vulnerability in synotheme_upload.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to upload arbitrary files wit… | Patch early | 9.8 critical | 16.3% | 2017-08-08 |
| CVE-2006-5506 EXP | Multiple PHP remote file inclusion vulnerabilities in WiClear 0.10 allow remote attackers to execute arbitrary PHP code via the path parameter in (1)… | Patch early | 7.5 high | 16.3% | 2006-10-25 |
| CVE-2018-14485 EXP | BlogEngine.NET 3.3 allows XXE attacks via the POST body to metaweblog.axd. | Patch early | 9.8 critical | 16.3% | 2019-05-07 |
| CVE-2019-7262 EXP | Linear eMerge E3-Series devices allow Cross-Site Request Forgery (CSRF). | Patch early | 8.8 high | 16.3% | 2019-07-02 |
| CVE-2010-4543 EXP | Heap-based buffer overflow in the read_channel_data function in file-psp.c in the Paint Shop Pro (PSP) plugin in GIMP 2.6.11 allows remote attackers t… | Patch early | 7.5 high | 16.3% | 2011-01-07 |
| CVE-1999-0233 EXP | IIS 1.0 allows users to execute arbitrary commands using .bat or .cmd files. | Patch early | 10.0 high | 16.3% | 1996-02-25 |
| CVE-2011-0501 EXP | Stack-based buffer overflow in Music Animation Machine MIDI Player 2006aug19 Release 035 and possibly other versions allows user-assisted remote attac… | Patch early | 9.3 high | 16.3% | 2011-01-20 |
| CVE-2006-0911 EXP | NmService.exe in Ipswitch WhatsUp Professional 2006 allows remote attackers to cause a denial of service (CPU consumption) via crafted requests to Log… | Patch early | 5.0 medium | 16.3% | 2006-02-28 |
| CVE-2009-4019 EXP | mysqld in MySQL 5.0.x before 5.0.88 and 5.1.x before 5.1.41 does not (1) properly handle errors during execution of certain SELECT statements with sub… | Patch early | 4.0 medium | 16.3% | 2009-11-30 |
| CVE-2012-6649 EXP | WordPress WP GPX Maps Plugin 1.1.21 allows remote attackers to execute arbitrary PHP code via improper file upload. | Patch early | 9.8 critical | 16.3% | 2020-01-23 |
| CVE-2024-44871 EXP | An arbitrary file upload vulnerability in the component /admin/index.php of moziloCMS v3.0 allows attackers to execute arbitrary code via uploading a… | Patch early | 7.2 high | 16.2% | 2024-09-10 |
| CVE-2011-3491 EXP | Heap-based buffer overflow in Progea Movicon / PowerHMI 11.2.1085 and earlier allows remote attackers to cause a denial of service (crash) and possibl… | Patch early | 10.0 high | 16.2% | 2011-09-16 |
| CVE-2015-4666 EXP | Directory traversal vulnerability in opm/read_sessionlog.php in Xceedium Xsuite 2.4.4.5 and earlier allows remote attackers to read arbitrary files vi… | Patch early | 5.0 medium | 16.2% | 2015-08-13 |
| CVE-2009-4492 EXP | WEBrick 1.3.1 in Ruby 1.8.6 through patchlevel 383, 1.8.7 through patchlevel 248, 1.8.8dev, 1.9.1 through patchlevel 376, and 1.9.2dev writes data to… | Patch early | 7.5 high | 16.2% | 2010-01-13 |
| CVE-2020-11749 EXP | Pandora FMS 7.0 NG <= 746 suffers from Multiple XSS vulnerabilities in different browser views. A network administrator scanning a SNMP device can tri… | Patch early | 9.0 critical | 16.2% | 2020-07-13 |
| CVE-2017-6206 EXP | D-Link DGS-1510-28XMP, DGS-1510-28X, DGS-1510-52X, DGS-1510-52, DGS-1510-28P, DGS-1510-28, and DGS-1510-20 Websmart devices with firmware before 1.31.… | Patch early | 7.5 high | 16.2% | 2017-02-23 |
| CVE-2015-5065 EXP | Absolute path traversal vulnerability in proxy.php in the google currency lookup in the Paypal Currency Converter Basic For WooCommerce plugin before… | Patch early | 5.0 medium | 16.2% | 2015-06-24 |
| CVE-2018-11220 EXP | Bitmain Antminer D3, L3+, and S9 devices allow Remote Command Execution via the system restore function. | Patch early | 8.8 high | 16.2% | 2018-05-31 |
| CVE-1999-0039 EXP | webdist CGI program (webdist.cgi) in SGI IRIX allows remote attackers to execute arbitrary commands via shell metacharacters in the distloc parameter. | Patch early | 7.3 high | 16.2% | 1997-05-06 |
| CVE-2019-18396 EXP | An issue was discovered in certain Oi third-party firmware that may be installed on Technicolor TD5130v2 devices. A Command Injection in the Ping modu… | Patch early | 7.2 high | 16.2% | 2019-10-31 |
| CVE-2004-0474 EXP | Help Center (HelpCtr.exe) may allow remote attackers to read or execute arbitrary files via an "http://" or "file://" argument to the topic parameter… | Patch early | 5.1 medium | 16.2% | 2004-07-07 |
| CVE-2013-2571 EXP | Iris 3.8 before build 1548, as used in Xpient point of sale (POS) systems, allows remote attackers to execute arbitrary commands via a crafted request… | Patch early | 9.8 critical | 16.2% | 2020-01-28 |
| CVE-2009-3732 EXP | Format string vulnerability in vmware-vmrc.exe build 158248 in VMware Remote Console (aka VMrc) allows remote attackers to execute arbitrary code via… | Patch early | 10.0 high | 16.2% | 2010-04-12 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt