CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
401,371 CVEs
1,734 on KEV
17,295 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-05
25,091 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2000-1058 EXP | Buffer overflow in OverView5 CGI program in HP OpenView Network Node Manager (NNM) 6.1 and earlier allows remote attackers to cause a denial of servic… | Patch early | 5.0 medium | 16.2% | 2000-12-11 |
| CVE-2010-4709 EXP | Heap-based buffer overflow in Automated Solutions Modbus/TCP Master OPC Server before 3.0.2 allows remote attackers to cause a denial of service (cras… | Patch early | 7.6 high | 16.2% | 2011-01-28 |
| CVE-2007-3488 EXP | Heap-based buffer overflow in the viewer ActiveX control in Sony Network Camera SNC-RZ25N before 1.30; SNC-P1 and SNC-P5 before 1.29; SNC-CS10 and SNC… | Patch early | 10.0 high | 16.2% | 2007-06-29 |
| CVE-2014-7140 EXP | Unspecified vulnerability in the management interface in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway 10.x before 10.1… | Patch early | 7.5 high | 16.2% | 2014-10-21 |
| CVE-2004-1292 EXP | Buffer overflow in the parse_emelody function in parse_emelody.c for ringtonetools 2.22 allows remote attackers to execute arbitrary code via a crafte… | Patch early | 10.0 high | 16.2% | 2005-01-10 |
| CVE-2017-1000251 EXP | The native Bluetooth stack in the Linux Kernel (BlueZ), starting at the Linux kernel version 2.6.32 and up to and including 4.13.1, are vulnerable to… | Patch early | 8.0 high | 16.2% | 2017-09-12 |
| CVE-2017-10355 EXP | Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected a… | Patch early | 5.3 medium | 16.2% | 2017-10-19 |
| CVE-2017-6971 EXP | AlienVault USM and OSSIM before 5.3.7 and NfSen before 1.3.8 allow remote authenticated users to execute arbitrary commands in a privileged context, o… | Patch early | 8.8 high | 16.2% | 2017-03-22 |
| CVE-2010-3599 EXP | Unspecified vulnerability in the Oracle Document Capture component in Oracle Fusion Middleware 10.1.3.4 and 10.1.3.5 allows remote attackers to affect… | Patch early | 9.4 high | 16.2% | 2011-01-19 |
| CVE-2018-10655 EXP | DLPnpAuditor.exe in DeviceLock Plug and Play Auditor (freeware) 5.72 has a Unicode Buffer Overflow (SEH). | Patch early | 7.8 high | 16.2% | 2018-05-10 |
| CVE-2005-0101 EXP | Buffer overflow in the socket_getline function in Newspost 2.1.1 and earlier allows remote malicious NNTP servers to execute arbitrary code via a long… | Patch early | 7.5 high | 16.2% | 2005-02-01 |
| CVE-2004-1018 EXP | Multiple integer handling errors in PHP before 4.3.10 allow attackers to bypass safe mode restrictions, cause a denial of service, or execute arbitrar… | Patch early | 10.0 high | 16.2% | 2005-01-10 |
| CVE-2020-15956 EXP | ActiveMediaServer.exe in ACTi NVR3 Standard Server 3.0.12.42 allows remote unauthenticated attackers to trigger a buffer overflow and application term… | Patch early | 7.5 high | 16.2% | 2020-08-04 |
| CVE-2008-0748 EXP | Buffer overflow in the Sony AxRUploadServer.AxRUploadControl.1 ActiveX control in AxRUploadServer.dll 1.0.0.38 in SonyISUpload.cab 1.0.0.38 for Sony I… | Patch early | 10.0 high | 16.2% | 2008-02-13 |
| CVE-2006-4384 EXP | Heap-based buffer overflow in Apple QuickTime before 7.1.3 allows user-assisted remote attackers to execute arbitrary code via the COLOR_64 chunk in a… | Patch early | 5.1 medium | 16.2% | 2006-09-12 |
| CVE-2010-1471 EXP | Directory traversal vulnerability in the AddressBook (com_addressbook) component 1.5.0 for Joomla! allows remote attackers to read arbitrary files via… | Patch early | 7.5 high | 16.2% | 2010-04-19 |
| CVE-2010-1953 EXP | Directory traversal vulnerability in the iNetLanka Multiple Map (com_multimap) component 1.0 for Joomla! allows remote attackers to read arbitrary fil… | Patch early | 7.5 high | 16.2% | 2010-05-19 |
| CVE-2010-1954 EXP | Directory traversal vulnerability in the iNetLanka Multiple root (com_multiroot) component 1.0 and 1.1 for Joomla! allows remote attackers to read arb… | Patch early | 7.5 high | 16.2% | 2010-05-19 |
| CVE-2007-0656 EXP | PHP remote file inclusion vulnerability in includes/functions.php in phpBB2-MODificat 0.2.0 and earlier allows remote attackers to execute arbitrary P… | Patch early | 7.5 high | 16.2% | 2007-02-01 |
| CVE-2013-1603 EXP | An Authentication vulnerability exists in D-LINK WCS-1100 1.02, TESCO DCS-2121 1.05_TESCO, TESCO DCS-2102 1.05_TESCO, DCS-7510 1.00, DCS-7410 1.00, DC… | Patch early | 5.3 medium | 16.1% | 2020-01-28 |
| CVE-2017-7981 EXP | Tuleap before 9.7 allows command injection via the PhpWiki 1.3.10 SyntaxHighlighter plugin. This occurs in the Project Wiki component because the proc… | Patch early | 8.8 high | 16.1% | 2017-04-29 |
| CVE-2002-1809 EXP | The default configuration of the Windows binary release of MySQL 3.23.2 through 3.23.52 has a NULL root password, which could allow remote attackers t… | Patch early | 7.5 high | 16.1% | 2002-12-31 |
| CVE-2001-1067 EXP | Buffer overflow in AOLserver 3.0 allows remote attackers to cause a denial of service, and possibly execute arbitrary code, via an HTTP request with a… | Patch early | 10.0 high | 16.1% | 2001-08-31 |
| CVE-2006-0230 EXP | Symantec Scan Engine 5.0.0.24, and possibly other versions before 5.1.0.7, uses a client-side check to verify a password, which allows remote attacker… | Patch early | 10.0 high | 16.1% | 2006-04-25 |
| CVE-2010-1929 EXP | Multiple stack-based buffer overflows in the jclient._Java_novell_jclient_JClient_defineClass@20 function in jclient.dll in the Tomcat web server in N… | Patch early | 9.0 high | 16.1% | 2010-06-28 |
| CVE-2009-1872 EXP | Multiple cross-site scripting (XSS) vulnerabilities in Adobe ColdFusion Server 8.0.1, 8, and earlier allow remote attackers to inject arbitrary web sc… | Patch early | 4.3 medium | 16.1% | 2009-08-18 |
| CVE-2025-34077 EXP | An authentication bypass vulnerability exists in the WordPress Pie Register plugin ≤ 3.7.1.4 that allows unauthenticated attackers to impersonate arbi… | Patch early | — | 16.1% | 2025-07-09 |
| CVE-2013-7137 EXP | The "remember me" functionality in login.php in Burden before 1.8.1 allows remote attackers to bypass authentication and gain privileges by setting th… | Patch early | 9.8 critical | 16.1% | 2014-01-26 |
| CVE-2006-5084 EXP | Format string vulnerability in the NSRunAlertPanel function in eBay Skype for Mac 1.5.*.79 and earlier allows remote attackers to cause a denial of se… | Patch early | 7.5 high | 16.1% | 2006-09-29 |
| CVE-2007-2362 EXP | Multiple buffer overflows in MyDNS 1.1.0 allow remote attackers to (1) cause a denial of service (daemon crash) and possibly execute arbitrary code vi… | Patch early | 9.0 high | 16.1% | 2007-04-30 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt