CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
401,488 CVEs
1,734 on KEV
17,295 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-05
25,091 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2008-2427 EXP | Stack-based buffer overflow in NConvert 4.92, GFL SDK 2.82, and XnView 1.93.6 on Windows and 1.70 on Linux and FreeBSD allows user-assisted remote att… | Patch early | 9.3 high | 16.1% | 2008-06-24 |
| CVE-2005-2103 EXP | Buffer overflow in the AIM and ICQ module in Gaim before 1.5.0 allows remote attackers to cause a denial of service (application crash) and possibly e… | Patch early | 9.8 critical | 16.1% | 2005-08-16 |
| CVE-2007-4938 EXP | Heap-based buffer overflow in libmpdemux/aviheader.c in MPlayer 1.0rc1 and earlier allows remote attackers to cause a denial of service (application c… | Patch early | 7.6 high | 16% | 2007-09-18 |
| CVE-2018-1247 EXP | RSA Authentication Manager Security Console, version 8.3 and earlier, contains a XML External Entity (XXE) vulnerability. This could potentially allow… | Patch early | 7.1 high | 16% | 2018-05-08 |
| CVE-2021-24276 EXP | The Contact Form by Supsystic WordPress plugin before 1.7.15 did not sanitise the tab parameter of its options page before outputting it in an attribu… | Patch early | 6.1 medium | 16% | 2021-05-05 |
| CVE-2017-14016 EXP | A Stack-based Buffer Overflow issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. The application lacks proper validation of… | Patch early | 6.3 medium | 16% | 2017-11-06 |
| CVE-2010-4231 EXP | Directory traversal vulnerability in the web-based administration interface on the Camtron CMNC-200 Full HD IP Camera and TecVoz CMNC-200 Megapixel IP… | Patch early | 7.8 high | 16% | 2010-11-17 |
| CVE-2015-8396 EXP | Integer overflow in the ImageRegionReader::ReadIntoBuffer function in MediaStorageAndFileFormat/gdcmImageRegionReader.cxx in Grassroots DICOM (aka GDC… | Patch early | 10.0 critical | 16% | 2016-01-12 |
| CVE-2001-0679 EXP | A buffer overflow in InterScan VirusWall 3.23 and 3.3 allows a remote attacker to execute arbitrary code by sending a long HELO command to the server. | Patch early | 10.0 high | 16% | 1999-11-08 |
| CVE-2018-15442 EXP | A vulnerability in the update service of Cisco Webex Meetings Desktop App for Windows could allow an authenticated, local attacker to execute arbitrar… | Patch early | 7.8 high | 16% | 2018-10-24 |
| CVE-2019-8045 EXP | Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015… | Patch early | 9.8 critical | 16% | 2019-08-20 |
| CVE-2004-2090 EXP | Microsoft Internet Explorer 5.0.1 through 6.0 allows remote attackers to determine the existence of arbitrary files via the VBScript LoadPicture metho… | Patch early | 5.0 medium | 16% | 2004-02-07 |
| CVE-2010-1658 EXP | Directory traversal vulnerability in the Code-Garage NoticeBoard (com_noticeboard) component 1.3 for Joomla! allows remote attackers to read arbitrary… | Patch early | 5.0 medium | 16% | 2010-05-03 |
| CVE-2009-0341 EXP | The shell32 module in Microsoft Internet Explorer 7.0 on Windows XP SP3 might allow remote attackers to execute arbitrary code via a long VALUE attrib… | Patch early | 9.3 high | 16% | 2009-01-29 |
| CVE-2017-12785 EXP | The novish command-line interface, included in the NoviWare software distribution through NW400.2.6 and deployed on NoviSwitch devices, is prone to a… | Patch early | 9.8 critical | 16% | 2017-08-22 |
| CVE-2020-28351 EXP | The conferencing component on Mitel ShoreTel 19.46.1802.0 devices could allow an unauthenticated attacker to conduct a reflected cross-site scripting… | Patch early | 6.1 medium | 16% | 2020-11-09 |
| CVE-2004-1170 EXP | a2ps 4.13 allows remote attackers to execute arbitrary commands via shell metacharacters in the filename. | Patch early | 10.0 high | 16% | 2005-01-10 |
| CVE-2006-3468 EXP | Linux kernel 2.6.x, when using both NFS and EXT3, allows remote attackers to cause a denial of service (file system panic) via a crafted UDP packet wi… | Patch early | 7.8 high | 16% | 2006-07-21 |
| CVE-2024-8945 EXP | A vulnerability has been found in CodeCanyon RISE Ultimate Project Manager 3.7.0 and classified as critical. This vulnerability affects unknown code o… | Patch early | 5.5 medium | 16% | 2024-09-17 |
| CVE-2020-23934 EXP | An issue was discovered in RiteCMS 2.2.1. An authenticated user can directly execute system commands by uploading a php web shell in the "Filemanager"… | Patch early | 8.8 high | 16% | 2020-08-18 |
| CVE-2012-1831 EXP | Heap-based buffer overflow in WellinTech KingView 6.53 allows remote attackers to execute arbitrary code via a crafted packet to TCP port 555. | Patch early | 10.0 high | 15.9% | 2012-07-05 |
| CVE-2017-0060 EXP | The Graphics Device Interface (GDI) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 201… | Patch early | 5.5 medium | 15.9% | 2017-03-17 |
| CVE-2001-0336 EXP | The Microsoft MS00-060 patch for IIS 5.0 and earlier introduces an error which allows attackers to cause a denial of service via a malformed request. | Patch early | 5.0 medium | 15.9% | 2001-06-27 |
| CVE-2010-0943 EXP | Directory traversal vulnerability in the JA Showcase (com_jashowcase) component for Joomla! allows remote attackers to read arbitrary files via a .. (… | Patch early | 5.0 medium | 15.9% | 2010-03-08 |
| CVE-2020-23935 EXP | Kabir Alhasan Student Management System 1.0 is vulnerable to Authentication Bypass via "Username: admin'# && Password: (Write Something)". | Patch early | 9.8 critical | 15.9% | 2020-08-20 |
| CVE-2017-7455 EXP | Moxa MXView 2.8 allows remote attackers to read web server's private key file, no access control. | Patch early | 7.5 high | 15.9% | 2017-04-14 |
| CVE-2005-3299 EXP | PHP file inclusion vulnerability in grab_globals.lib.php in phpMyAdmin 2.6.4 and 2.6.4-pl1 allows remote attackers to include local files via the $__r… | Patch early | 5.0 medium | 15.9% | 2005-10-23 |
| CVE-2010-1314 EXP | Directory traversal vulnerability in the Highslide JS (com_hsconfig) component 1.5 and 2.0.9 for Joomla! allows remote attackers to read arbitrary fil… | Patch early | 5.0 medium | 15.9% | 2010-04-08 |
| CVE-2010-1354 EXP | Directory traversal vulnerability in the VJDEO (com_vjdeo) component 1.0 and 1.0.1 for Joomla! allows remote attackers to read arbitrary files via a .… | Patch early | 5.0 medium | 15.9% | 2010-04-12 |
| CVE-2010-1532 EXP | Directory traversal vulnerability in the givesight PowerMail Pro (com_powermail) component 1.5.3 for Joomla! allows remote attackers to read arbitrary… | Patch early | 5.0 medium | 15.9% | 2010-04-26 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt