CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
401,522 CVEs
1,734 on KEV
17,295 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-05
25,091 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2010-4719 EXP | Directory traversal vulnerability in JRadio (com_jradio) component before 1.5.1 for Joomla! allows remote attackers to read arbitrary files via direct… | Patch early | 7.5 high | 15.4% | 2011-02-01 |
| CVE-2018-20220 EXP | An issue was discovered on Teracue ENC-400 devices with firmware 2.56 and below. While the web interface requires authentication before it can be inte… | Patch early | 7.5 high | 15.4% | 2019-03-21 |
| CVE-2012-0677 EXP | Heap-based buffer overflow in Apple iTunes before 10.6.3 allows remote attackers to execute arbitrary code or cause a denial of service (application c… | Patch early | 9.3 high | 15.4% | 2012-06-12 |
| CVE-2010-3141 EXP | Untrusted search path vulnerability in Microsoft PowerPoint 2010 allows local users, and possibly remote attackers, to execute arbitrary code and cond… | Patch early | 9.3 high | 15.4% | 2010-08-27 |
| CVE-2007-1785 EXP | The RPC service in mediasvr.exe in CA BrightStor ARCserve Backup 11.5 SP2 build 4237 allows remote attackers to execute arbitrary code via crafted xdr… | Patch early | 7.1 high | 15.4% | 2007-03-31 |
| CVE-2009-3170 EXP | Stack-based buffer overflow in AIMP2 Audio Converter 2.53 (build 330) and earlier allows remote attackers to cause a denial of service (crash) or poss… | Patch early | 9.3 high | 15.4% | 2009-09-11 |
| CVE-2012-4886 EXP | Stack-based buffer overflow in wpsio.dll in Kingsoft WPS Office 2012 possibly 8.1.0.3238 allows remote attackers to execute arbitrary code via a long… | Patch early | 10.0 high | 15.3% | 2014-03-24 |
| CVE-2005-2943 EXP | Stack-based buffer overflow in sendmail in XMail before 1.22 allows remote attackers to execute arbitrary code via a long -t command line option. | Patch early | 7.5 high | 15.3% | 2005-10-13 |
| CVE-2017-1084 EXP | In FreeBSD before 11.2-RELEASE, multiple issues with the implementation of the stack guard-page reduce the protections afforded by the guard-page. Thi… | Patch early | 7.5 high | 15.3% | 2018-09-12 |
| CVE-2010-1535 EXP | Directory traversal vulnerability in the TRAVELbook (com_travelbook) component 1.0.1 for Joomla! allows remote attackers to read arbitrary files and p… | Patch early | 7.5 high | 15.3% | 2010-04-26 |
| CVE-2007-1777 EXP | Integer overflow in the zip_read_entry function in PHP 4 before 4.4.5 allows remote attackers to execute arbitrary code via a ZIP archive that contain… | Patch early | 7.5 high | 15.3% | 2007-03-30 |
| CVE-2007-4566 EXP | Multiple buffer overflows in the login mechanism in sidvault in Alpha Centauri Software SIDVault LDAP Server before 2.0f allow remote attackers to exe… | Patch early | 10.0 high | 15.3% | 2007-08-28 |
| CVE-2014-2913 EXP | Incomplete blacklist vulnerability in nrpe.c in Nagios Remote Plugin Executor (NRPE) 2.15 and earlier allows remote attackers to execute arbitrary com… | Patch early | 7.5 high | 15.3% | 2014-05-07 |
| CVE-2007-2031 EXP | Buffer overflow in the HTTP proxy service for 3proxy 0.5 to 0.5.3g, and 0.6b-devel before 20070413, might allow remote attackers to execute arbitrary… | Patch early | 10.0 high | 15.3% | 2007-04-16 |
| CVE-2019-13605 EXP | In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.838 to 0.9.8.846, remote attackers can bypass authentication in the login process by leveragin… | Patch early | 8.8 high | 15.3% | 2019-07-16 |
| CVE-2025-9090 EXP | A vulnerability was identified in Tenda AC20 16.03.08.12. Affected is the function websFormDefine of the file /goform/telnet of the component Telnet S… | Patch early | 6.3 medium | 15.3% | 2025-08-17 |
| CVE-2008-0984 EXP | The MP4 demuxer (mp4.c) for VLC media player 0.8.6d and earlier, as used in Miro Player 1.1 and earlier, allows remote attackers to overwrite arbitrar… | Patch early | 9.3 high | 15.3% | 2008-02-26 |
| CVE-2015-3456 EXP | The Floppy Disk Controller (FDC) in QEMU, as used in Xen 4.5.x and earlier and KVM, allows local guest users to cause a denial of service (out-of-boun… | Patch early | 7.7 high | 15.3% | 2015-05-13 |
| CVE-2018-5234 EXP | The Norton Core router prior to v237 may be susceptible to a command injection exploit. This is a type of attack in which the goal is execution of arb… | Patch early | 8.0 high | 15.3% | 2018-04-30 |
| CVE-2017-6558 EXP | iball Baton 150M iB-WRA150N v1 00000001 1.2.6 build 110401 Rel.47776n devices are prone to an authentication bypass vulnerability that allows remote a… | Patch early | 9.8 critical | 15.3% | 2017-03-09 |
| CVE-2005-2665 EXP | Stack-based buffer overflow in expires.c in Elm 2.5 PL5 through PL7, and possibly other versions, allows remote attackers to execute arbitrary code vi… | Patch early | 7.5 high | 15.3% | 2005-08-23 |
| CVE-2025-27210 EXP | An incomplete fix has been identified for CVE-2025-23084 in Node.js, specifically affecting Windows device names like CON, PRN, and AUX. This vuln… | Patch early | 7.5 high | 15.3% | 2025-07-18 |
| CVE-2004-2532 EXP | Serv-U FTP server before 5.1.0.0 has a default account and password for local administration, which allows local users to execute arbitrary commands b… | Patch early | 10.0 high | 15.3% | 2004-12-31 |
| CVE-2010-4977 EXP | SQL injection vulnerability in menu.php in the Canteen (com_canteen) component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL comman… | Patch early | 7.5 high | 15.3% | 2011-11-01 |
| CVE-2010-0759 EXP | Directory traversal vulnerability in plugins/system/cdscriptegrator/libraries/highslide/js/jsloader.php in the Core Design Scriptegrator plugin 1.4.1… | Patch early | 7.5 high | 15.2% | 2010-02-27 |
| CVE-2005-1477 EXP | The install function in Firefox 1.0.3 allows remote web sites on the browser's whitelist, such as update.mozilla.org or addon.mozilla.org, to execute… | Patch early | 5.1 medium | 15.2% | 2005-05-09 |
| CVE-2017-5799 EXP | A Remote Code Execution vulnerability in HPE OpenCall Media Platform (OCMP) was found. The vulnerability impacts OCMP versions prior to 3.4.2 RP201 (f… | Patch early | 8.8 high | 15.2% | 2018-02-15 |
| CVE-2009-1210 EXP | Format string vulnerability in the PROFINET/DCP (PN-DCP) dissector in Wireshark 1.0.6 and earlier allows remote attackers to execute arbitrary code vi… | Patch early | 10.0 high | 15.2% | 2009-04-01 |
| CVE-2001-0162 EXP | WinCE 3.0.9348 generates predictable TCP Initial Sequence Numbers (ISNs), which allows remote attackers to spoof or hijack TCP connections. | Patch early | 7.5 high | 15.2% | 2001-01-01 |
| CVE-2010-1185 EXP | Stack-based buffer overflow in serv.exe in SAP MaxDB 7.4.3.32, and 7.6.0.37 through 7.6.06 allows remote attackers to execute arbitrary code via an in… | Patch early | 10.0 high | 15.2% | 2010-03-29 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt