CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
401,567 CVEs
1,734 on KEV
17,295 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-06
12,664 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2004-2026 EXP | Format string vulnerability in the logmsg function in svc.c for Pound 1.5 and earlier allows remote attackers to execute arbitrary code via format str… | Patch early | 7.5 high | 6.6% | 2004-12-31 |
| CVE-2017-15013 EXP | OpenText Documentum Content Server (formerly EMC Documentum Content Server) through 7.3 contains the following design gap, which allows an authenticat… | Patch early | 8.8 high | 6.6% | 2017-10-13 |
| CVE-2007-0355 EXP | Buffer overflow in the Apple Minimal SLP v2 Service Agent (slpd) in Mac OS X 10.4.11 and earlier, including 10.4.8, allows local users, and possibly r… | Patch early | 7.2 high | 6.6% | 2007-01-19 |
| CVE-2015-8358 EXP | Directory traversal vulnerability in the bitrix.mpbuilder module before 1.0.12 for Bitrix allows remote administrators to include and execute arbitrar… | Patch early | 9.0 high | 6.6% | 2015-12-16 |
| CVE-2010-2102 EXP | Buffer overflow in Webby Webserver 1.01 allows remote attackers to execute arbitrary code via a long HTTP GET request. | Patch early | 10.0 high | 6.6% | 2010-05-27 |
| CVE-2007-0344 EXP | Multiple format string vulnerabilities in (1) _invitedToRoom: and (2) _invitedToDirectChat: in Colloquy 2.1 and earlier allow remote attackers to caus… | Patch early | 7.5 high | 6.6% | 2007-01-18 |
| CVE-2007-1455 EXP | Multiple absolute path traversal vulnerabilities in Fantastico, as used with cPanel 10.x, allow remote authenticated users to include and execute arbi… | Patch early | 9.0 high | 6.6% | 2007-03-14 |
| CVE-2008-3322 EXP | admin/index.php in Maian Recipe 1.2 and earlier allows remote attackers to bypass authentication and gain administrative access by sending an arbitrar… | Patch early | 7.5 high | 6.6% | 2008-07-25 |
| CVE-2009-3041 EXP | SPIP 1.9 before 1.9.2i and 2.0.x through 2.0.8 does not use proper access control for (1) ecrire/exec/install.php and (2) ecrire/index.php, which allo… | Patch early | 7.5 high | 6.6% | 2009-09-01 |
| CVE-2005-4316 EXP | HP-UX B.11.00, B.11.04, B.11.11, and B.11.23 allows remote attackers to cause a denial of service via a "Rose Attack" that involves sending a subset o… | Patch early | 7.8 high | 6.6% | 2005-12-17 |
| CVE-2002-2251 EXP | Buffer overflow in the changevalue function in libcgi.h for Marcos Luiz Onisto Lib CGI 0.1 allows remote attackers to execute arbitrary code via a lon… | Patch early | 10.0 high | 6.6% | 2002-12-31 |
| CVE-2002-1135 EXP | modsecurity.php 1.10 and earlier, in phpWebSite 0.8.2 and earlier, allows remote attackers to execute arbitrary PHP source code via an inc_prefix para… | Patch early | 7.5 high | 6.6% | 2002-10-04 |
| CVE-2005-1222 EXP | cat_for_gen.php in Annuaire Netref 4.2 allows remote attackers to execute arbitrary PHP code by setting the ad_direct parameter to reference cat_for_g… | Patch early | 7.5 high | 6.6% | 2005-05-02 |
| CVE-2007-1446 EXP | Multiple PHP remote file inclusion vulnerabilities in Open Education System (OES) 0.1beta allow remote attackers to execute arbitrary PHP code via a U… | Patch early | 7.5 high | 6.6% | 2007-03-14 |
| CVE-2013-4978 EXP | Stack-based buffer overflow in AloahaPDFViewer 5.0.0.7 and earlier in Aloaha PDF Suite FREE allows remote attackers to execute arbitrary code via a cr… | Patch early | 9.3 high | 6.6% | 2014-02-05 |
| CVE-2010-0364 EXP | Stack-based buffer overflow in VideoLAN VLC Media Player 0.8.6 allows user-assisted remote attackers to execute arbitrary code via an ogg file with a… | Patch early | 9.3 high | 6.6% | 2010-01-21 |
| CVE-2004-1441 EXP | Cross-site scripting (XSS) vulnerability in icq.cgi in Board Power 2.04PF allows remote attackers to inject arbitrary web script or HTML via the actio… | Patch early | 9.3 high | 6.6% | 2004-12-31 |
| CVE-2003-0833 EXP | Stack-based buffer overflow in webfs before 1.20 allows attackers to execute arbitrary code by creating directories that result in a long pathname. | Patch early | 7.5 high | 6.6% | 2003-11-17 |
| CVE-2000-0038 EXP | glFtpD includes a default glftpd user account with a default password and a UID of 0. | Patch early | 7.5 high | 6.6% | 1999-12-23 |
| CVE-2017-2531 EXP | An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. Safari before 10.1.1 is affected. tvOS before 10.2.1 is affected. Th… | Patch early | 8.8 high | 6.6% | 2017-05-22 |
| CVE-2017-6980 EXP | An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. Safari before 10.1.1 is affected. tvOS before 10.2.1 is affected. Th… | Patch early | 8.8 high | 6.6% | 2017-05-22 |
| CVE-1999-0235 EXP | Buffer overflow in NCSA WebServer (1.4.1 and below) gives remote access. | Patch early | 10.0 high | 6.6% | 1995-02-17 |
| CVE-2005-1681 EXP | PHP remote file inclusion vulnerability in common.php in phpATM 1.21, and possibly earlier versions, allows remote attackers to execute arbitrary PHP… | Patch early | 7.5 high | 6.6% | 2005-05-20 |
| CVE-2005-2729 EXP | The HTTP proxy in Astaro Security Linux 6.0 does not properly filter HTTP CONNECT requests to localhost, which allows remote attackers to bypass firew… | Patch early | 7.5 high | 6.6% | 2005-08-30 |
| CVE-2015-2527 EXP | The process-initialization implementation in win32k.sys in the kernel-mode drivers in Microsoft Windows 8, Windows 8.1, Windows Server 2012 Gold and R… | Patch early | 7.2 high | 6.6% | 2015-09-09 |
| CVE-2008-2930 EXP | Red Hat Directory Server 7.1 before SP7, Red Hat Directory Server 8, and Fedora Directory Server 1.1.1 allow remote attackers to cause a denial of ser… | Patch early | 7.1 high | 6.6% | 2008-08-29 |
| CVE-2007-2081 EXP | MyBlog 0.9.8 and earlier allows remote attackers to bypass authentication requirements via the admin cookie parameter to certain admin files, as demon… | Patch early | 7.5 high | 6.6% | 2007-04-18 |
| CVE-2004-2003 EXP | Buffer overflow in the ssl_prcert function in the SSLway filter (sslway.c) for DeleGate 8.9.2 and earlier allows remote attackers to execute arbitrary… | Patch early | 7.5 high | 6.6% | 2004-05-06 |
| CVE-2016-9950 EXP | An issue was discovered in Apport before 2.20.4. There is a path traversal issue in the Apport crash file "Package" and "SourcePackage" fields. These… | Patch early | 7.8 high | 6.5% | 2016-12-17 |
| CVE-2004-1784 EXP | Buffer overflow in the web server of Webcam Watchdog 3.63 allows remote attackers to execute arbitrary code via a long HTTP GET request. | Patch early | 7.5 high | 6.5% | 2004-01-03 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt