CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
398,528 CVEs
1,726 on KEV
17,265 EPSS ≥ 10%
25,086 with exploits
synced 2026-09-27
10,151 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2002-0659 EXP | The ASN1 library in OpenSSL 0.9.6d and earlier, and 0.9.7-beta2 and earlier, allows remote attackers to cause a denial of service via invalid encoding… | Patch early | 5.0 medium | 36.2% | 2002-08-12 |
| CVE-2003-0231 EXP | Microsoft SQL Server 7, 2000, and MSDE allows local or remote authenticated users to cause a denial of service (crash or hang) via a long request to a… | Patch early | 5.0 medium | 36.2% | 2003-08-27 |
| CVE-1999-1412 EXP | A possible interaction between Apple MacOS X release 1.0 and Apache HTTP server allows remote attackers to cause a denial of service (crash) via a flo… | Patch early | 5.0 medium | 35.9% | 1999-06-03 |
| CVE-2006-5162 EXP | wininet.dll in Microsoft Internet Explorer 6.0 SP2 and earlier allows remote attackers to cause a denial of service (unhandled exception and crash) vi… | Patch early | 5.0 medium | 35.9% | 2006-10-05 |
| CVE-2014-8998 EXP | lib/message.php in X7 Chat 2.0.0 through 2.0.5.1 allows remote authenticated users to execute arbitrary PHP code via a crafted HTTP header to index.ph… | Patch early | 6.5 medium | 35.9% | 2014-11-20 |
| CVE-2000-0097 EXP | The WebHits ISAPI filter in Microsoft Index Server allows remote attackers to read arbitrary files, aka the "Malformed Hit-Highlighting Argument" vuln… | Patch early | 5.0 medium | 35.9% | 2000-01-26 |
| CVE-2008-5626 EXP | XM Easy Personal FTP Server 5.6.0 allows remote authenticated users to cause a denial of service via a crafted argument to the NLST command, as demons… | Patch early | 4.0 medium | 35.9% | 2008-12-17 |
| CVE-2004-2074 EXP | Format string vulnerability in Dream FTP 1.02 allows local users to cause a denial of service (crash) via format string specifiers in the (1) PASS or… | Patch early | 5.0 medium | 35.8% | 2004-12-31 |
| CVE-2006-1516 EXP | The check_connection function in sql_parse.cc in MySQL 4.0.x up to 4.0.26, 4.1.x up to 4.1.18, and 5.0.x up to 5.0.20 allows remote attackers to read… | Patch early | 5.0 medium | 35.8% | 2006-05-05 |
| CVE-2012-6330 EXP | The localization functionality in TWiki before 5.1.3, and Foswiki 1.0.x through 1.0.10 and 1.1.x through 1.1.6, allows remote attackers to cause a den… | Patch early | 5.0 medium | 35.7% | 2013-01-04 |
| CVE-1999-1575 EXP | The Kodak/Wang (1) Image Edit (imgedit.ocx), (2) Image Annotation (imgedit.ocx), (3) Image Scan (imgscan.ocx), (4) Thumbnail Image (imgthumb.ocx), (5)… | Patch early | 5.1 medium | 35.6% | 1999-09-10 |
| CVE-2005-2119 EXP | The MIDL_user_allocate function in the Microsoft Distributed Transaction Coordinator (MSDTC) proxy (MSDTCPRX.DLL) allocates a 4K page of memory regard… | Patch early | 5.0 medium | 35.5% | 2005-10-12 |
| CVE-2014-0038 EXP | The compat_sys_recvmmsg function in net/compat.c in the Linux kernel before 3.13.2, when CONFIG_X86_X32 is enabled, allows local users to gain privile… | Patch early | 6.9 medium | 35.5% | 2014-02-06 |
| CVE-1999-0015 EXP | Teardrop IP denial of service. | Patch early | 5.0 medium | 35.4% | 1997-12-16 |
| CVE-2012-6081 EXP | Multiple unrestricted file upload vulnerabilities in the (1) twikidraw (action/twikidraw.py) and (2) anywikidraw (action/anywikidraw.py) actions in Mo… | Patch early | 6.0 medium | 35.3% | 2013-01-03 |
| CVE-2017-0063 EXP | The Color Management Module (ICM32.dll) memory handling functionality in Windows Vista SP2; Windows Server 2008 SP2 and R2; and Windows 7 SP1; Windows… | Patch early | 6.5 medium | 35.3% | 2017-03-17 |
| CVE-2010-2103 EXP | Cross-site scripting (XSS) vulnerability in axis2-admin/axis2-admin/engagingglobally in the administration console in Apache Axis2/Java 1.4.1, 1.5.1,… | Patch early | 4.3 medium | 34.9% | 2010-05-27 |
| CVE-2006-6334 EXP | Heap-based buffer overflow in the SendChannelData function in wfica.ocx in Citrix Presentation Server Client before 9.230 for Windows allows remote ma… | Patch early | 6.8 medium | 34.8% | 2006-12-08 |
| CVE-2003-0866 EXP | The Catalina org.apache.catalina.connector.http package in Tomcat 4.0.x up to 4.0.3 allows remote attackers to cause a denial of service via several r… | Patch early | 5.0 medium | 34.8% | 2003-11-17 |
| CVE-2001-1186 EXP | Microsoft IIS 5.0 allows remote attackers to cause a denial of service via an HTTP request with a content-length value that is larger than the size of… | Patch early | 5.0 medium | 34.7% | 2001-12-11 |
| CVE-2007-4006 EXP | Buffer overflow in Mike Dubman Windows RSH daemon (rshd) 1.7 has unknown impact and remote attack vectors, aka ZD-00000034. NOTE: this information is… | Patch early | 6.8 medium | 34.5% | 2007-07-26 |
| CVE-2009-0595 EXP | PHP remote file inclusion vulnerability in skysilver/login.tpl.php in phpSkelSite 1.4, when register_globals is enabled and magic_quotes_gpc is disabl… | Patch early | 5.1 medium | 34.4% | 2009-02-16 |
| CVE-2003-0227 EXP | The logging capability for unicast and multicast transmissions in the ISAPI extension for Microsoft Windows Media Services in Microsoft Windows NT 4.0… | Patch early | 5.0 medium | 34.4% | 2003-06-09 |
| CVE-2006-3961 EXP | Buffer overflow in McSubMgr ActiveX control (mcsubmgr.dll) in McAfee Security Center 6.0.23 for Internet Security Suite 2006, Wireless Home Network Se… | Patch early | 6.8 medium | 34.4% | 2006-08-01 |
| CVE-2007-2918 EXP | Multiple stack-based buffer overflows in ActiveX controls (1) VibeC in (a) vibecontrol.dll, (2) CallManager and (3) ViewerClient in (b) StarClient.dll… | Patch early | 6.8 medium | 34.1% | 2007-06-01 |
| CVE-2013-5447 EXP | Stack-based buffer overflow in IBM Forms Viewer 4.x before 4.0.0.3 and 8.x before 8.0.1.1 allows remote attackers to execute arbitrary code via an XFD… | Patch early | 6.8 medium | 34% | 2013-12-10 |
| CVE-2002-1790 EXP | The SMTP service in Microsoft Internet Information Services (IIS) 4.0 and 5.0 allows remote attackers to bypass anti-relaying rules and send spam or s… | Patch early | 5.0 medium | 34% | 2002-12-31 |
| CVE-2011-4367 EXP | Multiple directory traversal vulnerabilities in MyFaces JavaServer Faces (JSF) in Apache MyFaces Core 2.0.x before 2.0.12 and 2.1.x before 2.1.6 allow… | Patch early | 5.0 medium | 33.7% | 2014-06-19 |
| CVE-2015-2995 EXP | The RdsLogsEntry servlet in SysAid Help Desk before 15.2 does not properly check file extensions, which allows remote attackers to upload and execute… | Patch early | 6.8 medium | 33.6% | 2015-06-08 |
| CVE-2010-5299 EXP | Stack-based buffer overflow in MicroP 0.1.1.1600 allows remote attackers to execute arbitrary code via a crafted .mppl file. NOTE: it has been report… | Patch early | 6.8 medium | 33.6% | 2014-05-23 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt