CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
402,085 CVEs
1,734 on KEV
17,294 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-06
12,664 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2009-0811 EXP | Insecure method vulnerability in the SopCast SopCore ActiveX control in sopocx.ocx 3.0.3.501 allows remote attackers to execute arbitrary programs via… | Patch early | 9.3 high | 5.5% | 2009-03-04 |
| CVE-2009-0865 EXP | Directory traversal vulnerability in the SnapShotToFile method in the GeoVision LiveX (aka LiveX_v8200) ActiveX control 8.1.2 and 8.2.0 in LIVEX_~1.OC… | Patch early | 8.8 high | 5.5% | 2009-03-10 |
| CVE-2007-1974 EXP | SQL injection vulnerability in the getArticle function in class/wfsarticle.php in WF-Section (aka WF-Sections) 1.0.1, as used in Xoops modules such as… | Patch early | 7.5 high | 5.5% | 2007-04-12 |
| CVE-2007-1439 EXP | PHP remote file inclusion vulnerability in ressourcen/dbopen.php in bitesser MySQL Commander 2.7 and earlier, when register_globals is enabled, allows… | Patch early | 9.3 high | 5.5% | 2007-03-13 |
| CVE-2013-6874 EXP | Stack-based buffer overflow in Vortex Light Alloy before 4.7.4 allows remote attackers to execute arbitrary code via a long URL in a .m3u file. | Patch early | 9.3 high | 5.5% | 2013-11-26 |
| CVE-2017-15235 EXP | The File Manager (gollem) module 3.0.11 in Horde Groupware 5.2.21 allows remote attackers to bypass Horde authentication for file downloads via a craf… | Patch early | 7.5 high | 5.5% | 2017-10-11 |
| CVE-2008-0952 EXP | The AppendStringToFile function in the HPISDataManagerLib.Datamgr ActiveX control in HPISDataManager.dll in HP Instant Support before 1.0.0.24 allows… | Patch early | 9.3 high | 5.5% | 2008-06-04 |
| CVE-2005-3135 EXP | Buffer overflow in Virtools Web Player 3.0.0.100 and earlier allows remote attackers to execute arbitrary code via a long filename. | Patch early | 7.5 high | 5.5% | 2005-10-04 |
| CVE-2003-0274 EXP | Buffer overflow in catmail for ListProc 8.2.09 and earlier allows remote attackers to execute arbitrary code via a long ULISTPROC_UMASK value. | Patch early | 10.0 high | 5.5% | 2003-05-27 |
| CVE-2023-30198 EXP | Prestashop winbizpayment <= 1.0.2 is vulnerable to Incorrect Access Control via modules/winbizpayment/downloads/download.php. | Patch early | 7.5 high | 5.5% | 2023-06-12 |
| CVE-2004-1728 EXP | Buffer overflow in British National Corpus SARA (sarad) allows remote attackers to execute arbitrary code by calling the client with a long string. | Patch early | 7.5 high | 5.5% | 2004-08-20 |
| CVE-2008-7162 EXP | Buffer overflow in Hero Super Player 3000 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long… | Patch early | 9.3 high | 5.5% | 2009-09-04 |
| CVE-2008-4932 EXP | webmail/modules/filesystem/edit.php in U-Mail Webmail server 4.91 allows remote attackers to overwrite arbitrary files via an absolute pathname in the… | Patch early | 9.0 high | 5.5% | 2008-11-05 |
| CVE-2010-3007 EXP | Unspecified vulnerability in HP Data Protector Express, and Data Protector Express Single Server Edition (SSE), 3.x before build 56936 and 4.x before… | Patch early | 7.2 high | 5.5% | 2010-09-09 |
| CVE-2002-1428 EXP | index.php in dotProject 0.2.1.5 allows remote attackers to bypass authentication via a cookie or URL with the user_cookie parameter set to 1. | Patch early | 10.0 high | 5.5% | 2003-04-11 |
| CVE-2017-15950 EXP | Flexense SyncBreeze Enterprise version 10.1.16 is vulnerable to a buffer overflow that can be exploited for arbitrary code execution. The flaw is trig… | Patch early | 7.8 high | 5.5% | 2017-10-31 |
| CVE-2017-14083 EXP | A vulnerability in Trend Micro OfficeScan 11.0 and XG allows remote unauthenticated users who can access the system to download the OfficeScan encrypt… | Patch early | 7.5 high | 5.5% | 2017-10-06 |
| CVE-2007-0955 EXP | The NTLM_UnPack_Type3 function in MENTLM.dll in MailEnable Professional 2.35 and earlier allows remote attackers to cause a denial of service (applica… | Patch early | 7.8 high | 5.5% | 2007-02-15 |
| CVE-2008-5756 EXP | Buffer overflow in BreakPoint Software Hex Workshop 5.1.4 allows user-assisted attackers to cause a denial of service and possibly execute arbitrary c… | Patch early | 9.3 high | 5.5% | 2008-12-30 |
| CVE-2005-4195 EXP | Multiple SQL injection vulnerabilities in Scout Portal Toolkit (SPT) 1.3.1 and earlier allow remote attackers to execute arbitrary SQL commands via (1… | Patch early | 7.5 high | 5.5% | 2005-12-13 |
| CVE-2019-6218 EXP | A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 12.1.3, macOS Mojave 10.14.3, tvOS 12.1.2. A malici… | Patch early | 7.8 high | 5.5% | 2019-03-05 |
| CVE-2016-1848 EXP | QuickTime in Apple OS X before 10.11.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafte… | Patch early | 7.8 high | 5.5% | 2016-05-20 |
| CVE-2005-4270 EXP | Buffer overflow in Watchfire AppScan QA 5.0.609 and 5.0.134 allows remote web servers to execute arbitrary code via an HTTP 401 response with a WWW-Au… | Patch early | 7.5 high | 5.5% | 2005-12-15 |
| CVE-2017-16542 EXP | Zoho ManageEngine Applications Manager 13 before build 13500 allows Post-authentication SQL injection via the name parameter in a manageApplications.d… | Patch early | 8.8 high | 5.5% | 2017-11-05 |
| CVE-2009-4148 EXP | DAZ Studio 2.3.3.161, 2.3.3.163, and 3.0.1.135 allows remote attackers to execute arbitrary JavaScript code via a (1) .ds, (2) .dsa, (3) .dse, or (4)… | Patch early | 9.3 high | 5.5% | 2009-12-04 |
| CVE-2002-1773 EXP | Buffer overflow in ICQ 2.6x for MacOS X 10.0 through 10.1.2 allows remote attackers to cause a denial of service and possibly execute arbitrary code v… | Patch early | 7.5 high | 5.5% | 2002-12-31 |
| CVE-2007-2744 EXP | Stack-based buffer overflow in the PrecisionID Barcode 1.9 ActiveX control in PrecisionID_Barcode.dll allows remote attackers to cause a denial of ser… | Patch early | 7.5 high | 5.5% | 2007-05-17 |
| CVE-2007-2814 EXP | Multiple stack-based buffer overflows in the Pegasus ImagN' ActiveX control (IMW32O40.OCX) 4.00.041 allow remote attackers to execute arbitrary code v… | Patch early | 7.5 high | 5.5% | 2007-05-22 |
| CVE-2007-0911 EXP | Off-by-one error in the str_ireplace function in PHP 5.2.1 might allow context-dependent attackers to cause a denial of service (crash). | Patch early | 7.8 high | 5.5% | 2007-02-13 |
| CVE-2009-3518 EXP | Argument injection vulnerability in the iim: URI handler in IBMIM.exe in IBM Installation Manager 1.3.2 and earlier, as used in IBM Rational Robot and… | Patch early | 9.3 high | 5.5% | 2009-10-01 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt