CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
398,529 CVEs
1,726 on KEV
17,265 EPSS ≥ 10%
25,086 with exploits
synced 2026-09-27
12,661 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2015-0318 EXP | Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to… | Patch early | 10.0 high | 75.2% | 2015-02-06 |
| CVE-2015-1497 EXP | radexecd.exe in Persistent Systems Radia Client Automation (RCA) 7.9, 8.1, 9.0, and 9.1 allows remote attackers to execute arbitrary commands via a cr… | Patch early | 10.0 high | 75.1% | 2015-02-16 |
| CVE-2009-2629 EXP | Buffer underflow in src/http/ngx_http_parse.c in nginx 0.1.0 through 0.5.37, 0.6.x before 0.6.39, 0.7.x before 0.7.62, and 0.8.x before 0.8.15 allows… | Patch early | 7.5 high | 75.1% | 2009-09-15 |
| CVE-2006-3942 EXP | The server driver (srv.sys) in Microsoft Windows NT 4.0, 2000, XP, and Server 2003 allows remote attackers to cause a denial of service (system crash)… | Patch early | 7.8 high | 75% | 2006-07-31 |
| CVE-2006-4688 EXP | Buffer overflow in Client Service for NetWare (CSNW) in Microsoft Windows 2000 SP4, XP SP2, and Server 2003 up to SP1 allows remote attackers to execu… | Patch early | 7.5 high | 75% | 2006-11-14 |
| CVE-2016-1525 EXP | Directory traversal vulnerability in data/config/image.do in NETGEAR Management System NMS300 1.5.0.11 and earlier allows remote authenticated users t… | Patch early | 8.6 high | 75% | 2016-02-13 |
| CVE-2006-0476 EXP | Buffer overflow in Nullsoft Winamp 5.12 allows remote attackers to execute arbitrary code via a playlist (pls) file with a long file name (File1 field… | Patch early | 7.6 high | 75% | 2006-01-31 |
| CVE-2005-0116 EXP | AWStats 6.1, and other versions before 6.3, allows remote attackers to execute arbitrary commands via shell metacharacters in the configdir parameter… | Patch early | 7.5 high | 74.9% | 2005-01-18 |
| CVE-2009-0920 EXP | Stack-based buffer overflow in OvCgi/Toolbar.exe in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allows remote attackers to execute… | Patch early | 7.5 high | 74.9% | 2009-03-25 |
| CVE-2001-0550 EXP | wu-ftpd 2.6.1 allows remote attackers to execute arbitrary commands via a "~{" argument to commands such as CWD, which is not properly handled by the… | Patch early | 7.5 high | 74.8% | 2001-11-30 |
| CVE-2002-1643 EXP | Multiple buffer overflows in RealNetworks Helix Universal Server 9.0 (9.0.2.768) allow remote attackers to execute arbitrary code via (1) a long Trans… | Patch early | 7.5 high | 74.7% | 2002-12-19 |
| CVE-2004-0206 EXP | Network Dynamic Data Exchange (NetDDE) services for Microsoft Windows 98, Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 allows att… | Patch early | 7.5 high | 74.7% | 2004-11-03 |
| CVE-1999-0874 EXP | Buffer overflow in IIS 4.0 allows remote attackers to cause a denial of service via a malformed request for files with .HTR, .IDC, or .STM extensions. | Patch early | 10.0 high | 74.7% | 1999-06-16 |
| CVE-2000-1089 EXP | Buffer overflow in Microsoft Phone Book Service allows local users to execute arbitrary commands, aka the "Phone Book Service Buffer Overflow" vulnera… | Patch early | 10.0 high | 74.6% | 2001-01-09 |
| CVE-2011-1563 EXP | Multiple stack-based buffer overflows in the HMI application in DATAC RealFlex RealWin 2.1 (Build 6.1.10.10) and earlier allow remote attackers to exe… | Patch early | 10.0 high | 74.6% | 2011-04-05 |
| CVE-2013-2115 EXP | Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using t… | Patch early | 8.1 high | 74.6% | 2013-07-10 |
| CVE-2010-3653 EXP | The Director module (dirapi.dll) in Adobe Shockwave Player before 11.5.9.615 allows remote attackers to execute arbitrary code or cause a denial of se… | Patch early | 9.3 high | 74.6% | 2010-10-26 |
| CVE-2016-1542 EXP | The RPC API in RSCD agent in BMC BladeLogic Server Automation (BSA) 8.2.x, 8.3.x, 8.5.x, 8.6.x, and 8.7.x on Linux and UNIX allows remote attackers to… | Patch early | 7.5 high | 74.6% | 2016-06-13 |
| CVE-2008-4193 EXP | Stack-based buffer overflow in SecurityGateway.dll in Alt-N Technologies SecurityGateway 1.0.1 allows remote attackers to execute arbitrary code via a… | Patch early | 10.0 high | 74.6% | 2008-09-24 |
| CVE-2007-3370 EXP | Multiple PHP remote file inclusion vulnerabilities in Sun Board 1.00.00 Alpha allow remote attackers to execute arbitrary PHP code via a URL in (1) th… | Patch early | 7.5 high | 74.5% | 2007-06-22 |
| CVE-2012-5159 EXP | phpMyAdmin 3.5.2.2, as distributed by the cdnetworks-kr-1 mirror during an unspecified time frame in 2012, contains an externally introduced modificat… | Patch early | 7.5 high | 74.5% | 2012-09-25 |
| CVE-2015-5374 EXP | A vulnerability has been identified in Firmware variant PROFINET IO for EN100 Ethernet module : All versions < V1.04.01; Firmware variant Modbus TCP f… | Patch early | 7.8 high | 74.5% | 2015-07-18 |
| CVE-2012-1182 EXP | The RPC code generator in Samba 3.x before 3.4.16, 3.5.x before 3.5.14, and 3.6.x before 3.6.4 does not implement validation of an array length in a m… | Patch early | 10.0 high | 74.4% | 2012-04-10 |
| CVE-2015-0779 EXP | Directory traversal vulnerability in UploadServlet in Novell ZENworks Configuration Management (ZCM) 10 and 11 before 11.3.2 allows remote attackers t… | Patch early | 10.0 high | 74.4% | 2015-06-07 |
| CVE-2008-1697 EXP | Stack-based buffer overflow in ovwparser.dll in HP OpenView Network Node Manager (OV NNM) 7.53, 7.51, and earlier allows remote attackers to execute a… | Patch early | 10.0 high | 74.3% | 2008-04-08 |
| CVE-2022-23642 EXP | Sourcegraph is a code search and navigation engine. Sourcegraph prior to version 3.37 is vulnerable to remote code execution in the `gitserver` servic… | Patch early | 8.8 high | 74.3% | 2022-02-18 |
| CVE-2015-3087 EXP | Integer overflow in Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on Linux,… | Patch early | 10.0 high | 74.3% | 2015-05-13 |
| CVE-2016-1561 EXP | ExaGrid appliances with firmware before 4.8 P26 have a default SSH public key in the authorized_keys file for root, which allows remote attackers to o… | Patch early | 7.5 high | 74.3% | 2017-04-21 |
| CVE-2006-5815 EXP | Stack-based buffer overflow in the sreplace function in ProFTPD 1.3.0 and earlier allows remote attackers, probably authenticated, to cause a denial o… | Patch early | 10.0 high | 74.2% | 2006-11-08 |
| CVE-2017-5255 EXP | In version 3.5 and prior of Cambium Networks ePMP firmware, a lack of input sanitation for certain parameters on the web management console allows any… | Patch early | 8.8 high | 74.2% | 2017-12-20 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt