CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
403,011 CVEs
1,734 on KEV
17,293 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-08
25,091 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2018-8947 EXP | rap2hpoutre Laravel Log Viewer before v0.13.0 relies on Base64 encoding for l, dl, and del requests, which makes it easier for remote attackers to byp… | Patch early | 7.5 high | 11% | 2018-03-25 |
| CVE-2007-1620 EXP | Multiple PHP remote file inclusion vulnerabilities in PHP DB Designer 1.02 and earlier allow remote attackers to execute arbitrary PHP code via a URL… | Patch early | 10.0 high | 11% | 2007-03-23 |
| CVE-2012-4170 EXP | Buffer overflow in Adobe Photoshop CS6 13.x before 13.0.1 allows remote attackers to execute arbitrary code via a crafted file. | Patch early | 9.3 high | 11% | 2012-08-31 |
| CVE-2008-3409 EXP | Buffer overflow in Unreal Tournament 3 1.3beta4 and earlier allows remote attackers to cause a denial of service (memory corruption and daemon crash)… | Patch early | 7.5 high | 11% | 2008-07-31 |
| CVE-2007-4534 EXP | Buffer overflow in the VThinker::BroadcastPrintf function in p_thinker.cpp in Vavoom 1.24 and earlier allows remote attackers to execute arbitrary cod… | Patch early | 7.5 high | 11% | 2007-08-25 |
| CVE-2006-0528 EXP | The cairo library (libcairo), as used in GNOME Evolution and possibly other products, allows remote attackers to cause a denial of service (persistent… | Patch early | 5.0 medium | 11% | 2006-02-02 |
| CVE-2006-6097 EXP | GNU tar 1.16 and 1.15.1, and possibly other versions, allows user-assisted attackers to overwrite arbitrary files via a tar file that contains a GNUTY… | Patch early | 4.0 medium | 11% | 2006-11-24 |
| CVE-2009-2764 EXP | Microsoft Internet Explorer 8.0.7100.0 on Windows 7 RC on the x64 platform allows remote attackers to cause a denial of service (application crash) vi… | Patch early | 5.0 medium | 11% | 2009-08-14 |
| CVE-2014-3220 EXP | F5 BIG-IQ Cloud and Security 4.0.0 through 4.1.0 allows remote authenticated users to change the password of arbitrary users via the name parameter in… | Patch early | 9.0 high | 11% | 2014-05-05 |
| CVE-2005-1100 EXP | Format string vulnerability in the ErrorLog function in cnf.c in Greylisting daemon (GLD) 1.3 and 1.4 allows remote attackers to execute arbitrary cod… | Patch early | 7.5 high | 11% | 2005-05-02 |
| CVE-2015-6023 EXP | ping.cgi in NetCommWireless HSPA 3G10WVE wireless routers with firmware before 3G10WVE-L101-S306ETS-C01_R05 allows remote attackers to bypass intended… | Patch early | 7.3 high | 11% | 2017-02-09 |
| CVE-2018-6460 EXP | Hotspot Shield runs a webserver with a static IP address 127.0.0.1 and port 895. The web server uses JSONP and hosts sensitive information including c… | Patch early | 7.5 high | 11% | 2018-01-31 |
| CVE-2005-3202 EXP | Multiple cross-site scripting (XSS) vulnerabilities in Oracle HTML DB (HTMLDB) 1.3 through 1.3.6 allow remote attackers to inject arbitrary web script… | Patch early | 6.8 medium | 11% | 2005-10-14 |
| CVE-2013-1868 EXP | Multiple buffer overflows in VideoLAN VLC media player 2.0.4 and earlier allow remote attackers to cause a denial of service (crash) and execute arbit… | Patch early | 9.3 high | 11% | 2013-07-10 |
| CVE-2006-2151 EXP | PHP remote file inclusion vulnerability in toplist.php in phpBB TopList 1.3.8 and earlier, when register_globals is enabled, allows remote attackers t… | Patch early | 7.5 high | 11% | 2006-05-03 |
| CVE-2001-0277 EXP | Buffer overflow in ext.dll in BadBlue 1.02.07 Personal Edition allows remote attackers to cause a denial of service and possibly execute arbitrary com… | Patch early | 10.0 high | 11% | 2001-05-03 |
| CVE-2006-3995 EXP | Multiple PHP remote file inclusion vulnerabilities in (1) uhp_config.php, and possibly (2) footer.php, (3) functions.php, (4) install.uhp.php, (5) too… | Patch early | 6.8 medium | 11% | 2006-08-05 |
| CVE-2014-7221 EXP | TeamSpeak Client 3.0.14 and earlier allows remote authenticated users to cause a denial of service (buffer overflow and application crash) by connecti… | Patch early | 6.5 medium | 11% | 2018-01-08 |
| CVE-2014-7222 EXP | Buffer overflow in TeamSpeak Client 3.0.14 and earlier allows remote authenticated users to cause a denial of service (application crash) by connectin… | Patch early | 6.5 medium | 11% | 2018-01-08 |
| CVE-2008-4434 EXP | Stack-based buffer overflow in (1) uTorrent 1.7.7 build 8179 and earlier and (2) BitTorrent 6.0.3 build 8642 and earlier allows remote attackers to ca… | Patch early | 9.3 high | 11% | 2008-10-03 |
| CVE-2020-13144 EXP | Studio in Open edX Ironwood 2.5, when CodeJail is not used, allows a user to go to the "Create New course>New section>New subsection>New unit>Add new… | Patch early | 8.8 high | 11% | 2020-05-18 |
| CVE-2002-0516 EXP | SquirrelMail 1.2.5 and earlier allows authenticated SquirrelMail users to execute arbitrary commands by modifying the THEME variable in a cookie. | Patch early | 10.0 high | 11% | 2002-08-12 |
| CVE-2006-4901 EXP | Computer Associates (CA) eTrust Security Command Center 1.0 and r8 up to SP1 CR2, and eTrust Audit 1.5 and r8, allows remote attackers to spoof alerts… | Patch early | 6.4 medium | 11% | 2006-09-22 |
| CVE-2001-0590 EXP | Apache Software Foundation Tomcat Servlet prior to 3.2.2 allows a remote attacker to read the source code to arbitrary 'jsp' files via a malformed URL… | Patch early | 5.0 medium | 11% | 2001-08-02 |
| CVE-2006-5205 EXP | Directory traversal vulnerability in Invision Gallery 2.0.7 allows remote attackers to read arbitrary files via a .. (dot dot) sequence in the dir par… | Patch early | 5.0 medium | 11% | 2006-10-10 |
| CVE-2020-11060 EXP | In GLPI before 9.4.6, an attacker can execute system commands by abusing the backup functionality. Theoretically, this vulnerability can be exploited… | Patch early | 7.4 high | 10.9% | 2020-05-12 |
| CVE-2010-3145 EXP | Untrusted search path vulnerability in the BitLocker Drive Encryption API, as used in sdclt.exe in Backup Manager in Microsoft Windows Vista SP1 and S… | Patch early | 9.3 high | 10.9% | 2010-08-27 |
| CVE-2010-0049 EXP | Use-after-free vulnerability in WebKit in Apple Safari before 4.0.5 allows remote attackers to execute arbitrary code or cause a denial of service (ap… | Patch early | 9.3 high | 10.9% | 2010-03-15 |
| CVE-2009-0367 EXP | The Python AI module in Wesnoth 1.4.x and 1.5 before 1.5.11 allows remote attackers to escape the sandbox and execute arbitrary code by using a whitel… | Patch early | 9.3 high | 10.9% | 2009-03-05 |
| CVE-2009-3250 EXP | The saveForwardAttachments procedure in the Compose Mail functionality in vtiger CRM 5.0.4 allows remote authenticated users to execute arbitrary code… | Patch early | 9.0 high | 10.9% | 2009-09-18 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt