CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
403,011 CVEs
1,734 on KEV
17,293 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-08
25,091 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2010-4259 EXP | Stack-based buffer overflow in FontForge 20100501 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitra… | Patch early | 6.8 medium | 10.9% | 2010-12-07 |
| CVE-2000-1105 EXP | The ixsso.query ActiveX Object is marked as safe for scripting, which allows malicious web site operators to embed a script that remotely determines t… | Patch early | 4.3 medium | 10.8% | 2001-01-09 |
| CVE-2009-3382 EXP | layout/base/nsCSSFrameConstructor.cpp in the browser engine in Mozilla Firefox 3.0.x before 3.0.15 does not properly handle first-letter frames, which… | Patch early | 10.0 high | 10.8% | 2009-10-29 |
| CVE-2009-2753 EXP | Multiple buffer overflows in the authentication functionality in librpc.dll in the Informix Storage Manager (ISM) Portmapper service (aka portmap.exe)… | Patch early | 10.0 high | 10.8% | 2010-03-05 |
| CVE-2015-6567 EXP | Wolf CMS before 0.8.3.1 allows unrestricted file upload and PHP Code Execution because admin/plugin/file_manager/browse/ (aka the filemanager) does no… | Patch early | 8.8 high | 10.8% | 2017-04-14 |
| CVE-2022-41544 EXP | GetSimple CMS v3.3.16 was discovered to contain a remote code execution (RCE) vulnerability via the edited_file parameter in admin/theme-edit.php. | Patch early | 9.8 critical | 10.8% | 2022-10-18 |
| CVE-2005-3243 EXP | Multiple buffer overflows in Ethereal 0.10.12 and earlier might allow remote attackers to execute arbitrary code via unknown vectors in the (1) SLIMP3… | Patch early | 7.5 high | 10.8% | 2005-10-27 |
| CVE-2017-3006 EXP | Adobe Thor versions 3.9.5.353 and earlier have a vulnerability related to the use of improper resource permissions during the installation of Creative… | Patch early | 8.8 high | 10.8% | 2017-04-12 |
| CVE-2008-3269 EXP | WRPCServer.exe in WinSoftMagic WinRemotePC (WRPC) Lite 2008 and Full 2008 allows remote attackers to cause a denial of service (CPU consumption) via a… | Patch early | 5.0 medium | 10.8% | 2008-07-24 |
| CVE-2001-1130 EXP | Sdbsearch.cgi in SuSE Linux 6.0-7.2 could allow remote attackers to execute arbitrary commands by uploading a keylist.txt file that contains filenames… | Patch early | 7.5 high | 10.8% | 2001-08-02 |
| CVE-2012-5875 EXP | Firefly Media Server 1.0.0.1359 allows remote attackers to cause a denial of service (NULL pointer dereference) via a (1) crafted Connection HTTP head… | Patch early | 5.0 medium | 10.8% | 2013-01-18 |
| CVE-2006-2769 EXP | The HTTP Inspect preprocessor (http_inspect) in Snort 2.4.0 through 2.4.4 allows remote attackers to bypass "uricontent" rules via a carriage return (… | Patch early | 5.0 medium | 10.8% | 2006-06-02 |
| CVE-2010-0287 EXP | Directory traversal vulnerability in the ACL Manager plugin (plugins/acl/ajax.php) in DokuWiki before 2009-12-25b allows remote attackers to list the… | Patch early | 5.0 medium | 10.8% | 2010-02-15 |
| CVE-2007-6485 EXP | Multiple PHP remote file inclusion vulnerabilities in Centreon 1.4.1 (aka Oreon 1.4) allow remote attackers to execute arbitrary PHP code via a URL in… | Patch early | 7.5 high | 10.8% | 2007-12-20 |
| CVE-2020-15160 EXP | PrestaShop from version 1.7.5.0 and before version 1.7.6.8 is vulnerable to a blind SQL Injection attack in the Catalog Product edition page with loca… | Patch early | 9.8 critical | 10.8% | 2020-09-24 |
| CVE-2009-0755 EXP | The FormWidgetChoice::loadDefaults function in Poppler before 0.10.4 allows remote attackers to cause a denial of service (crash) via a PDF file with… | Patch early | 5.0 medium | 10.8% | 2009-03-03 |
| CVE-2009-5022 EXP | Heap-based buffer overflow in tif_ojpeg.c in the OJPEG decoder in LibTIFF before 3.9.5 allows remote attackers to execute arbitrary code via a crafted… | Patch early | 6.8 medium | 10.8% | 2011-05-03 |
| CVE-2005-1278 EXP | The isis_print function, as called by isoclns_print, in tcpdump 3.9.1 and earlier allows remote attackers to cause a denial of service (infinite loop)… | Patch early | 5.0 medium | 10.8% | 2005-05-02 |
| CVE-2006-5826 EXP | Buffer overflow in Texas Imperial Software WFTPD Pro Server 3.23.1.1 allows remote authenticated users to execute arbitrary code or cause a denial of… | Patch early | 5.8 medium | 10.8% | 2006-11-10 |
| CVE-2001-0199 EXP | Directory traversal vulnerability in SEDUM HTTP Server 2.0 allows remote attackers to read arbitrary files via a .. (dot dot) attack in the HTTP GET r… | Patch early | 5.0 medium | 10.8% | 2001-05-03 |
| CVE-2017-11661 EXP | The _WM_SetupMidiEvent function in internal_midi.c:2318 in WildMIDI 0.4.2 can cause a denial of service (invalid memory read and application crash) vi… | Patch early | 7.5 high | 10.8% | 2017-08-17 |
| CVE-2013-3075 EXP | Multiple buffer overflows in ActUWzd.dll 1.0.0.1 in Mitsubishi MX Component 3, as distributed in Citect CitectFacilities 7.10 and CitectScada 7.10r1,… | Patch early | 10.0 high | 10.8% | 2013-04-19 |
| CVE-2003-0125 EXP | Buffer overflow in the web interface for SOHO Routefinder 550 before firmware 4.63 allows remote attackers to cause a denial of service (reboot) and e… | Patch early | 5.0 medium | 10.8% | 2003-03-18 |
| CVE-2010-1932 EXP | Heap-based buffer overflow in XnView 1.97.4 and possibly earlier allows remote attackers to execute arbitrary code via a MultiBitMap (MBM) file with a… | Patch early | 9.3 high | 10.8% | 2010-06-16 |
| CVE-2008-0619 EXP | Buffer overflow in NeroMediaPlayer.exe in Nero Media Player 1.4.0.35 and earlier allows remote attackers to execute arbitrary code or cause a denial o… | Patch early | 9.3 high | 10.8% | 2008-02-06 |
| CVE-2018-19125 EXP | PrestaShop 1.6.x before 1.6.1.23 and 1.7.x before 1.7.4.4 allows remote attackers to delete an image directory. | Patch early | 7.5 high | 10.8% | 2018-11-09 |
| CVE-2004-1392 EXP | PHP 4.0 with cURL functions allows remote attackers to bypass the open_basedir setting and read arbitrary files via a file: URL argument to the curl_i… | Patch early | 5.0 medium | 10.8% | 2004-12-31 |
| CVE-1999-0426 EXP | The default permissions of /dev/kmem in Linux versions before 2.0.36 allows IP spoofing. | Patch early | 9.8 critical | 10.8% | 1999-03-01 |
| CVE-2007-1733 EXP | Buffer overflow in InterVations NaviCOPA HTTP Server 2.01 allows remote attackers to execute arbitrary code via a long (1) /cgi-bin/ or (2) /cgi/ path… | Patch early | 10.0 high | 10.8% | 2007-03-28 |
| CVE-2012-0056 EXP | The mem_write function in the Linux kernel before 3.2.2, when ASLR is disabled, does not properly check permissions when writing to /proc/<pid>/mem, w… | Patch early | 6.9 medium | 10.8% | 2012-01-27 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt