CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
424,700 CVEs
1,779 on KEV
17,541 EPSS ≥ 10%
25,095 with exploits
synced 2026-11-12
12,664 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2006-5156 EXP | Buffer overflow in McAfee ePolicy Orchestrator before 3.5.0.720 and ProtectionPilot before 1.1.1.126 allows remote attackers to execute arbitrary code… | Patch early | 10.0 high | 74.4% | 2006-10-05 |
| CVE-2012-1182 EXP | The RPC code generator in Samba 3.x before 3.4.16, 3.5.x before 3.5.14, and 3.6.x before 3.6.4 does not implement validation of an array length in a m… | Patch early | 10.0 high | 74.4% | 2012-04-10 |
| CVE-2015-0779 EXP | Directory traversal vulnerability in UploadServlet in Novell ZENworks Configuration Management (ZCM) 10 and 11 before 11.3.2 allows remote attackers t… | Patch early | 10.0 high | 74.4% | 2015-06-07 |
| CVE-2008-1697 EXP | Stack-based buffer overflow in ovwparser.dll in HP OpenView Network Node Manager (OV NNM) 7.53, 7.51, and earlier allows remote attackers to execute a… | Patch early | 10.0 high | 74.3% | 2008-04-08 |
| CVE-2022-23642 EXP | Sourcegraph is a code search and navigation engine. Sourcegraph prior to version 3.37 is vulnerable to remote code execution in the `gitserver` servic… | Patch early | 8.8 high | 74.3% | 2022-02-18 |
| CVE-2015-3087 EXP | Integer overflow in Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on Linux,… | Patch early | 10.0 high | 74.3% | 2015-05-13 |
| CVE-2017-5255 EXP | In version 3.5 and prior of Cambium Networks ePMP firmware, a lack of input sanitation for certain parameters on the web management console allows any… | Patch early | 8.8 high | 74.2% | 2017-12-20 |
| CVE-2015-6522 EXP | SQL injection vulnerability in the WP Symposium plugin before 15.8 for WordPress allows remote attackers to execute arbitrary SQL commands via the siz… | Patch early | 7.5 high | 74.1% | 2015-08-19 |
| CVE-2010-0304 EXP | Multiple buffer overflows in the LWRES dissector in Wireshark 0.9.15 through 1.0.10 and 1.2.0 through 1.2.5 allow remote attackers to cause a denial o… | Patch early | 7.5 high | 74.1% | 2010-02-03 |
| CVE-2001-0550 EXP | wu-ftpd 2.6.1 allows remote attackers to execute arbitrary commands via a "~{" argument to commands such as CWD, which is not properly handled by the… | Patch early | 7.5 high | 74.1% | 2001-11-30 |
| CVE-2009-3844 EXP | Stack-based buffer overflow in the OmniInet process in HP OpenView Data Protector Application Recovery Manager 5.50 and 6.0 allows remote attackers to… | Patch early | 10.0 high | 74.1% | 2009-12-08 |
| CVE-2009-4178 EXP | Heap-based buffer overflow in OvWebHelp.exe in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allows remote attackers to execute arbit… | Patch early | 10.0 high | 74% | 2009-12-10 |
| CVE-2016-9244 EXP | A BIG-IP virtual server configured with a Client SSL profile that has the non-default Session Tickets option enabled may leak up to 31 bytes of uninit… | Patch early | 7.5 high | 74% | 2017-02-09 |
| CVE-2007-3401 EXP | PHP remote file inclusion vulnerability in footer.inc.php in B1G b1gBB 2.24 allows remote attackers to execute arbitrary PHP code via a URL in the tfo… | Patch early | 7.5 high | 74% | 2007-06-26 |
| CVE-2005-1213 EXP | Stack-based buffer overflow in the news reader for Microsoft Outlook Express (MSOE.DLL) 5.5 SP2, 6, and 6 SP1 allows remote malicious NNTP servers to… | Patch early | 7.5 high | 74% | 2005-06-14 |
| CVE-2020-8813 EXP | graph_realtime.php in Cacti 1.2.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in a cookie, if a guest user has t… | Patch early | 8.8 high | 74% | 2020-02-22 |
| CVE-2012-0261 EXP | license.php in system-portal before 1.6.2 in op5 Monitor and op5 Appliance before 5.5.3 allows remote attackers to execute arbitrary commands via shel… | Patch early | 10.0 high | 73.9% | 2013-12-31 |
| CVE-2016-7202 EXP | The scripting engines in Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denia… | Patch early | 7.5 high | 73.9% | 2016-11-10 |
| CVE-2017-16709 EXP | Crestron Airmedia AM-100 devices with firmware before 1.6.0 and AM-101 devices with firmware before 2.7.0 allows remote authenticated administrators t… | Patch early | 7.2 high | 73.9% | 2018-07-11 |
| CVE-2012-0013 EXP | Incomplete blacklist vulnerability in the Windows Packager configuration in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista S… | Patch early | 9.3 high | 73.9% | 2012-01-10 |
| CVE-2017-17405 EXP | Ruby before 2.4.3 allows Net::FTP command injection. Net::FTP#get, getbinaryfile, gettextfile, put, putbinaryfile, and puttextfile use Kernel#open to… | Patch early | 8.8 high | 73.8% | 2017-12-15 |
| CVE-2014-0659 EXP | The Cisco WAP4410N access point with firmware through 2.0.6.1, WRVS4400N router with firmware 1.x through 1.1.13 and 2.x through 2.0.2.1, and RVS4000… | Patch early | 10.0 high | 73.8% | 2014-01-12 |
| CVE-2009-0542 EXP | SQL injection vulnerability in ProFTPD Server 1.3.1 through 1.3.2rc2 allows remote attackers to execute arbitrary SQL commands via a "%" (percent) cha… | Patch early | 7.5 high | 73.8% | 2009-02-12 |
| CVE-2011-2404 EXP | A certain ActiveX control in HPTicketMgr.dll in HP Easy Printer Care Software 2.5 and earlier allows remote attackers to download an arbitrary program… | Patch early | 7.5 high | 73.7% | 2011-08-11 |
| CVE-2008-1914 EXP | Stack-based buffer overflow in the AntServer module (AntServer.exe) in BigAnt IM Server in BigAnt Messenger 2.2 allows remote attackers to execute arb… | Patch early | 10.0 high | 73.7% | 2008-04-22 |
| CVE-2013-2578 EXP | cgi-bin/admin/servetest in TP-Link IP Cameras TL-SC3130, TL-SC3130G, TL-SC3171, TL-SC3171G, and possibly other models before beta firmware LM.1.6.18P1… | Patch early | 10.0 high | 73.7% | 2013-10-11 |
| CVE-2013-1966 EXP | Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using t… | Patch early | 9.3 high | 73.7% | 2013-07-10 |
| CVE-2009-3849 EXP | Multiple stack-based buffer overflows in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allow remote attackers to execute arbitrary co… | Patch early | 10.0 high | 73.7% | 2009-12-10 |
| CVE-2017-15889 EXP | Command injection vulnerability in smart.cgi in Synology DiskStation Manager (DSM) before 5.2-5967-5 allows remote authenticated users to execute arbi… | Patch early | 8.8 high | 73.7% | 2017-12-04 |
| CVE-2000-0248 EXP | The web GUI for the Linux Virtual Server (LVS) software in the Red Hat Linux Piranha package has a backdoor password that allows remote attackers to e… | Patch early | 10.0 high | 73.7% | 2000-04-24 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt