CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
398,529 CVEs
1,726 on KEV
17,265 EPSS ≥ 10%
25,086 with exploits
synced 2026-09-27
25,086 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2013-2028 EXP | The ngx_http_parse_chunked function in http/ngx_http_parse.c in nginx 1.3.9 through 1.4.0 allows remote attackers to cause a denial of service (crash)… | Patch early | 7.5 high | 87.5% | 2013-07-20 |
| CVE-2017-11610 EXP | The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows remote authenticated users to exe… | Patch early | 8.8 high | 87.4% | 2017-08-23 |
| CVE-2018-7584 EXP | In PHP through 5.6.33, 7.0.x before 7.0.28, 7.1.x through 7.1.14, and 7.2.x through 7.2.2, there is a stack-based buffer under-read while parsing an H… | Patch early | 9.8 critical | 87.3% | 2018-03-01 |
| CVE-2000-1209 EXP | The "sa" account is installed with a default null password on (1) Microsoft SQL Server 2000, (2) SQL Server 7.0, and (3) Data Engine (MSDE) 1.0, inclu… | Patch early | 10.0 high | 87.3% | 2002-08-12 |
| CVE-2021-32305 EXP | WebSVN before 2.6.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the search parameter. | Patch early | 9.8 critical | 87.3% | 2021-05-18 |
| CVE-2017-5487 EXP | wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php in the REST API implementation in WordPress 4.7 before 4.7.1 does not properly restr… | Patch early | 5.3 medium | 87.3% | 2017-01-15 |
| CVE-2000-0778 EXP | IIS 5.0 allows remote attackers to obtain source code for .ASP files and other scripts via an HTTP GET request with a "Translate: f" header, aka the "… | Patch early | 5.0 medium | 87.3% | 2000-10-20 |
| CVE-2018-5999 EXP | An issue was discovered in AsusWRT before 3.0.0.4.384_10007. In the handle_request function in router/httpd/httpd.c, processing of POST requests conti… | Patch early | 9.8 critical | 87.3% | 2018-01-22 |
| CVE-2009-3555 EXP | The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache H… | Patch early | 9.8 critical | 87.3% | 2009-11-09 |
| CVE-2013-1488 EXP | The Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 6 and 7, allows remote attackers to execute arbitr… | Patch early | 10.0 high | 87.2% | 2013-03-08 |
| CVE-2019-11358 EXP | jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollutio… | Patch early | 6.1 medium | 87.2% | 2019-04-20 |
| CVE-2021-24145 EXP | Arbitrary file upload in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly check the imported file, allowing… | Patch early | 7.2 high | 87.2% | 2021-03-18 |
| CVE-2015-3864 EXP | Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in Android before 5.1.1 LMY48M all… | Patch early | 10.0 high | 87.1% | 2015-10-01 |
| CVE-2017-12611 EXP | In Apache Struts 2.0.0 through 2.3.33 and 2.5 through 2.5.10.1, using an unintentional expression in a Freemarker tag instead of string literals can l… | Patch early | 9.8 critical | 87.1% | 2017-09-20 |
| CVE-2012-0779 EXP | Adobe Flash Player before 10.3.183.19 and 11.x before 11.2.202.235 on Windows, Mac OS X, and Linux; before 11.1.111.9 on Android 2.x and 3.x; and befo… | Patch early | 9.3 high | 87.1% | 2012-05-04 |
| CVE-2016-6603 EXP | ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to bypass authentication and impersonate arbitrary users via the UserName HTTP header. | Patch early | 9.8 critical | 87% | 2017-01-23 |
| CVE-2008-5416 EXP | Heap-based buffer overflow in Microsoft SQL Server 2000 SP4, 8.00.2050, 8.00.2039, and earlier; SQL Server 2000 Desktop Engine (MSDE 2000) SP4; SQL Se… | Patch early | 9.0 high | 87% | 2008-12-10 |
| CVE-2005-2611 EXP | VERITAS Backup Exec for Windows Servers 8.6 through 10.0, Backup Exec for NetWare Servers 9.0 and 9.1, and NetBackup for NetWare Media Server Option 4… | Patch early | 10.0 high | 87% | 2005-08-17 |
| CVE-2025-32429 EXP | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 9.4-rc-1 through 16.10.5 and 17.0… | Patch early | 9.8 critical | 87% | 2025-07-24 |
| CVE-2018-1002105 EXP | In all Kubernetes versions prior to v1.10.11, v1.11.5, and v1.12.3, incorrect handling of error responses to proxied upgrade requests in the kube-apis… | Patch early | 9.8 critical | 87% | 2018-12-05 |
| CVE-2017-16894 EXP | In Laravel framework through 5.5.21, remote attackers can obtain sensitive information (such as externally usable passwords) via a direct request for… | Patch early | 7.5 high | 86.9% | 2017-11-20 |
| CVE-2004-2111 EXP | Stack-based buffer overflow in the site chmod command in Serv-U FTP Server before 4.2 allows remote attackers to execute arbitrary code via a long fil… | Patch early | 8.5 high | 86.9% | 2004-12-31 |
| CVE-2004-1857 EXP | Directory traversal vulnerability in setinfo.hts in HP Web Jetadmin 7.5.2546 allows remote authenticated attackers to read arbitrary files via a .. (d… | Patch early | 2.1 low | 86.8% | 2004-03-24 |
| CVE-2021-24762 EXP | The Perfect Survey WordPress plugin before 1.5.2 does not validate and escape the question_id GET parameter before using it in a SQL statement in the… | Patch early | 9.8 critical | 86.8% | 2022-02-01 |
| CVE-2018-0101 EXP | A vulnerability in the Secure Sockets Layer (SSL) VPN functionality of the Cisco Adaptive Security Appliance (ASA) Software could allow an unauthentic… | Patch early | 10.0 critical | 86.8% | 2018-01-29 |
| CVE-2020-13151 EXP | Aerospike Community Edition 4.9.0.5 allows for unauthenticated submission and execution of user-defined functions (UDFs), written in Lua, as part of a… | Patch early | 9.8 critical | 86.7% | 2020-08-05 |
| CVE-2005-4360 EXP | The URL parser in Microsoft Internet Information Services (IIS) 5.1 on Windows XP Professional SP2 allows remote attackers to execute arbitrary code v… | Patch early | 7.8 high | 86.7% | 2005-12-20 |
| CVE-2015-8103 EXP | The Jenkins CLI subsystem in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to execute arbitrary code via a crafted serialized Ja… | Patch early | 9.8 critical | 86.7% | 2015-11-25 |
| CVE-2003-0132 EXP | A memory leak in Apache 2.0 through 2.0.44 allows remote attackers to cause a denial of service (memory consumption) via large chunks of linefeed char… | Patch early | 5.0 medium | 86.7% | 2003-04-11 |
| CVE-2010-0483 EXP | vbscript.dll in VBScript 5.1, 5.6, 5.7, and 5.8 in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2, when Internet Explorer is used, al… | Patch early | 7.6 high | 86.6% | 2010-03-03 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt