CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
425,548 CVEs
1,779 on KEV
17,545 EPSS ≥ 10%
25,095 with exploits
synced 2026-11-13
25,095 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2018-10661 EXP | An issue was discovered in multiple models of Axis IP Cameras. There is a bypass of access control. | Patch early | 9.8 critical | 86% | 2018-06-26 |
| CVE-2014-0226 EXP | Race condition in the mod_status module in the Apache HTTP Server before 2.4.10 allows remote attackers to cause a denial of service (heap-based buffe… | Patch early | 6.8 medium | 85.8% | 2014-07-20 |
| CVE-2019-8449 EXP | The /rest/api/latest/groupuserpicker resource in Jira before version 8.4.0 allows remote attackers to enumerate usernames via an information disclosur… | Patch early | 5.3 medium | 85.7% | 2019-09-11 |
| CVE-2021-29447 EXP | Wordpress is an open source CMS. A user with the ability to upload files (like an Author) can exploit an XML parsing issue in the Media Library leadin… | Patch early | 7.1 high | 85.7% | 2021-04-15 |
| CVE-2001-0241 EXP | Buffer overflow in Internet Printing ISAPI extension in Windows 2000 allows remote attackers to gain root privileges via a long print request that is… | Patch early | 10.0 high | 85.7% | 2001-06-27 |
| CVE-2003-0109 EXP | Buffer overflow in ntdll.dll on Microsoft Windows NT 4.0, Windows NT 4.0 Terminal Server Edition, Windows 2000, and Windows XP allows remote attackers… | Patch early | 7.5 high | 85.7% | 2003-03-31 |
| CVE-2003-0533 EXP | Stack-based buffer overflow in certain Active Directory service functions in LSASRV.DLL of the Local Security Authority Subsystem Service (LSASS) in M… | Patch early | 7.5 high | 85.6% | 2004-06-01 |
| CVE-2023-4634 EXP | The Media Library Assistant plugin for WordPress is vulnerable to Local File Inclusion and Remote Code Execution in versions up to, and including, 3.0… | Patch early | 9.8 critical | 85.6% | 2023-09-06 |
| CVE-2001-0803 EXP | Buffer overflow in the client connection routine of libDtSvc.so.1 in CDE Subprocess Control Service (dtspcd) allows remote attackers to execute arbitr… | Patch early | 10.0 high | 85.6% | 2001-12-06 |
| CVE-2015-7858 EXP | SQL injection vulnerability in Joomla! 3.2 before 3.4.4 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, a different… | Patch early | 7.5 high | 85.6% | 2015-10-29 |
| CVE-2017-9769 EXP | A specially crafted IOCTL can be issued to the rzpnk.sys driver in Razer Synapse 2.20.15.1104 that is forwarded to ZwOpenProcess allowing a handle to… | Patch early | 9.8 critical | 85.5% | 2017-08-02 |
| CVE-2006-4847 EXP | Multiple buffer overflows in Ipswitch WS_FTP Server 5.05 before Hotfix 1 allow remote authenticated users to execute arbitrary code via long (1) XCRC,… | Patch early | 6.5 medium | 85.5% | 2006-09-19 |
| CVE-2025-32429 EXP | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 9.4-rc-1 through 16.10.5 and 17.0… | Patch early | 9.8 critical | 85.5% | 2025-07-24 |
| CVE-2004-0330 EXP | Buffer overflow in Serv-U ftp before 5.0.0.4 allows remote authenticated users to execute arbitrary code via a long time zone argument to the MDTM com… | Patch early | 10.0 high | 85.5% | 2004-11-23 |
| CVE-2011-0063 EXP | The _list_file_get function in lib/Majordomo.pm in Majordomo 2 20110203 and earlier allows remote attackers to conduct directory traversal attacks and… | Patch early | 5.0 medium | 85.5% | 2011-03-15 |
| CVE-2017-14495 EXP | Memory leak in dnsmasq before 2.78, when the --add-mac, --add-cpe-id or --add-subnet option is specified, allows remote attackers to cause a denial of… | Patch early | 7.5 high | 85.4% | 2017-10-03 |
| CVE-2005-2086 EXP | PHP remote file inclusion vulnerability in viewtopic.php in phpBB 2.0.15 and earlier allows remote attackers to execute arbitrary PHP code. | Patch early | 7.5 high | 85.4% | 2005-07-05 |
| CVE-2012-4940 EXP | Multiple directory traversal vulnerabilities in the View Log Files component in Axigen Free Mail Server allow remote attackers to read or delete arbit… | Patch early | 6.4 medium | 85.4% | 2012-10-31 |
| CVE-2022-0441 EXP | The MasterStudy LMS WordPress plugin before 2.7.6 does to validate some parameters given when registering a new account, allowing unauthenticated user… | Patch early | 9.8 critical | 85.3% | 2022-03-07 |
| CVE-2019-3799 EXP | Spring Cloud Config, versions 2.1.x prior to 2.1.2, versions 2.0.x prior to 2.0.4, and versions 1.4.x prior to 1.4.6, and older unsupported versions a… | Patch early | 6.5 medium | 85.3% | 2019-05-06 |
| CVE-2017-14493 EXP | Stack-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafte… | Patch early | 9.8 critical | 85.2% | 2017-10-03 |
| CVE-1999-1053 EXP | guestbook.pl cleanses user-inserted SSI commands by removing text between "<!--" and "-->" separators, which allows remote attackers to execute arbitr… | Patch early | 7.5 high | 85.2% | 1999-09-13 |
| CVE-2001-0499 EXP | Buffer overflow in Transparent Network Substrate (TNS) Listener in Oracle 8i 8.1.7 and earlier allows remote attackers to gain privileges via a long a… | Patch early | 10.0 high | 85.2% | 2001-07-21 |
| CVE-2018-6000 EXP | An issue was discovered in AsusWRT before 3.0.0.4.384_10007. The do_vpnupload_post function in router/httpd/web.c in vpnupload.cgi provides functional… | Patch early | 9.8 critical | 85.2% | 2018-01-22 |
| CVE-2006-5478 EXP | Multiple stack-based buffer overflows in Novell eDirectory 8.8.x before 8.8.1 FTF1, and 8.x up to 8.7.3.8, and Novell NetMail before 3.52e FTF2, allow… | Patch early | 7.5 high | 85.1% | 2006-10-24 |
| CVE-2019-20361 EXP | There was a flaw in the WordPress plugin, Email Subscribers & Newsletters before 4.3.1, that allowed SQL statements to be passed to the database in th… | Patch early | 9.8 critical | 85.1% | 2020-01-08 |
| CVE-2009-2335 EXP | WordPress and WordPress MU before 2.8.1 exhibit different behavior for a failed login attempt depending on whether the user account exists, which allo… | Patch early | 5.0 medium | 85% | 2009-07-10 |
| CVE-2019-7214 EXP | SmarterTools SmarterMail 16.x before build 6985 allows deserialization of untrusted data. An unauthenticated attacker could run commands on the server… | Patch early | 9.8 critical | 84.9% | 2019-04-24 |
| CVE-2003-0772 EXP | Multiple buffer overflows in WS_FTP 3 and 4 allow remote authenticated users to cause a denial of service and possibly execute arbitrary code via long… | Patch early | 7.5 high | 84.9% | 2003-09-22 |
| CVE-2004-0493 EXP | The ap_get_mime_headers_core function in Apache httpd 2.0.49 allows remote attackers to cause a denial of service (memory exhaustion), and possibly an… | Patch early | 6.4 medium | 84.8% | 2004-08-06 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt