CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
398,558 CVEs
1,726 on KEV
17,267 EPSS ≥ 10%
25,086 with exploits
synced 2026-09-27
12,661 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2010-0822 EXP | Stack-based buffer overflow in Microsoft Office Excel 2002 SP3, Office 2004 for Mac, Office 2008 for Mac, and Open XML File Format Converter for Mac a… | Patch early | 9.3 high | 70.1% | 2010-06-08 |
| CVE-2011-0266 EXP | Buffer overflow in nnmRptConfig.exe in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53 allows remote attackers to execute arbitrary code via a… | Patch early | 10.0 high | 70.1% | 2011-01-13 |
| CVE-2021-45010 EXP | A path traversal vulnerability in the file upload functionality in tinyfilemanager.php in Tiny File Manager before 2.4.7 allows remote attackers (with… | Patch early | 8.8 high | 70.1% | 2022-03-15 |
| CVE-2011-3176 EXP | Stack-based buffer overflow in the Preboot Service in Novell ZENworks Configuration Management (ZCM) 11.1 and 11.1a allows remote attackers to execute… | Patch early | 10.0 high | 70.1% | 2012-04-09 |
| CVE-2004-1373 EXP | Format string vulnerability in SHOUTcast 1.9.4 allows remote attackers to cause a denial of service (application crash) and execute arbitrary code via… | Patch early | 7.5 high | 70.1% | 2004-12-23 |
| CVE-2007-0169 EXP | Multiple buffer overflows in Computer Associates (CA) BrightStor ARCserve Backup 9.01 through 11.5, Enterprise Backup 10.5, and CA Server/Business Pro… | Patch early | 7.5 high | 70% | 2007-01-11 |
| CVE-2007-3614 EXP | Multiple stack-based buffer overflows in waHTTP.exe (aka the SAP DB Web Server) in SAP DB, possibly 7.3 through 7.5, allow remote attackers to execute… | Patch early | 7.5 high | 70% | 2007-07-06 |
| CVE-2006-1185 EXP | Unspecified vulnerability in Microsoft Internet Explorer 5.01 through 6 allows remote attackers to execute arbitrary code via certain invalid HTML tha… | Patch early | 7.5 high | 70% | 2006-04-11 |
| CVE-2011-2039 EXP | The helper application in Cisco AnyConnect Secure Mobility Client (formerly AnyConnect VPN Client) before 2.3.185 on Windows, and on Windows Mobile, d… | Patch early | 7.6 high | 70% | 2011-06-02 |
| CVE-2010-0886 EXP | Unspecified vulnerability in the Java Deployment Toolkit component in Oracle Java SE and Java for Business JDK and JRE 6 Update 10 through 19 allows r… | Patch early | 10.0 high | 69.9% | 2010-04-20 |
| CVE-2015-5082 EXP | Endian Firewall before 3.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) NEW_PASSWORD_1 or (2) NEW_PASSWOR… | Patch early | 10.0 high | 69.9% | 2015-09-28 |
| CVE-2007-3605 EXP | Stack-based buffer overflow in the kweditcontrol.kwedit.1 ActiveX control in FrontEnd\SapGui\kwedit.dll in the EnjoySAP SAP GUI allows remote attacker… | Patch early | 7.6 high | 69.9% | 2007-07-06 |
| CVE-2008-4556 EXP | Stack-based buffer overflow in the adm_build_path function in sadmind in Sun Solstice AdminSuite on Solaris 8 and 9 allows remote attackers to execute… | Patch early | 10.0 high | 69.9% | 2008-10-14 |
| CVE-2002-0965 EXP | Buffer overflow in TNS Listener for Oracle 9i Database Server on Windows systems, and Oracle 8 on VM, allows local users to execute arbitrary code via… | Patch early | 7.5 high | 69.8% | 2002-10-04 |
| CVE-2017-11873 EXP | ChakraCore and Microsoft Edge in Windows 10 1511, 1607, 1703, 1709, Windows Server 2016 and Windows Server, version 1709 allows an attacker to gain th… | Patch early | 7.5 high | 69.8% | 2017-11-15 |
| CVE-2014-0257 EXP | Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, 4.5, and 4.5.1 does not properly determine whether it is safe to execute a method,… | Patch early | 9.3 high | 69.8% | 2014-02-12 |
| CVE-2014-6277 EXP | GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to… | Patch early | 10.0 high | 69.8% | 2014-09-27 |
| CVE-2005-0260 EXP | Stack-based buffer overflow in the Discovery Service for BrightStor ARCserve Backup 11.1 and earlier allows remote attackers to execute arbitrary code… | Patch early | 10.0 high | 69.7% | 2005-05-02 |
| CVE-2002-0661 EXP | Directory traversal vulnerability in Apache 2.0 through 2.0.39 on Windows, OS2, and Netware allows remote attackers to read arbitrary files and execut… | Patch early | 7.5 high | 69.7% | 2002-08-12 |
| CVE-2010-3654 EXP | Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris and 10.1.95.1 on Android, and authplay.dll (a… | Patch early | 9.3 high | 69.7% | 2010-10-29 |
| CVE-2013-6117 EXP | Dahua DVR 2.608.0000.0 and 2.608.GV00.0 allows remote attackers to bypass authentication and obtain sensitive information including user credentials,… | Patch early | 7.5 high | 69.7% | 2014-07-11 |
| CVE-2004-0627 EXP | The check_scramble_323 function in MySQL 4.1.x before 4.1.3, and 5.0, allows remote attackers to bypass authentication via a zero-length scrambled str… | Patch early | 10.0 high | 69.6% | 2004-12-06 |
| CVE-2012-0003 EXP | Unspecified vulnerability in winmm.dll in Windows Multimedia Library in Windows Media Player (WMP) in Microsoft Windows XP SP2 and SP3, Server 2003 SP… | Patch early | 8.1 high | 69.6% | 2012-01-10 |
| CVE-2011-3658 EXP | The SVG implementation in Mozilla Firefox 8.0, Thunderbird 8.0, and SeaMonkey 2.5 does not properly interact with DOMAttrModified event handlers, whic… | Patch early | 7.5 high | 69.6% | 2011-12-21 |
| CVE-2011-1567 EXP | Multiple stack-based buffer overflows in IGSSdataServer.exe 9.00.00.11063 and earlier in 7-Technologies Interactive Graphical SCADA System (IGSS) allo… | Patch early | 10.0 high | 69.6% | 2011-04-05 |
| CVE-2007-6204 EXP | Multiple stack-based buffer overflows in HP OpenView Network Node Manager (OV NNM) 6.41, 7.01, and 7.51 allow remote attackers to execute arbitrary co… | Patch early | 10.0 high | 69.6% | 2007-12-13 |
| CVE-2009-4484 EXP | Multiple stack-based buffer overflows in the CertDecoder::GetName function in src/asn.cpp in TaoCrypt in yaSSL before 1.9.9, as used in mysqld in MySQ… | Patch early | 7.5 high | 69.6% | 2009-12-30 |
| CVE-2014-0307 EXP | Use-after-free vulnerability in Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory c… | Patch early | 9.3 high | 69.5% | 2014-03-12 |
| CVE-2009-4188 EXP | HP Operations Dashboard has a default password of j2deployer for the j2deployer account, which allows remote attackers to execute arbitrary code via a… | Patch early | 10.0 high | 69.5% | 2009-12-03 |
| CVE-2005-0560 EXP | Heap-based buffer overflow in the SvrAppendReceivedChunk function in xlsasink.dll in the SMTP service of Exchange Server 2000 and 2003 allows remote a… | Patch early | 7.5 high | 69.5% | 2005-05-02 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt