CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
403,879 CVEs
1,739 on KEV
17,300 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-10
25,091 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2020-10387 EXP | Path Traversal in admin/download.php in Chadha PHPKB Standard Multi-Language 9 allows remote attackers to download files from the server using a dot-d… | Patch early | 4.9 medium | 7.8% | 2020-03-12 |
| CVE-2020-12712 EXP | A vulnerability based on insecure user/password encryption in the JOE (job editor) component of SOS JobScheduler 1.12 and 1.13 allows attackers to dec… | Patch early | 7.5 high | 7.8% | 2020-06-11 |
| CVE-2013-1806 EXP | Multiple directory traversal vulnerabilities in PHP-Fusion before 7.02.06 allow remote authenticated users to include and execute arbitrary files via… | Patch early | 6.5 medium | 7.8% | 2014-04-30 |
| CVE-2007-0020 EXP | Heap-based buffer overflow in the SFTP protocol handler for Panic Transmit (Transmit.app) up to 3.5.5 allows remote attackers to execute arbitrary cod… | Patch early | 9.3 high | 7.8% | 2007-01-24 |
| CVE-1999-0101 EXP | Buffer overflow in AIX and Solaris "gethostbyname" library call allows root access through corrupt DNS host names. | Patch early | 10.0 high | 7.8% | 1996-12-10 |
| CVE-2008-4472 EXP | The UpdateEngine class in the LiveUpdate ActiveX control (LiveUpdate16.DLL 17.2.56), as used in Revit Architecture 2009 SP2 and Autodesk Design Review… | Patch early | 9.3 high | 7.8% | 2008-10-07 |
| CVE-2007-1890 EXP | Integer overflow in the msg_receive function in PHP 4 before 4.4.5 and PHP 5 before 5.2.1, on FreeBSD and possibly other platforms, allows context-dep… | Patch early | 7.5 high | 7.8% | 2007-04-06 |
| CVE-2010-3130 EXP | Untrusted search path vulnerability in TechSmith Snagit all versions 10.x and 11.x allows local users, and possibly remote attackers, to execute arbit… | Patch early | 9.3 high | 7.8% | 2010-08-26 |
| CVE-2006-2330 EXP | PHP-Fusion 6.00.306 and earlier, running under Apache HTTP Server 1.3.27 and PHP 4.3.3, allows remote authenticated users to upload files of arbitrary… | Patch early | 6.4 medium | 7.8% | 2006-05-12 |
| CVE-2026-46368 EXP | luci-app-https-dns-proxy through 2025.12.29-5 — an optional LuCI web UI add-on for the https-dns-proxy package, distributed through the OpenWrt commun… | Patch early | 8.8 high | 7.8% | 2026-05-26 |
| CVE-2007-1362 EXP | Mozilla Firefox 1.5.x before 1.5.0.12 and 2.x before 2.0.0.4, and SeaMonkey 1.0.9 and 1.1.2, allows remote attackers to cause a denial of service via… | Patch early | 4.3 medium | 7.8% | 2007-06-01 |
| CVE-2007-4244 EXP | PHP remote file inclusion vulnerability in langset.php in J! Reactions (com_jreactions) 1.8.1 and earlier, a Joomla! component, allows remote attacker… | Patch early | 7.5 high | 7.8% | 2007-08-08 |
| CVE-2010-3126 EXP | Untrusted search path vulnerability in avast! Free Antivirus version 5.0.594 and earlier allows local users, and possibly remote attackers, to execute… | Patch early | 9.3 high | 7.8% | 2010-08-26 |
| CVE-2010-3137 EXP | Untrusted search path vulnerability in Nullsoft Winamp 5.581, and probably other versions, allows local users, and possibly remote attackers, to execu… | Patch early | 9.3 high | 7.8% | 2010-08-26 |
| CVE-2007-2425 EXP | Directory traversal vulnerability in fileview.php in Imageview 5.3 allows remote attackers to read arbitrary files via a .. (dot dot) in the album par… | Patch early | 5.0 medium | 7.8% | 2007-05-02 |
| CVE-2013-6343 EXP | Multiple buffer overflows in web.c in httpd on the ASUS RT-N56U and RT-AC66U routers with firmware 3.0.0.4.374_979 allow remote attackers to execute a… | Patch early | 10.0 high | 7.8% | 2014-01-22 |
| CVE-2002-0982 EXP | Microsoft SQL Server 2000 SP2, when configured as a distributor, allows attackers to execute arbitrary code via the @scriptfile parameter to the sp_MS… | Patch early | 7.5 high | 7.8% | 2002-09-24 |
| CVE-2018-10608 EXP | SEL AcSELerator Architect version 2.2.24.0 and prior can be exploited when the AcSELerator Architect FTP client connects to a malicious FTP server, wh… | Patch early | 7.5 high | 7.8% | 2018-07-24 |
| CVE-2007-2611 EXP | Multiple PHP remote file inclusion vulnerabilities in CGX 20050314 allow remote attackers to execute arbitrary PHP code via a URL in the pathCGX param… | Patch early | 6.8 medium | 7.8% | 2007-05-11 |
| CVE-2012-3816 EXP | WinRadius Server 2009 allows remote attackers to cause a denial of service (crash) via a long password in an Access-Request packet. | Patch early | 7.8 high | 7.8% | 2012-06-27 |
| CVE-2005-3293 EXP | Xerver 4.17 allows remote attackers to (1) obtain source code of scripts via a request with a trailing "." (dot) or (2) list directory contents via a… | Patch early | 5.0 medium | 7.8% | 2005-10-23 |
| CVE-2008-6178 EXP | Unrestricted file upload vulnerability in editor/filemanager/browser/default/connectors/php/connector.php in FCKeditor 2.2, as used in Falt4 CMS, Nuke… | Patch early | 7.5 high | 7.8% | 2009-02-19 |
| CVE-2008-1488 EXP | Stack-based buffer overflow in apc.c in Alternative PHP Cache (APC) 3.0.11 through 3.0.16 allows remote attackers to execute arbitrary code via a long… | Patch early | 6.8 medium | 7.8% | 2008-03-24 |
| CVE-2000-0688 EXP | Subscribe Me LITE does not properly authenticate attempts to change the administrator password, which allows remote attackers to gain privileges for t… | Patch early | 7.5 high | 7.8% | 2000-10-20 |
| CVE-2000-0689 EXP | Account Manager LITE does not properly authenticate attempts to change the administrator password, which allows remote attackers to gain privileges fo… | Patch early | 7.5 high | 7.8% | 2000-10-20 |
| CVE-2019-19142 EXP | Intelbras WRN240 devices do not require authentication to replace the firmware via a POST request to the incoming/Firmware.cfg URI. | Patch early | 7.5 high | 7.8% | 2020-01-17 |
| CVE-2022-34128 EXP | The Cartography (aka positions) plugin before 6.0.1 for GLPI allows remote code execution via PHP code in the POST data to front/upload.php. | Patch early | 9.8 critical | 7.8% | 2023-04-16 |
| CVE-2008-3360 EXP | Stack-based buffer overflow in the HTML parser in IntelliTamper 2.0.7 allows remote attackers to execute arbitrary code via a long URL in the HREF att… | Patch early | 9.3 high | 7.8% | 2008-07-29 |
| CVE-2012-3549 EXP | The SCTP implementation in FreeBSD 8.2 allows remote attackers to cause a denial of service (NULL pointer dereference and kernel panic) via a crafted… | Patch early | 7.8 high | 7.8% | 2012-10-09 |
| CVE-2009-2478 EXP | Mozilla Firefox 3.5 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via unspecified vectors, rel… | Patch early | 5.0 medium | 7.8% | 2009-07-16 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt