CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
403,887 CVEs
1,739 on KEV
17,300 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-10
25,091 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2000-0282 EXP | TalentSoft webpsvr daemon in the Web+ shopping cart application allows remote attackers to read arbitrary files via a .. (dot dot) attack on the webpl… | Patch early | 5.0 medium | 7.8% | 2000-04-12 |
| CVE-2002-1432 EXP | MidiCart stores the midicart.mdb database file under the Web document root, which allows remote attackers to steal sensitive information by directly r… | Patch early | 5.0 medium | 7.8% | 2003-04-11 |
| CVE-2016-5840 EXP | hotfix_upload.cgi in Trend Micro Deep Discovery Inspector (DDI) 3.7, 3.8 SP1 (3.81), and 3.8 SP2 (3.82) allows remote administrators to execute arbitr… | Patch early | 7.2 high | 7.8% | 2016-06-30 |
| CVE-2007-6548 EXP | Multiple direct static code injection vulnerabilities in RunCMS before 1.6.1 allow remote authenticated administrators to inject arbitrary PHP code vi… | Patch early | 7.5 high | 7.8% | 2007-12-28 |
| CVE-2005-4468 EXP | PHP remote file include vulnerability in help_text_vars.php in PHPGedView 3.3.7 and earlier allows remote attackers to execute arbitrary code via a UR… | Patch early | 7.5 high | 7.8% | 2005-12-22 |
| CVE-2018-12519 EXP | An issue was discovered in ShopNx through 2017-11-17. The vulnerability allows a remote attacker to upload any malicious file to a Node.js application… | Patch early | 8.8 high | 7.8% | 2018-06-19 |
| CVE-2006-0714 EXP | Directory traversal vulnerability in the installation file (sql/install-0.9.7.php) in Flyspray 0.9.7 allows remote attackers to include arbitrary file… | Patch early | 5.0 medium | 7.8% | 2006-02-15 |
| CVE-2007-1596 EXP | Multiple PHP remote file inclusion vulnerabilities in the NFN Address Book (com_nfn_addressbook) 0.4 component for Mambo and Joomla! allow remote atta… | Patch early | 9.3 high | 7.8% | 2007-03-22 |
| CVE-2007-2763 EXP | Buffer overflow in the UnlockSupport function in the LockModules subsystem in a certain ActiveX control in ltmm15.dll in Sienzo Digital Music Mentor (… | Patch early | 10.0 high | 7.8% | 2007-05-18 |
| CVE-2016-5764 EXP | Micro Focus Rumba FTP 4.X client buffer overflow makes it possible to corrupt the stack and allow arbitrary code execution. Fixed in: Rumba FTP 4.5 (H… | Patch early | 8.8 high | 7.8% | 2016-10-27 |
| CVE-2009-5026 EXP | The executable comment feature in MySQL 5.0.x before 5.0.93 and 5.1.x before 5.1.50, when running in certain slave configurations in which the slave i… | Patch early | 6.8 medium | 7.8% | 2012-08-17 |
| CVE-2006-3323 EXP | PHP remote file inclusion vulnerability in admin/admin.php in MF Piadas 1.0 allows remote attackers to execute arbitrary PHP code via the page paramet… | Patch early | 7.5 high | 7.8% | 2006-06-30 |
| CVE-2003-1263 EXP | ICAL.EXE in iCal 3.7 allows remote attackers to cause a denial of service (crash) via a malformed HTTP request, possibly due to an invalid method name… | Patch early | 5.0 medium | 7.8% | 2003-12-31 |
| CVE-2011-5012 EXP | Heap-based buffer overflow in the Reflection FTP Client (rftpcom.dll 7.2.0.106 and possibly other versions), as used in Attachmate Reflection 2008, Re… | Patch early | 10.0 high | 7.8% | 2011-12-25 |
| CVE-2005-1703 EXP | Warrior Kings: Battles 1.23 and earlier allows remote attackers to cause a denial of service (server crash) via a partial join packet that triggers a… | Patch early | 5.0 medium | 7.7% | 2005-05-24 |
| CVE-2024-39930 EXP | The built-in SSH server of Gogs through 0.13.0 allows argument injection in internal/ssh/ssh.go, leading to remote code execution. Authenticated attac… | Patch early | 9.9 critical | 7.7% | 2024-07-04 |
| CVE-2009-4541 EXP | Multiple PHP remote file inclusion vulnerabilities in IsolSoft Support Center 2.5 allow remote attackers to execute arbitrary PHP code via a URL in th… | Patch early | 7.5 high | 7.7% | 2010-01-04 |
| CVE-2000-0937 EXP | Samba Web Administration Tool (SWAT) in Samba 2.0.7 does not log login attempts in which the username is correct but the password is wrong, which allo… | Patch early | 7.5 high | 7.7% | 2000-12-19 |
| CVE-2008-4514 EXP | The HTML parser in KDE Konqueror 3.5.9 allows remote attackers to cause a denial of service (application crash) via a font tag with a long color value… | Patch early | 5.0 medium | 7.7% | 2008-10-09 |
| CVE-2012-2271 EXP | Buffer overflow in the InitLicenKeys function in a certain ActiveX control in SkinCrafter3_vs2005.dll in SkinCrafter 3.0 allows remote attackers to ex… | Patch early | 10.0 high | 7.7% | 2012-05-21 |
| CVE-2004-2507 EXP | Absolute path traversal vulnerability in main.cgi in Linksys WVC11B Wireless-B Internet Video Camera allows remote attackers to read arbitrary files v… | Patch early | 5.0 medium | 7.7% | 2004-12-31 |
| CVE-2004-2107 EXP | Finjan SurfinGate 6.0 and 7.0, when running in proxy mode, does not authenticate FHTTP commands on TCP port 3141, which allows remote attackers to use… | Patch early | 7.5 high | 7.7% | 2004-12-31 |
| CVE-2012-3585 EXP | Heap-based buffer overflow in jpeg_ls.dll in the Jpeg_LS (aka JLS) plugin in the formats plugins in IrfanView PlugIns before 4.34 allows remote attack… | Patch early | 9.3 high | 7.7% | 2012-07-05 |
| CVE-2014-5084 EXP | A Command Execution vulnerability exists in Sphider Pro 3.2 due to insufficient sanitization of fwrite, which could let a remote malicious user execut… | Patch early | 8.8 high | 7.7% | 2020-02-10 |
| CVE-2011-4643 EXP | Multiple directory traversal vulnerabilities in Splunk 4.x before 4.2.5 allow remote authenticated users to read arbitrary files via a .. (dot dot) in… | Patch early | 4.0 medium | 7.7% | 2012-01-03 |
| CVE-2006-4850 EXP | PHP remote file inclusion vulnerability in system/_b/contentFiles/gBIndex.php in BolinOS 4.5.5 and earlier allows remote attackers to execute arbitrar… | Patch early | 5.1 medium | 7.7% | 2006-09-19 |
| CVE-2005-3487 EXP | Multiple buffer overflows in Scorched 3D 39.1 (bf) and earlier allow remote attackers to execute arbitrary code via various (1) GLConsole::addLine, (2… | Patch early | 7.5 high | 7.7% | 2005-11-03 |
| CVE-2004-1471 EXP | Format string vulnerability in wrapper.c in CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16 allows remote attackers with CVSROOT commit access t… | Patch early | 7.1 high | 7.7% | 2004-12-31 |
| CVE-2012-4889 EXP | Multiple cross-site scripting (XSS) vulnerabilities in ManageEngine Firewall Analyzer 7.2 allow remote attackers to inject arbitrary web script or HTM… | Patch early | 4.3 medium | 7.7% | 2012-09-10 |
| CVE-2019-8611 EXP | Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, Safa… | Patch early | 8.8 high | 7.7% | 2019-12-18 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt