CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
425,632 CVEs
1,781 on KEV
17,555 EPSS ≥ 10%
25,095 with exploits
synced 2026-11-13
25,095 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2016-10073 EXP | The from method in library/core/class.email.php in Vanilla Forums before 2.3.1 allows remote attackers to spoof the email domain in sent messages and… | Patch early | 7.5 high | 83.6% | 2017-05-23 |
| CVE-2007-4560 EXP | clamav-milter in ClamAV before 0.91.2, when run in black hole mode, allows remote attackers to execute arbitrary commands via shell metacharacters tha… | Patch early | 7.6 high | 83.5% | 2007-08-28 |
| CVE-2010-2075 EXP | UnrealIRCd 3.2.8.1, as distributed on certain mirror sites from November 2009 through June 2010, contains an externally introduced modification (Troja… | Patch early | 7.5 high | 83.5% | 2010-06-15 |
| CVE-2014-1511 EXP | Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remote attackers to bypass the pop… | Patch early | 9.8 critical | 83.5% | 2014-03-19 |
| CVE-2005-1790 EXP | Microsoft Internet Explorer 6 SP2 6.0.2900.2180 and 6.0.2800.1106, and earlier versions, allows remote attackers to cause a denial of service (crash)… | Patch early | 2.6 low | 83.5% | 2005-06-01 |
| CVE-2009-2288 EXP | statuswml.cgi in Nagios before 3.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) ping or (2) Traceroute… | Patch early | 7.5 high | 83.5% | 2009-07-01 |
| CVE-2023-22232 EXP | Adobe Connect versions 11.4.5 (and earlier), 12.1.5 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Secu… | Patch early | 5.3 medium | 83.4% | 2023-02-17 |
| CVE-2001-1583 EXP | lpd daemon (in.lpd) in Solaris 8 and earlier allows remote attackers to execute arbitrary commands via a job request with a crafted control file that… | Patch early | 10.0 high | 83.4% | 2001-12-31 |
| CVE-2014-7863 EXP | The FailOverHelperServlet (aka FailServlet) servlet in ZOHO ManageEngine Applications Manager before 11.9 build 11912, OpManager 8 through 11.5 build… | Patch early | 7.5 high | 83.4% | 2020-02-08 |
| CVE-2019-1935 EXP | A vulnerability in Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data could allo… | Patch early | 9.8 critical | 83.4% | 2019-08-21 |
| CVE-2009-3733 EXP | Directory traversal vulnerability in VMware Server 1.x before 1.0.10 build 203137 and 2.x before 2.0.2 build 203138 on Linux, VMware ESXi 3.5, and VMw… | Patch early | 5.0 medium | 83.4% | 2009-11-02 |
| CVE-2011-4885 EXP | PHP before 5.3.9 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote… | Patch early | 5.0 medium | 83.4% | 2011-12-30 |
| CVE-2014-0050 EXP | MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to ca… | Patch early | 7.5 high | 83.3% | 2014-04-01 |
| CVE-2016-0792 EXP | Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to execute arbitrary code via seria… | Patch early | 8.8 high | 83.3% | 2016-04-07 |
| CVE-2014-9034 EXP | wp-includes/class-phpass.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to cause… | Patch early | 5.0 medium | 83.2% | 2014-11-25 |
| CVE-2020-7246 EXP | A remote code execution (RCE) vulnerability exists in qdPM 9.1 and earlier. An attacker can upload a malicious PHP code file via the profile photo fun… | Patch early | 8.8 high | 83.2% | 2020-01-21 |
| CVE-2021-25094 EXP | The Tatsu WordPress plugin before 3.3.12 add_custom_font action can be used without prior authentication to upload a rogue zip file which is uncompres… | Patch early | 8.1 high | 83.2% | 2022-04-25 |
| CVE-2012-5958 EXP | Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP parser in the portable SDK for UPnP Devices (aka lib… | Patch early | 10.0 high | 83.2% | 2013-01-31 |
| CVE-2015-3090 EXP | Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on Linux, Adobe AIR before 17… | Patch early | 10.0 high | 83.2% | 2015-05-13 |
| CVE-2020-7980 EXP | Intellian Aptus Web 1.24 allows remote attackers to execute arbitrary OS commands via the Q field within JSON data to the cgi-bin/libagent.cgi URI. NO… | Patch early | 9.8 critical | 83.1% | 2020-01-25 |
| CVE-2011-2921 EXP | ktsuss versions 1.4 and prior has the uid set to root and does not drop privileges prior to executing user specified commands, which can result in com… | Patch early | 9.8 critical | 83.1% | 2019-11-19 |
| CVE-2010-4452 EXP | Unspecified vulnerability in the Deployment component in Java Runtime Environment (JRE) in Oracle Java SE and Java for Business 6 Update 23 and earlie… | Patch early | 10.0 high | 83% | 2011-02-17 |
| CVE-2003-0822 EXP | Buffer overflow in the debug functionality in fp30reg.dll of Microsoft FrontPage Server Extensions (FPSE) 2000 and 2002 allows remote attackers to exe… | Patch early | 7.5 high | 83% | 2003-12-15 |
| CVE-2018-17254 EXP | The JCK Editor component 6.4.4 for Joomla! allows SQL Injection via the jtreelink/dialogs/links.php parent parameter. | Patch early | 9.8 critical | 83% | 2018-09-20 |
| CVE-2019-14470 EXP | cosenary Instagram-PHP-API (aka Instagram PHP API V2), as used in the UserPro plugin through 4.9.32 for WordPress, has XSS via the example/success.php… | Patch early | 6.1 medium | 83% | 2019-09-04 |
| CVE-2018-16763 EXP | FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter. This can lead to Pre-Auth Remote Code… | Patch early | 9.8 critical | 82.9% | 2018-09-09 |
| CVE-2009-4006 EXP | Stack-based buffer overflow in the TEA decoding algorithm in RhinoSoft Serv-U FTP server 7.0.0.1, 9.0.0.5, and other versions before 9.1.0.0 allows re… | Patch early | 10.0 high | 82.9% | 2009-11-20 |
| CVE-2016-0041 EXP | Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows… | Patch early | 7.8 high | 82.9% | 2016-02-10 |
| CVE-2019-0539 EXP | A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scri… | Patch early | 7.5 high | 82.9% | 2019-01-08 |
| CVE-2019-1619 EXP | A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to b… | Patch early | 9.8 critical | 82.8% | 2019-06-27 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt