CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
424,850 CVEs
1,779 on KEV
17,545 EPSS ≥ 10%
25,095 with exploits
synced 2026-11-12
10,150 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2017-0118 EXP | Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT… | Patch early | 4.3 medium | 23% | 2017-03-17 |
| CVE-2010-0432 EXP | Multiple cross-site scripting (XSS) vulnerabilities in the Apache Open For Business Project (aka OFBiz) 09.04 and earlier, as used in Opentaps, Neogia… | Patch early | 4.3 medium | 22.9% | 2010-04-15 |
| CVE-2017-8652 EXP | Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to disclose information due to the way that… | Patch early | 6.5 medium | 22.9% | 2017-08-08 |
| CVE-2000-0887 EXP | named in BIND 8.2 through 8.2.2-P6 allows remote attackers to cause a denial of service by making a compressed zone transfer (ZXFR) request and perfor… | Patch early | 5.0 medium | 22.9% | 2000-12-19 |
| CVE-2022-28117 EXP | A Server-Side Request Forgery (SSRF) in feed_parser class of Navigate CMS v2.9.4 allows remote attackers to force the application to make arbitrary re… | Patch early | 4.9 medium | 22.9% | 2022-04-28 |
| CVE-2017-0120 EXP | Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to obtain sensitive informatio… | Patch early | 4.3 medium | 22.8% | 2017-03-17 |
| CVE-2008-2631 EXP | The WordClient interface in Alt-N Technologies MDaemon 9.6.5 allows remote attackers to cause a denial of service (NULL pointer dereference and applic… | Patch early | 5.0 medium | 22.8% | 2008-06-10 |
| CVE-2018-18777 EXP | Directory traversal vulnerability in Microstrategy Web, version 7, in "/WebMstr7/servlet/mstrWeb" (in the parameter subpage) allows remote authenticat… | Patch early | 4.3 medium | 22.8% | 2018-11-01 |
| CVE-2006-3513 EXP | danim.dll in Microsoft Internet Explorer 6 allows remote attackers to cause a denial of service (application crash) by accessing the Data property of… | Patch early | 5.0 medium | 22.7% | 2006-07-11 |
| CVE-2014-2668 EXP | Apache CouchDB 1.5.0 and earlier allows remote attackers to cause a denial of service (CPU and memory consumption) via the count parameter to /_uuids. | Patch early | 5.0 medium | 22.7% | 2014-03-28 |
| CVE-2012-0896 EXP | Absolute path traversal vulnerability in download.php in the Count Per Day module before 3.1.1 for WordPress allows remote attackers to read arbitrary… | Patch early | 5.0 medium | 22.7% | 2012-01-20 |
| CVE-2006-1043 EXP | Stack-based buffer overflow in Microsoft Visual Studio 6.0 and Microsoft Visual InterDev 6.0 allows user-assisted attackers to execute arbitrary code… | Patch early | 5.1 medium | 22.6% | 2006-03-07 |
| CVE-2024-21320 EXP | Windows Themes Spoofing Vulnerability | Patch early | 6.5 medium | 22.6% | 2024-01-09 |
| CVE-2013-2419 EXP | Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0… | Patch early | 5.0 medium | 22.6% | 2013-04-17 |
| CVE-2009-2655 EXP | mshtml.dll in Microsoft Internet Explorer 7 and 8 on Windows XP SP3 allows remote attackers to cause a denial of service (application crash) by callin… | Patch early | 4.3 medium | 22.6% | 2009-08-03 |
| CVE-2017-8683 EXP | Windows graphics on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows… | Patch early | 5.5 medium | 22.6% | 2017-09-13 |
| CVE-1999-0668 EXP | The scriptlet.typelib ActiveX control is marked as "safe for scripting" for Internet Explorer, which allows a remote attacker to execute arbitrary com… | Patch early | 5.1 medium | 22.6% | 1999-08-21 |
| CVE-2004-0519 EXP | Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.2 allow remote attackers to execute arbitrary script as other users and possib… | Patch early | 6.8 medium | 22.5% | 2004-08-18 |
| CVE-2008-0090 EXP | A certain ActiveX control in npUpload.dll in DivX Player 6.6.0 allows remote attackers to cause a denial of service (Internet Explorer 7 crash) via a… | Patch early | 5.0 medium | 22.5% | 2008-01-04 |
| CVE-2003-0526 EXP | Cross-site scripting (XSS) vulnerability in Microsoft Internet Security and Acceleration (ISA) Server 2000 allows remote attackers to inject arbitrary… | Patch early | 6.8 medium | 22.5% | 2003-08-18 |
| CVE-2015-5116 EXP | Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18… | Patch early | 5.0 medium | 22.5% | 2015-07-09 |
| CVE-2017-8550 EXP | A remote code execution vulnerability exists in Skype for Business when the software fails to sanitize specially crafted content, aka "Skype for Busin… | Patch early | 5.4 medium | 22.4% | 2017-06-15 |
| CVE-2000-0581 EXP | Windows 2000 Telnet Server allows remote attackers to cause a denial of service by sending a continuous stream of binary zeros, which causes the serve… | Patch early | 5.0 medium | 22.4% | 2000-06-30 |
| CVE-2007-4058 EXP | Absolute path traversal vulnerability in a certain ActiveX control in vielib.dll 2.2.5.42958 in EMC VMware 6.0.0 allows remote attackers to execute ar… | Patch early | 4.3 medium | 22.4% | 2007-07-30 |
| CVE-2000-0942 EXP | The CiWebHitsFile component in Microsoft Indexing Services for Windows 2000 allows remote attackers to conduct a cross site scripting (CSS) attack via… | Patch early | 5.1 medium | 22.4% | 2000-12-19 |
| CVE-2001-1055 EXP | The Microsoft Windows network stack allows remote attackers to cause a denial of service (CPU consumption) via a flood of malformed ARP request packet… | Patch early | 5.0 medium | 22.3% | 2001-07-30 |
| CVE-2014-6308 EXP | Directory traversal vulnerability in OSClass before 3.4.2 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter in… | Patch early | 5.0 medium | 22.3% | 2014-10-20 |
| CVE-2002-1831 EXP | Microsoft MSN Messenger Service 1.0 through 4.6 allows remote attackers to cause a denial of service (crash) via an invite request that contains hex-e… | Patch early | 5.0 medium | 22.3% | 2002-12-31 |
| CVE-2013-3179 EXP | Cross-site scripting (XSS) vulnerability in Microsoft SharePoint Server 2007 SP3, 2010 SP1 and SP2, and 2013 allows remote attackers to inject arbitra… | Patch early | 4.3 medium | 22.3% | 2013-09-11 |
| CVE-2015-8660 EXP | The ovl_setattr function in fs/overlayfs/inode.c in the Linux kernel through 4.3.3 attempts to merge distinct setattr operations, which allows local u… | Patch early | 6.7 medium | 22.2% | 2015-12-28 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt