CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
425,632 CVEs
1,781 on KEV
17,555 EPSS ≥ 10%
25,095 with exploits
synced 2026-11-13
25,095 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2006-0003 EXP | Unspecified vulnerability in the RDS.Dataspace ActiveX control, which is contained in ActiveX Data Objects (ADO) and distributed in Microsoft Data Acc… | Patch early | 5.1 medium | 82.8% | 2006-04-12 |
| CVE-2005-0356 EXP | Multiple TCP implementations with Protection Against Wrapped Sequence Numbers (PAWS) with the timestamps option enabled allow remote attackers to caus… | Patch early | 5.0 medium | 82.8% | 2005-05-31 |
| CVE-2019-8942 EXP | WordPress before 4.9.9 and 5.x before 5.0.1 allows remote code execution because an _wp_attached_file Post Meta entry can be changed to an arbitrary s… | Patch early | 8.8 high | 82.7% | 2019-02-20 |
| CVE-2020-2230 EXP | Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the project naming strategy description, resulting in a stored cross-site scripting… | Patch early | 5.4 medium | 82.7% | 2020-08-12 |
| CVE-2014-4511 EXP | Gitlist before 0.5.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the file name in the URI of a request for a (1)… | Patch early | 7.5 high | 82.7% | 2014-07-22 |
| CVE-2017-5817 EXP | A Remote Code Execution vulnerability in HPE Intelligent Management Center (iMC) PLAT version 7.3 E0504P04 was found. | Patch early | 9.8 critical | 82.6% | 2018-02-15 |
| CVE-2009-2765 EXP | httpd.c in httpd in the management GUI in DD-WRT 24 sp1, and other versions before build 12533, allows remote attackers to execute arbitrary commands… | Patch early | 8.3 high | 82.5% | 2009-08-14 |
| CVE-2020-8163 EXP | The is a code injection vulnerability in versions of Rails prior to 5.0.1 that wouldallow an attacker who controlled the `locals` argument of a `rende… | Patch early | 8.8 high | 82.5% | 2020-07-02 |
| CVE-2011-0276 EXP | HP OpenView Performance Insight Server 5.2, 5.3, 5.31, 5.4, and 5.41 contains a "hidden account" in the com.trinagy.security.XMLUserManager Java class… | Patch early | 10.0 high | 82.4% | 2011-02-02 |
| CVE-2021-28164 EXP | In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to ac… | Patch early | 5.3 medium | 82.4% | 2021-04-01 |
| CVE-2024-44000 EXP | Insufficiently Protected Credentials vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Authentication Bypass.This issue a… | Patch early | 9.8 critical | 82.3% | 2024-10-20 |
| CVE-2017-2741 EXP | A potential security vulnerability has been identified with HP PageWide Printers, HP OfficeJet Pro Printers, with firmware before 1708D. This vulnerab… | Patch early | 9.8 critical | 82.3% | 2018-01-23 |
| CVE-2018-9995 EXP | TBK DVR4104 and DVR4216 devices, as well as Novo, CeNova, QSee, Pulnix, XVR 5 in 1, Securus, Night OWL, DVR Login, HVR Login, and MDVR Login, which ru… | Patch early | 9.8 critical | 82.3% | 2018-04-10 |
| CVE-2009-2521 EXP | Stack consumption vulnerability in the FTP Service in Microsoft Internet Information Services (IIS) 5.0 through 7.0 allows remote authenticated users… | Patch early | 5.0 medium | 82.3% | 2009-09-04 |
| CVE-2011-2140 EXP | Adobe Flash Player before 10.3.183.5 on Windows, Mac OS X, Linux, and Solaris and before 10.3.186.3 on Android, and Adobe AIR before 2.7.1 on Windows… | Patch early | 10.0 high | 82.3% | 2011-08-10 |
| CVE-2007-1036 EXP | The default configuration of JBoss does not restrict access to the (1) console and (2) web management interfaces, which allows remote attackers to byp… | Patch early | 7.5 high | 82.3% | 2007-02-21 |
| CVE-2003-0818 EXP | Multiple integer overflows in Microsoft ASN.1 library (MSASN1.DLL), as used in LSASS.EXE, CRYPT32.DLL, and other Microsoft executables and libraries o… | Patch early | 7.5 high | 82.2% | 2004-03-03 |
| CVE-2017-0038 EXP | gdi32.dll in Graphics Device Interface (GDI) in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows S… | Patch early | 5.5 medium | 82.2% | 2017-02-20 |
| CVE-2024-10924 EXP | The Really Simple Security (Free, Pro, and Pro Multisite) plugins for WordPress are vulnerable to authentication bypass in versions 9.0.0 to 9.1.1.1.… | Patch early | 9.8 critical | 82.2% | 2024-11-15 |
| CVE-2014-1510 EXP | The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows rem… | Patch early | 9.8 critical | 82.2% | 2014-03-19 |
| CVE-2012-0053 EXP | protocol.c in the Apache HTTP Server 2.2.x through 2.2.21 does not properly restrict header information during construction of Bad Request (aka 400) e… | Patch early | 4.3 medium | 82.2% | 2012-01-28 |
| CVE-2017-17090 EXP | An issue was discovered in chan_skinny.c in Asterisk Open Source 13.18.2 and older, 14.7.2 and older, and 15.1.2 and older, and Certified Asterisk 13.… | Patch early | 7.5 high | 82.2% | 2017-12-02 |
| CVE-2015-6922 EXP | Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.33, 8.x before 8.0.0.23, 9.0 before 9.0.0.19, and 9.1 before 9.1.0.9 does not properly requ… | Patch early | 9.8 critical | 82.1% | 2020-02-17 |
| CVE-2003-0812 EXP | Stack-based buffer overflow in a logging function for Windows Workstation Service (WKSSVC.DLL) allows remote attackers to execute arbitrary code via R… | Patch early | 7.5 high | 82.1% | 2003-12-15 |
| CVE-2022-1175 EXP | Improper neutralization of user input in GitLab CE/EE versions 14.4 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versions startin… | Patch early | 8.7 high | 82% | 2022-04-04 |
| CVE-2018-0886 EXP | The Credential Security Support Provider protocol (CredSSP) in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Wi… | Patch early | 7.0 high | 82% | 2018-03-14 |
| CVE-2014-8440 EXP | Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR before 15.0.0… | Patch early | 10.0 high | 81.9% | 2014-11-11 |
| CVE-2020-35578 EXP | An issue was discovered in the Manage Plugins page in Nagios XI before 5.8.0. Because the line-ending conversion feature is mishandled during a plugin… | Patch early | 7.2 high | 81.9% | 2021-01-13 |
| CVE-2009-2526 EXP | Microsoft Windows Vista Gold, SP1, and SP2 and Server 2008 Gold and SP2 do not properly validate fields in SMBv2 packets, which allows remote attacker… | Patch early | 7.8 high | 81.9% | 2009-10-14 |
| CVE-2015-6128 EXP | Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 mishandle library loading, which allows local users to gain privile… | Patch early | 7.2 high | 81.9% | 2015-12-09 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt