CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
404,381 CVEs
1,739 on KEV
17,299 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-12
25,091 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2017-5344 EXP | An issue was discovered in dotCMS through 3.6.1. The findChildrenByFilter() function which is called by the web accessible path /categoriesServlet per… | Patch early | 9.8 critical | 6.3% | 2017-02-17 |
| CVE-2013-6796 EXP | The SMTP server in DeepOfix 3.3 and earlier allows remote attackers to bypass authentication via an empty password, which triggers an LDAP anonymous b… | Patch early | 5.0 medium | 6.3% | 2014-10-26 |
| CVE-2002-0388 EXP | Cross-site scripting vulnerabilities in Mailman before 2.0.11 allow remote attackers to execute script via (1) the admin login page, or (2) the Piperm… | Patch early | 7.5 high | 6.3% | 2002-06-18 |
| CVE-2020-15718 EXP | RosarioSIS 6.7.2 is vulnerable to XSS, caused by improper validation of user-supplied input by the PrintSchedules.php script. A remote attacker could… | Patch early | 6.1 medium | 6.3% | 2020-07-15 |
| CVE-2001-0778 EXP | OmniHTTPd 2.0.8 and earlier allow remote attackers to obtain source code via a GET request with the URL-encoded symbol for a space (%20). | Patch early | 5.0 medium | 6.3% | 2001-10-18 |
| CVE-2007-6593 EXP | Multiple stack-based buffer overflows in l123sr.dll in Autonomy (formerly Verity) KeyView SDK, as used by IBM Lotus Notes 5.x through 8.x, allow user-… | Patch early | 8.8 high | 6.3% | 2007-12-28 |
| CVE-2019-15083 EXP | Default installations of Zoho ManageEngine ServiceDesk Plus 10.0 before 10500 are vulnerable to XSS injected by a workstation local administrator. Usi… | Patch early | 6.1 medium | 6.3% | 2020-05-14 |
| CVE-2008-3486 EXP | Directory traversal vulnerability in the user_get_profile function in include/functions.inc.php in Coppermine Photo Gallery (CPG) 1.4.18 and earlier,… | Patch early | 7.5 high | 6.3% | 2008-08-06 |
| CVE-2022-47879 EXP | A Remote Code Execution (RCE) vulnerability in /be/rpc.php in Jedox 2020.2.5 allows remote authenticated users to load arbitrary PHP classes from the… | Patch early | 7.5 high | 6.3% | 2023-05-12 |
| CVE-2014-4018 EXP | The ZTE ZXV10 W300 router with firmware W300V1.0.0a_ZRD_LK has a default password of admin for the admin account, which makes it easier for remote att… | Patch early | 7.8 high | 6.3% | 2014-07-16 |
| CVE-2005-1006 EXP | Multiple cross-site scripting (XSS) vulnerabilities in SonicWALL SOHO 5.1.7.0 allow remote attackers to inject arbitrary web script or HTML via (1) th… | Patch early | 4.3 medium | 6.3% | 2005-05-02 |
| CVE-2018-10286 EXP | The Ericsson-LG iPECS NMS A.1Ac web application discloses sensitive information such as the NMS admin credentials and the PostgreSQL database credenti… | Patch early | 8.8 high | 6.3% | 2018-04-22 |
| CVE-2008-4664 EXP | Heap-based buffer overflow in QvodInsert.QvodCtrl.1 ActiveX control (QvodInsert.dll) in QVOD Player before 2.1.5 build 0053 allows remote attackers to… | Patch early | 9.3 high | 6.3% | 2008-10-22 |
| CVE-2008-2076 EXP | Directory traversal vulnerability in admin.php in ActualScripts ActualAnalyzer Lite 2.78 allows remote attackers to include and execute arbitrary loca… | Patch early | 7.5 high | 6.3% | 2008-05-05 |
| CVE-2007-0649 EXP | Variable overwrite vulnerability in interface/globals.php in OpenEMR 2.8.2 and earlier allows remote attackers to overwrite arbitrary program variable… | Patch early | 4.3 medium | 6.3% | 2007-02-01 |
| CVE-2019-8352 EXP | By default, BMC PATROL Agent through 11.3.01 uses a static encryption key for encrypting/decrypting user credentials sent over the network to managed… | Patch early | 9.8 critical | 6.3% | 2019-05-20 |
| CVE-2009-0250 EXP | Ryneezy phoSheezy 0.2 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the… | Patch early | 5.0 medium | 6.3% | 2009-01-22 |
| CVE-2020-25453 EXP | An issue was discovered in BlackCat CMS before 1.4. There is a CSRF vulnerability (bypass csrf_token) that allows remote arbitrary code execution. | Patch early | 8.8 high | 6.3% | 2020-09-15 |
| CVE-2012-4865 EXP | Buffer overflow in Oreans Themida 2.1.8.0 allows remote attackers to execute arbitrary code via a crafted .TMD file. | Patch early | 9.3 high | 6.3% | 2012-09-06 |
| CVE-2012-5324 EXP | Multiple buffer overflows in the Pdf Printer Preferences ActiveX Control in pdfxctrl.dll in Tracker Software PDF-XChange 3.60.0128 allow remote attack… | Patch early | 9.3 high | 6.3% | 2012-10-08 |
| CVE-2006-4898 EXP | PHP remote file inclusion vulnerability in include/phpxd/phpXD.php in guanxiCRM 0.9.1 and earlier allows remote attackers to execute arbitrary PHP cod… | Patch early | 7.5 high | 6.3% | 2006-09-19 |
| CVE-2006-4912 EXP | PHP remote file inclusion vulnerability in PHP DocWriter 0.3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the script… | Patch early | 7.5 high | 6.3% | 2006-09-21 |
| CVE-2006-5292 EXP | PHP remote file inclusion vulnerability in photo_comment.php in Exhibit Engine 1.5 RC 4 and earlier allows remote attackers to execute arbitrary PHP c… | Patch early | 7.5 high | 6.3% | 2006-10-16 |
| CVE-2008-5885 EXP | The Net Guys ASPired2Quote stores sensitive information under the web root with insufficient access control, which allows remote attackers to download… | Patch early | 5.0 medium | 6.3% | 2009-01-12 |
| CVE-2009-0645 EXP | Directory traversal vulnerability in index.php in Jaws 0.8.8 allows remote authenticated users to read arbitrary files via a .. (dot dot) in the (1) l… | Patch early | 6.5 medium | 6.3% | 2009-02-18 |
| CVE-2009-0858 EXP | The response_addname function in response.c in Daniel J. Bernstein djbdns 1.05 and earlier does not constrain offsets in the required manner, which al… | Patch early | 5.8 medium | 6.3% | 2009-03-09 |
| CVE-2005-3550 EXP | Directory traversal vulnerability in admin.php in toendaCMS before 0.6.2 allows remote attackers to access arbitrary files via a .. (dot dot) in the i… | Patch early | 5.0 medium | 6.3% | 2005-11-16 |
| CVE-2006-0125 EXP | Unspecified vulnerability in appserv/main.php in AppServ 2.4.5 allows remote attackers to include arbitrary files via the appserv_root parameter. NOT… | Patch early | 5.0 medium | 6.3% | 2006-01-09 |
| CVE-2008-3150 EXP | Directory traversal vulnerability in index.php in Neutrino Atomic Edition 0.8.4 allows remote attackers to read and modify files, as demonstrated by m… | Patch early | 10.0 high | 6.3% | 2008-07-11 |
| CVE-2008-6537 EXP | LightNEasy/lightneasy.php in LightNEasy No database version 1.2 allows remote attackers to obtain the hash of the administrator password via the setup… | Patch early | 5.0 medium | 6.3% | 2009-03-30 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt