CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
404,394 CVEs
1,739 on KEV
17,299 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-12
25,091 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2003-1140 EXP | Buffer overflow in Musicqueue 1.2.0 allows local users to execute arbitrary code via a long language variable in the configuration file. | Patch early | 10.0 high | 6.2% | 2003-10-27 |
| CVE-2009-1171 EXP | The TeX filter in Moodle 1.6 before 1.6.9+, 1.7 before 1.7.7+, 1.8 before 1.8.9, and 1.9 before 1.9.5 allows user-assisted attackers to read arbitrary… | Patch early | 4.3 medium | 6.2% | 2009-03-30 |
| CVE-2023-4278 EXP | The MasterStudy LMS WordPress Plugin WordPress plugin before 3.0.18 does not have proper checks in place during registration allowing anyone to regist… | Patch early | 7.5 high | 6.2% | 2023-09-11 |
| CVE-1999-0771 EXP | The web components of Compaq Management Agents and the Compaq Survey Utility allow a remote attacker to read arbitrary files via a .. (dot dot) attack… | Patch early | 5.0 medium | 6.2% | 1999-05-26 |
| CVE-2014-4968 EXP | The WebView class and use of the WebView.addJavascriptInterface method in the Boat Browser application 8.0 and 8.0.1 for Android allow remote attacker… | Patch early | 8.8 high | 6.2% | 2020-02-12 |
| CVE-2023-28288 EXP | Microsoft SharePoint Server Spoofing Vulnerability | Patch early | 8.1 high | 6.2% | 2023-04-11 |
| CVE-2008-0852 EXP | freeSSHd 1.2 and earlier allows remote attackers to cause a denial of service (crash) via a SSH2_MSG_NEWKEYS packet to TCP port 22, which triggers a N… | Patch early | 5.0 medium | 6.2% | 2008-02-21 |
| CVE-2018-0952 EXP | An Elevation of Privilege vulnerability exists when Diagnostics Hub Standard Collector allows file creation in arbitrary locations, aka "Diagnostic Hu… | Patch early | 7.8 high | 6.2% | 2018-08-15 |
| CVE-2008-2398 EXP | Cross-site scripting (XSS) vulnerability in index.php in AppServ Open Project 2.5.10 and earlier allows remote attackers to inject arbitrary web scrip… | Patch early | 4.3 medium | 6.2% | 2008-05-21 |
| CVE-2009-3969 EXP | Stack-based buffer overflow in Faslo Player 7.0 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary… | Patch early | 9.3 high | 6.2% | 2009-11-18 |
| CVE-2012-2593 EXP | Cross-site scripting (XSS) vulnerability in the administrative interface in Atmail Webmail Server 6.4 allows remote attackers to inject arbitrary web… | Patch early | 6.1 medium | 6.2% | 2020-02-06 |
| CVE-2006-6624 EXP | The FTP Server in Sambar Server 6.4 allows remote authenticated users to cause a denial of service (application crash) via a long series of "./" seque… | Patch early | 4.0 medium | 6.2% | 2006-12-18 |
| CVE-1999-0997 EXP | wu-ftp with FTP conversion enabled allows an attacker to execute commands via a malformed file name that is interpreted as an argument to the program… | Patch early | 7.5 high | 6.2% | 1999-12-20 |
| CVE-2003-1313 EXP | Multiple PHP remote file inclusion vulnerabilities in EternalMart Mailing List Manager (EMLM) 1.32 allow remote attackers to execute arbitrary PHP cod… | Patch early | 7.5 high | 6.2% | 2003-12-31 |
| CVE-2007-0504 EXP | Eval injection vulnerability in poll_frame.php in Vote! Pro 4.0, and possibly other scripts, allows remote attackers to execute arbitrary code via the… | Patch early | 10.0 high | 6.2% | 2007-01-26 |
| CVE-1999-0210 EXP | Automount daemon automountd allows local or remote users to gain privileges via shell metacharacters. | Patch early | 10.0 high | 6.2% | 1997-11-26 |
| CVE-2004-0312 EXP | Linksys WAP55AG 1.07 allows remote attackers with access to an SNMP read only community string to gain access to read/write communtiy strings via a qu… | Patch early | 6.4 medium | 6.2% | 2004-11-23 |
| CVE-2007-2568 EXP | Multiple stack-based buffer overflows in VCDGear 3.55 allow user-assisted remote attackers to execute arbitrary code via a long (1) tag or (2) track t… | Patch early | 9.3 high | 6.2% | 2007-05-16 |
| CVE-2012-2315 EXP | admin/Auth in OpenKM 5.1.7 and other versions before 5.1.8-2 does not properly enforce privileges for changing user roles, which allows remote authent… | Patch early | 4.0 medium | 6.2% | 2012-09-09 |
| CVE-2017-7049 EXP | An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. iCloud before 6.2.2 on Windows is… | Patch early | 8.8 high | 6.2% | 2017-07-20 |
| CVE-2007-5642 EXP | Multiple directory traversal vulnerabilities in PHP Project Management 0.8.10 and earlier allow remote attackers to include and execute arbitrary loca… | Patch early | 6.8 medium | 6.2% | 2007-10-23 |
| CVE-2015-2824 EXP | Multiple SQL injection vulnerabilities in the Simple Ads Manager plugin before 2.7.97 for WordPress allow remote attackers to execute arbitrary SQL co… | Patch early | 7.5 high | 6.2% | 2015-04-06 |
| CVE-2007-5837 EXP | GUI.pm in yarssr 0.2.2, when Gnome default URL handling is disabled, allows remote attackers to execute arbitrary commands via shell metacharacters in… | Patch early | 6.8 medium | 6.2% | 2007-11-05 |
| CVE-2009-4051 EXP | Home FTP Server 1.10.1.139 allows remote attackers to cause a denial of service (daemon outage) via multiple invalid SITE INDEX commands. | Patch early | 5.0 medium | 6.2% | 2009-11-23 |
| CVE-2019-10866 EXP | In the Form Maker plugin before 1.13.3 for WordPress, it's possible to achieve SQL injection in the function get_labels_parameters in the file form-ma… | Patch early | 9.8 critical | 6.2% | 2019-05-23 |
| CVE-2009-3838 EXP | Stack-based buffer overflow in Pegasus Mail (PMail) 4.41 and possibly 4.51 allows remote POP3 servers to cause a denial of service (application crash)… | Patch early | 9.3 high | 6.2% | 2009-11-02 |
| CVE-2009-1724 EXP | Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 4.0.2, as used on iPhone OS before 3.1, iPhone OS before 3.1.1 for iPod touc… | Patch early | 4.3 medium | 6.2% | 2009-07-09 |
| CVE-2007-4174 EXP | Tor before 0.1.2.16, when ControlPort is enabled, does not properly restrict commands to localhost port 9051, which allows remote attackers to modify… | Patch early | 5.8 medium | 6.2% | 2007-08-07 |
| CVE-2008-1480 EXP | rpc.metad in Sun Solaris 10 allows remote attackers to cause a denial of service (daemon crash) via a malformed RPC request. | Patch early | 4.3 medium | 6.2% | 2008-03-24 |
| CVE-2001-0421 EXP | FTP server in Solaris 8 and earlier allows local and remote attackers to cause a core dump in the root directory, possibly with world-readable permiss… | Patch early | 6.4 medium | 6.2% | 2001-07-02 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt