CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
398,596 CVEs
1,728 on KEV
17,267 EPSS ≥ 10%
25,086 with exploits
synced 2026-09-28
12,661 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2005-4267 EXP | Stack-based buffer overflow in Qualcomm WorldMail 3.0 allows remote attackers to execute arbitrary code via a long IMAP command that ends with a "}" c… | Patch early | 7.5 high | 66.8% | 2005-12-21 |
| CVE-2007-1404 EXP | tftpd.exe in ProSysInfo TFTP Server TFTPDWIN 0.4.2 allows remote attackers to cause a denial of service via a long UDP packet that is not properly han… | Patch early | 7.3 high | 66.7% | 2007-03-10 |
| CVE-2015-2049 EXP | Unrestricted file upload vulnerability in D-Link DCS-931L with firmware 1.04 and earlier allows remote authenticated users to execute arbitrary code b… | Patch early | 9.0 high | 66.7% | 2015-02-23 |
| CVE-2017-7411 EXP | An issue was discovered in Enalean Tuleap 9.6 and prior versions. The vulnerability exists because the User::getRecentElements() method is using the u… | Patch early | 8.8 high | 66.6% | 2017-10-30 |
| CVE-2002-1120 EXP | Buffer overflow in Savant Web Server 3.1 and earlier allows remote attackers to execute arbitrary code via a long HTTP GET request. | Patch early | 7.5 high | 66.6% | 2002-09-24 |
| CVE-2013-3576 EXP | ginkgosnmp.inc in HP System Management Homepage (SMH) allows remote authenticated users to execute arbitrary commands via shell metacharacters in the… | Patch early | 9.0 high | 66.6% | 2013-06-14 |
| CVE-2015-6133 EXP | Microsoft Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 Gold and 1511 mishandle library loading, wh… | Patch early | 7.2 high | 66.6% | 2015-12-09 |
| CVE-2004-0363 EXP | Stack-based buffer overflow in the SymSpamHelper ActiveX component (symspam.dll) in Norton AntiSpam 2004, as used in Norton Internet Security 2004, al… | Patch early | 7.5 high | 66.6% | 2004-04-15 |
| CVE-2009-0183 EXP | Stack-based buffer overflow in Remote Control Server in Free Download Manager (FDM) 2.5 Build 758 and 3.0 Build 844 allows remote attackers to execute… | Patch early | 10.0 high | 66.5% | 2009-02-03 |
| CVE-2008-4844 EXP | Use-after-free vulnerability in the CRecordInstance::TransferToDestination function in mshtml.dll in Microsoft Internet Explorer 5.01, 6, 6 SP1, and 7… | Patch early | 9.3 high | 66.5% | 2008-12-11 |
| CVE-2016-7240 EXP | The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corrup… | Patch early | 7.5 high | 66.5% | 2016-11-10 |
| CVE-2013-4730 EXP | Buffer overflow in PCMan's FTP Server 2.0.7 allows remote attackers to execute arbitrary code via a long string in a USER command. | Patch early | 10.0 high | 66.5% | 2014-05-15 |
| CVE-2012-6096 EXP | Multiple stack-based buffer overflows in the get_history function in history.cgi in Nagios Core before 3.4.4, and Icinga 1.6.x before 1.6.2, 1.7.x bef… | Patch early | 7.5 high | 66.5% | 2013-01-22 |
| CVE-2007-6377 EXP | Stack-based buffer overflow in the PassThru functionality in ext.dll in BadBlue 2.72b and earlier allows remote attackers to execute arbitrary code vi… | Patch early | 7.5 high | 66.4% | 2007-12-15 |
| CVE-2013-2347 EXP | The Backup Client Service (OmniInet.exe) in HP Storage Data Protector 6.2X allows remote attackers to execute arbitrary commands or cause a denial of… | Patch early | 10.0 high | 66.4% | 2014-01-04 |
| CVE-2017-14496 EXP | Integer underflow in the add_pseudoheader function in dnsmasq before 2.78 , when the --add-mac, --add-cpe-id or --add-subnet option is specified, allo… | Patch early | 7.5 high | 66.3% | 2017-10-03 |
| CVE-2018-0933 EXP | ChakraCore and Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the Chakra scriptin… | Patch early | 7.5 high | 66.3% | 2018-03-14 |
| CVE-2018-0980 EXP | A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scri… | Patch early | 7.5 high | 66.3% | 2018-04-12 |
| CVE-2013-3205 EXP | Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craft… | Patch early | 9.3 high | 66.3% | 2013-09-11 |
| CVE-2018-0934 EXP | ChakraCore and Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the Chakra scriptin… | Patch early | 7.5 high | 66.2% | 2018-03-14 |
| CVE-2007-0213 EXP | Microsoft Exchange Server 2000 SP3, 2003 SP1 and SP2, and 2007 does not properly decode certain MIME encoded e-mails, which allows remote attackers to… | Patch early | 10.0 high | 66.2% | 2007-05-08 |
| CVE-2010-1964 EXP | Buffer overflow in ovwebsnmpsrv.exe in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53 allows remote attackers to execute arbitrary code via u… | Patch early | 7.5 high | 66.1% | 2010-06-17 |
| CVE-2005-1272 EXP | Stack-based buffer overflow in the Backup Agent for Microsoft SQL Server in BrightStor ARCserve Backup Agent for SQL Server 11.0 allows remote attacke… | Patch early | 7.5 high | 66.1% | 2005-08-05 |
| CVE-2005-1543 EXP | Multiple stack-based and heap-based buffer overflows in Remote Management authentication (zenrem32.exe) on Novell ZENworks 6.5 Desktop and Server Mana… | Patch early | 7.5 high | 66.1% | 2005-05-25 |
| CVE-2007-3566 EXP | Stack-based buffer overflow in the database service (ibserver.exe) in Borland InterBase 2007 before SP2 allows remote attackers to execute arbitrary c… | Patch early | 7.5 high | 66.1% | 2007-07-26 |
| CVE-2011-3175 EXP | Stack-based buffer overflow in the Preboot Service in Novell ZENworks Configuration Management (ZCM) 11.1 and 11.1a allows remote attackers to execute… | Patch early | 10.0 high | 66.1% | 2012-04-09 |
| CVE-2004-0636 EXP | Buffer overflow in the goaway function in the aim:goaway URI handler for AOL Instant Messenger (AIM) 5.5, including 5.5.3595, allows remote attackers… | Patch early | 10.0 high | 66% | 2004-11-23 |
| CVE-2019-12181 EXP | A privilege escalation vulnerability exists in SolarWinds Serv-U before 15.1.7 for Linux. | Patch early | 8.8 high | 66% | 2019-06-17 |
| CVE-2014-7186 EXP | The redirection implementation in parse.y in GNU Bash through 4.3 bash43-026 allows remote attackers to cause a denial of service (out-of-bounds array… | Patch early | 10.0 high | 66% | 2014-09-28 |
| CVE-2015-5560 EXP | Integer overflow in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR… | Patch early | 10.0 high | 66% | 2015-08-14 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt