CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
404,406 CVEs
1,739 on KEV
17,299 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-12
25,091 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2017-15359 EXP | In the 3CX Phone System 15.5.3554.1, the Management Console typically listens to port 5001 and is prone to a directory traversal attack: "/api/Recordi… | Patch early | 6.5 medium | 6.2% | 2017-10-18 |
| CVE-2004-1301 EXP | Buffer overflow in the book_format_sql function in format.c for xlreader 0.9.0 allows remote attackers to execute arbitrary code via a crafted Excel (… | Patch early | 10.0 high | 6.2% | 2005-01-10 |
| CVE-2006-3491 EXP | Stack-based buffer overflow in Kaillera Server 0.86 and earlier allows remote attackers to execute arbitrary code via a long nickname. | Patch early | 7.5 high | 6.2% | 2006-07-10 |
| CVE-2017-2367 EXP | An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. tvOS before 10.2 is affected. The issu… | Patch early | 6.5 medium | 6.2% | 2017-04-02 |
| CVE-2017-2442 EXP | An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. The issue involves the "WebKit JavaScr… | Patch early | 6.5 medium | 6.2% | 2017-04-02 |
| CVE-2007-2474 EXP | Multiple PHP remote file inclusion vulnerabilities in Turnkey Web Tools SunShop Shopping Cart 4.0 allow remote attackers to execute arbitrary PHP code… | Patch early | 7.5 high | 6.2% | 2007-05-02 |
| CVE-2009-1368 EXP | Directory traversal vulnerability in index.php in moziloCMS 1.11 allows remote attackers to read arbitrary files via a .. (dot dot) in the page parame… | Patch early | 7.5 high | 6.2% | 2009-04-22 |
| CVE-2006-5634 EXP | Multiple PHP remote file inclusion vulnerabilities in phpProfiles 2.1 Beta allow remote attackers to execute arbitrary PHP code via a URL in the (1) r… | Patch early | 6.8 medium | 6.2% | 2006-11-01 |
| CVE-2010-3070 EXP | Cross-site scripting (XSS) vulnerability in NuSOAP 0.9.5, as used in MantisBT and other products, allows remote attackers to inject arbitrary web scri… | Patch early | 4.3 medium | 6.2% | 2010-09-28 |
| CVE-2021-43650 EXP | WebRun 3.6.0.42 is vulnerable to SQL Injection via the P_0 parameter used to set the username during the login process. | Patch early | 9.8 critical | 6.2% | 2022-03-22 |
| CVE-2013-5688 EXP | Multiple directory traversal vulnerabilities in index.php in AjaXplorer 5.0.2 and earlier allow remote authenticated users to read arbitrary files via… | Patch early | 5.5 medium | 6.2% | 2013-11-05 |
| CVE-2019-9834 EXP | The Netdata web application through 1.13.0 allows remote attackers to inject their own malicious HTML code into an imported snapshot, aka HTML Injecti… | Patch early | 6.1 medium | 6.2% | 2019-03-15 |
| CVE-2000-0720 EXP | news.cgi in GWScripts News Publisher does not properly authenticate requests to add an author to the author index, which allows remote attackers to ad… | Patch early | 5.0 medium | 6.2% | 2000-10-20 |
| CVE-1999-0175 EXP | The convert.bas program in the Novell web server allows a remote attackers to read any file on the system that is internally accessible by the web ser… | Patch early | 5.0 medium | 6.2% | 1996-07-01 |
| CVE-2019-12562 EXP | Stored Cross-Site Scripting in DotNetNuke (DNN) Version before 9.4.0 allows remote attackers to store and embed the malicious script into the admin no… | Patch early | 6.1 medium | 6.2% | 2019-09-26 |
| CVE-2019-9816 EXP | A possible vulnerability exists where type confusion can occur when manipulating JavaScript objects in object groups, allowing for the bypassing of se… | Patch early | 5.9 medium | 6.2% | 2019-07-23 |
| CVE-2004-0290 EXP | Buffer overflow in Purge Jihad 2.0.1 and earlier allows remote game servers to execute arbitrary code via an information packet that contains large (1… | Patch early | 10.0 high | 6.1% | 2004-11-23 |
| CVE-2013-4954 EXP | Multiple cross-site scripting (XSS) vulnerabilities in wp-login.php in the Genetech Solutions Pie-Register plugin before 1.31 for WordPress, when "All… | Patch early | 2.6 low | 6.1% | 2013-07-29 |
| CVE-2017-15287 EXP | There is XSS in the BouquetEditor WebPlugin for Dream Multimedia Dreambox devices, as demonstrated by the "Name des Bouquets" field, or the file param… | Patch early | 6.1 medium | 6.1% | 2017-10-12 |
| CVE-2006-4310 EXP | Mozilla Firefox 1.5.0.6 allows remote attackers to cause a denial of service (crash) via a crafted FTP response, when attempting to connect with a use… | Patch early | 4.3 medium | 6.1% | 2006-08-23 |
| CVE-2015-1481 EXP | Ansible Tower (aka Ansible UI) before 2.0.5 allows remote organization administrators to gain privileges by creating a superuser account. | Patch early | 6.5 medium | 6.1% | 2015-02-04 |
| CVE-2005-2367 EXP | Format string vulnerability in the proto_item_set_text function in Ethereal 0.9.4 through 0.10.11, as used in multiple dissectors, allows remote attac… | Patch early | 7.5 high | 6.1% | 2005-08-10 |
| CVE-2007-5812 EXP | Directory traversal vulnerability in modules/Builder/DownloadModule.php in ModuleBuilder 1.0 allows remote attackers to read arbitrary files via a ..… | Patch early | 5.0 medium | 6.1% | 2007-11-05 |
| CVE-2009-2180 EXP | Multiple directory traversal vulnerabilities in upfiles/index.php in Pc4 Uploader 10.0 and earlier allow remote attackers to read arbitrary files via… | Patch early | 5.0 medium | 6.1% | 2009-06-23 |
| CVE-2018-15740 EXP | Zoho ManageEngine ADManager Plus 6.5.7 has XSS on the "Workflow Delegation" "Requester Roles" screen. | Patch early | 6.1 medium | 6.1% | 2018-08-28 |
| CVE-2005-4809 EXP | Mozilla Firefox 1.0.1 and possibly other versions, including Mozilla and Thunderbird, allows remote attackers to spoof the URL in the Status Bar via a… | Patch early | 5.0 medium | 6.1% | 2005-12-31 |
| CVE-2015-1366 EXP | Cross-site scripting (XSS) vulnerability in pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress allows remote attackers to inject… | Patch early | 4.3 medium | 6.1% | 2015-01-27 |
| CVE-2016-3219 EXP | The kernel-mode driver in Microsoft Windows 10 Gold and 1511 allows local users to gain privileges via a crafted application, aka "Win32k Elevation of… | Patch early | 7.8 high | 6.1% | 2016-06-16 |
| CVE-2020-7750 EXP | This affects the package scratch-svg-renderer before 0.2.0-prerelease.20201019174008. The loadString function does not escape SVG properly, which can… | Patch early | 9.6 critical | 6.1% | 2020-10-21 |
| CVE-2007-6614 EXP | PHP remote file inclusion vulnerability in admin/frontpage_right.php in Agares Media phpAutoVideo 2.21 allows remote attackers to execute arbitrary PH… | Patch early | 6.8 medium | 6.1% | 2008-01-03 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt