CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
404,449 CVEs
1,739 on KEV
17,299 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-12
25,091 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2017-9259 EXP | The TDStretch::acceptNewOverlapLength function in source/SoundTouch/TDStretch.cpp in SoundTouch 1.9.2 allows remote attackers to cause a denial of ser… | Patch early | 5.5 medium | 6.1% | 2017-07-27 |
| CVE-2003-1397 EXP | The PluginContext object of Opera 6.05 and 7.0 allows remote attackers to cause a denial of service (crash) via an HTTP request containing a long stri… | Patch early | 4.3 medium | 6.1% | 2003-12-31 |
| CVE-2018-7466 EXP | install/installNewDB.php in TestLink through 1.9.16 allows remote attackers to conduct injection attacks by leveraging control over DB LOGIN NAMES dat… | Patch early | 7.5 high | 6.1% | 2018-02-25 |
| CVE-2007-1331 EXP | Multiple cross-site scripting (XSS) vulnerabilities in TKS Banking Solutions ePortfolio 1.0 Java allow remote attackers to inject arbitrary web script… | Patch early | 4.3 medium | 6.1% | 2007-03-07 |
| CVE-2007-3167 EXP | Stack-based buffer overflow in the Vivotek Motion Jpeg ActiveX control (aka MjpegControl) in MjpegDecoder.dll 2.0.0.13 allows remote attackers to exec… | Patch early | 7.6 high | 6.1% | 2007-06-11 |
| CVE-2007-2761 EXP | Stack-based buffer overflow in MagicISO 5.4 build 239 and earlier allows remote attackers to execute arbitrary code via a long filename in a .cue file… | Patch early | 7.5 high | 6.1% | 2007-05-18 |
| CVE-2008-6143 EXP | OwenPoll 1.0 allows remote attackers to bypass authentication and obtain administrative access via a modified account name in the username cookie. | Patch early | 7.5 high | 6.1% | 2009-02-16 |
| CVE-2009-3306 EXP | PHP remote file inclusion vulnerability in include/header.php in ClearSite 4.50 allows remote attackers to execute arbitrary PHP code via a URL in the… | Patch early | 7.5 high | 6.1% | 2009-09-23 |
| CVE-2023-0527 EXP | A vulnerability was found in PHPGurukul Online Security Guards Hiring System 1.0 and classified as problematic. Affected by this issue is some unknown… | Patch early | 3.5 low | 6.1% | 2023-01-27 |
| CVE-1999-0238 EXP | php.cgi allows attackers to read any file on the system. | Patch early | 10.0 high | 6.1% | 1997-08-01 |
| CVE-2005-3133 EXP | Multiple directory traversal vulnerabilities in MERAK Mail Server 8.2.4r with Icewarp Web Mail 5.5.1, and possibly earlier versions, allows remote att… | Patch early | 5.0 medium | 6.1% | 2005-10-04 |
| CVE-2009-1610 EXP | admin/changepassword.php in Job Script Job Board Software 2.0 allows remote attackers to change the administrator password and gain administrator priv… | Patch early | 7.5 high | 6.1% | 2009-05-11 |
| CVE-2006-3277 EXP | The SMTP service of MailEnable Standard 1.92 and earlier, Professional 2.0 and earlier, and Enterprise 2.0 and earlier before the MESMTPC hotfix, allo… | Patch early | 5.0 medium | 6.1% | 2006-06-28 |
| CVE-2009-0457 EXP | Multiple directory traversal vulnerabilities in AJA Portal 1.2 allow remote attackers to include and execute arbitrary local files via directory trave… | Patch early | 7.5 high | 6.1% | 2009-02-10 |
| CVE-2002-0855 EXP | Cross-site scripting vulnerability in Mailman before 2.0.12 allows remote attackers to execute script as other users via a subscriber's list subscript… | Patch early | 7.5 high | 6.1% | 2002-09-05 |
| CVE-2000-1046 EXP | Multiple buffer overflows in the ESMTP service of Lotus Domino 5.0.2c and earlier allow remote attackers to cause a denial of service and possibly exe… | Patch early | 10.0 high | 6.1% | 2000-12-11 |
| CVE-2007-1882 EXP | qcbin/servlet/tdservlet/TDAPI_GeneralWebTreatment in HP Mercury Quality Center 9.0 build 9.1.0.4352 allows remote authenticated users to execute arbit… | Patch early | 6.5 medium | 6.1% | 2007-04-06 |
| CVE-2005-2540 EXP | CRLF injection vulnerability in FlatNuke 2.5.5 and possibly earlier versions allows remote attackers to execute arbitrary PHP commands via an ASCII ch… | Patch early | 5.0 medium | 6.1% | 2005-08-10 |
| CVE-2009-2363 EXP | Stack-based buffer overflow in KUDRSOFT AudioPLUS 2.00.215 allows remote attackers to execute arbitrary code via a .pls playlist file with a playlist… | Patch early | 9.3 high | 6.1% | 2009-07-08 |
| CVE-2009-1652 EXP | admin/adminaddeditdetails.php in Business Community Script does not properly restrict access, which allows remote attackers to gain privileges and add… | Patch early | 7.5 high | 6.1% | 2009-05-16 |
| CVE-2006-7068 EXP | PHP remote file inclusion vulnerability in CliServ Web Community 0.65 and earlier allows remote attackers to execute arbitrary PHP code via a URL in t… | Patch early | 7.5 high | 6.1% | 2007-03-02 |
| CVE-2001-0029 EXP | Buffer overflow in oops WWW proxy server 1.4.6 (and possibly other versions) allows remote attackers to execute arbitrary commands via a long host or… | Patch early | 10.0 high | 6.1% | 2001-02-12 |
| CVE-2018-6221 EXP | An unvalidated software update vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow a man-in-the-middle attacker to tamper with an up… | Patch early | 8.1 high | 6.1% | 2018-03-15 |
| CVE-2014-5345 EXP | Cross-site scripting (XSS) vulnerability in upgrade.php in the Disqus Comment System plugin before 2.76 for WordPress allows remote attackers to injec… | Patch early | 4.3 medium | 6.1% | 2014-08-19 |
| CVE-2015-4063 EXP | Cross-site scripting (XSS) vulnerability in includes/nsp_search.php in the NewStatPress plugin before 0.9.9 for WordPress allows remote authenticated… | Patch early | 3.5 low | 6.1% | 2015-05-27 |
| CVE-2005-4550 EXP | The PORTAL schema in Oracle Application Server (OracleAS) Discussion Forum Portlet allows remote attackers to obtain the source code for arbitrary JSP… | Patch early | 5.0 medium | 6.1% | 2005-12-28 |
| CVE-2007-1111 EXP | Multiple cross-site scripting (XSS) vulnerabilities in ActiveCalendar 1.2.0 allow remote attackers to inject arbitrary web script or HTML via the css… | Patch early | 6.8 medium | 6.1% | 2007-02-26 |
| CVE-2008-3304 EXP | BilboBlog 0.2.1 allows remote attackers to obtain sensitive information via (1) an enable_cache=false query string to footer.php or (2) a direct reque… | Patch early | 5.0 medium | 6.1% | 2008-07-25 |
| CVE-2002-2420 EXP | site_searcher.cgi in Super Site Searcher allows remote attackers to execute arbitrary commands via shell metacharacters in the page parameter. | Patch early | 7.5 high | 6.1% | 2002-12-31 |
| CVE-2007-4838 EXP | Multiple buffer overflows in CellFactor Revolution 1.03 and earlier allow remote attackers to execute arbitrary code via a long string in a (1) 0x21,… | Patch early | 7.5 high | 6.1% | 2007-09-12 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt