CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
404,473 CVEs
1,739 on KEV
17,299 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-12
25,091 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2011-0405 EXP | Directory traversal vulnerability in module.php in PhpGedView 4.2.3 and possibly other versions, when magic_quotes_gpc is disabled, allows remote atta… | Patch early | 6.8 medium | 6.1% | 2011-01-11 |
| CVE-2009-3188 EXP | PHP remote file inclusion vulnerability in save.php in phpSANE 0.5.0 allows remote attackers to execute arbitrary PHP code via a URL in the file_save… | Patch early | 7.5 high | 6.1% | 2009-09-15 |
| CVE-2004-1564 EXP | CRLF injection vulnerability in subscribe_thread.php in w-Agora 4.1.6a allows remote attackers to perform HTTP Response Splitting attacks to modify ex… | Patch early | 5.0 medium | 6.1% | 2004-12-31 |
| CVE-2023-26918 EXP | Diasoft File Replication Pro 7.5.0 allows attackers to escalate privileges by replacing a legitimate file with a Trojan horse that will be executed as… | Patch early | 9.8 critical | 6.1% | 2023-04-14 |
| CVE-2010-4613 EXP | Multiple directory traversal vulnerabilities in Hycus CMS 1.0.3 allow remote attackers to include and execute arbitrary local files via a .. (dot dot)… | Patch early | 7.5 high | 6.1% | 2010-12-29 |
| CVE-2000-0992 EXP | Directory traversal vulnerability in scp in sshd 1.2.xx allows a remote malicious scp server to overwrite arbitrary files via a .. (dot dot) attack. | Patch early | 5.0 medium | 6.1% | 2000-12-19 |
| CVE-2000-0056 EXP | IMail IMONITOR status.cgi CGI script allows remote attackers to cause a denial of service with many calls to status.cgi. | Patch early | 5.0 medium | 6% | 2000-01-05 |
| CVE-2004-1101 EXP | mailpost.exe in MailPost 5.1.1sv, and possibly earlier versions, allows remote attackers to cause a denial of service (server crash), leak sensitive p… | Patch early | 5.8 medium | 6% | 2005-01-10 |
| CVE-2014-2579 EXP | Multiple cross-site request forgery (CSRF) vulnerabilities in XCloner Standalone 3.5 and earlier allow remote attackers to hijack the authentication o… | Patch early | 7.6 high | 6% | 2014-04-25 |
| CVE-2017-2514 EXP | An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. Safari before 10.1.1 is affected. The issue involves the "WebKit" co… | Patch early | 8.8 high | 6% | 2017-05-22 |
| CVE-2014-8606 EXP | Directory traversal vulnerability in the XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! allows remote administrators to read arbitrary files… | Patch early | 4.0 medium | 6% | 2015-06-10 |
| CVE-2009-3810 EXP | Heap-based buffer overflow in Acoustica MP3 Audio Mixer 2.471 allows remote attackers to cause a denial of service (crash) or execute arbitrary code v… | Patch early | 9.3 high | 6% | 2009-10-27 |
| CVE-2007-6317 EXP | Multiple directory traversal vulnerabilities in BarracudaDrive Web Server before 3.8 allow (1) remote attackers to read arbitrary files via certain ..… | Patch early | 5.5 medium | 6% | 2007-12-12 |
| CVE-2022-35513 EXP | The Blink1Control2 application <= 2.2.7 uses weak password encryption and an insecure method of storage. | Patch early | 7.5 high | 6% | 2022-09-07 |
| CVE-1999-0268 EXP | MetaInfo MetaWeb web server allows users to upload, execute, and read scripts. | Patch early | 10.0 high | 6% | 1999-01-01 |
| CVE-2002-2416 EXP | Directory traversal vulnerability in Zeroo web server 1.5 allows remote attackers to read arbitrary files via a .. (dot dot) in a URL GET request. | Patch early | 5.0 medium | 6% | 2002-12-31 |
| CVE-2021-28379 EXP | web/upload/UploadHandler.php in Vesta Control Panel (aka VestaCP) through 0.9.8-27 and myVesta through 0.9.8-26-39 allows uploads from a different ori… | Patch early | 8.8 high | 6% | 2021-03-15 |
| CVE-2015-3632 EXP | Foxit Reader, Enterprise Reader, and PhantomPDF before 7.1.5 allow remote attackers to cause a denial of service (memory corruption and crash) via a c… | Patch early | 4.3 medium | 6% | 2015-05-01 |
| CVE-2015-7570 EXP | Multiple server-side request forgery (SSRF) vulnerabilities in Yeager CMS 1.2.1 allow remote attackers to trigger outbound requests and enumerate open… | Patch early | 7.2 high | 6% | 2017-04-24 |
| CVE-2008-3209 EXP | Heap-based buffer overflow in the OpenGifFile function in BiGif.dll in Black Ice Document Imaging SDK 10.95 allows remote attackers to execute arbitra… | Patch early | 9.3 high | 6% | 2008-07-18 |
| CVE-2008-4548 EXP | Stack-based buffer overflow in the PTZCamPanelCtrl ActiveX control (CamPanel.dll) in RTS Sentry 2.1.0.2 allows remote attackers to execute arbitrary c… | Patch early | 9.3 high | 6% | 2008-10-14 |
| CVE-2017-17874 EXP | Vanguard Marketplace Digital Products PHP 1.4 allows arbitrary file upload via an "Add a new product" or "Add a product preview" action, which can mak… | Patch early | 8.8 high | 6% | 2017-12-27 |
| CVE-2006-2225 EXP | Buffer overflow in XM Easy Personal FTP Server 4.3 and earlier allows remote attackers to execute arbitrary code, probably via a USER command with a l… | Patch early | 7.5 high | 6% | 2006-05-05 |
| CVE-2006-2408 EXP | Multiple buffer overflows in Raydium before SVN revision 310 allow remote attackers to execute arbitrary code via a large packet when logged via (1) t… | Patch early | 7.5 high | 6% | 2006-05-16 |
| CVE-2001-0173 EXP | Buffer overflow in qDecoder library 5.08 and earlier, as used in CrazyWWWBoard, CrazySearch, and other CGI programs, allows remote attackers to execut… | Patch early | 10.0 high | 6% | 2001-05-03 |
| CVE-2011-5006 EXP | Stack-based buffer overflow in QQPlayer 3.2.845 allows remote attackers to execute arbitrary code via a crafted PnSize value in a MOV file. | Patch early | 9.3 high | 6% | 2011-12-25 |
| CVE-2015-7707 EXP | Ignite Realtime Openfire 3.10.2 allows remote authenticated users to gain administrator access via the isadmin parameter to user-edit-form.jsp. | Patch early | 6.5 medium | 6% | 2015-10-05 |
| CVE-2019-12538 EXP | An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SiteLookup.do search field. | Patch early | 6.1 medium | 6% | 2019-06-05 |
| CVE-2019-12541 EXP | An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SolutionSearch.do searchText parameter. | Patch early | 6.1 medium | 6% | 2019-06-05 |
| CVE-2019-12542 EXP | An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SearchN.do userConfigID parameter. | Patch early | 6.1 medium | 6% | 2019-06-05 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt