CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
404,492 CVEs
1,739 on KEV
17,299 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-12
25,091 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2004-0241 EXP | X-Cart 3.4.3 allows remote attackers to execute arbitrary commands via the perl_binary argument in (1) upgrade.php or (2) general.php. | Patch early | 10.0 high | 6% | 2004-11-23 |
| CVE-2009-1071 EXP | Stack-based buffer overflow in Icarus 2.0 allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via a cra… | Patch early | 9.3 high | 6% | 2009-03-26 |
| CVE-2009-1327 EXP | Stack-based buffer overflow in Mini-stream WM Downloader 3.0.0.9 allows remote attackers to execute arbitrary code via a long URI in a playlist (.m3u)… | Patch early | 9.3 high | 6% | 2009-04-17 |
| CVE-2008-3733 EXP | Stack-based buffer overflow in EO Video (eo-video) 1.36 allows remote attackers to cause a denial of service (application crash) or execute arbitrary… | Patch early | 9.3 high | 6% | 2008-08-20 |
| CVE-2009-4754 EXP | Stack-based buffer overflow in Mercury Audio Player 1.21 allows remote attackers to execute arbitrary code via a long string in a malformed playlist (… | Patch early | 9.3 high | 6% | 2010-03-29 |
| CVE-2007-6649 EXP | PHP remote file inclusion vulnerability in includes/tumbnail.php in MatPo Bilder Galerie 1.1 allows remote attackers to execute arbitrary PHP code via… | Patch early | 7.5 high | 6% | 2008-01-04 |
| CVE-2007-6657 EXP | PHP remote file inclusion vulnerability in source/includes/load_forum.php in Mihalism Multi Forum Host 3.0.x and earlier allows remote attackers to ex… | Patch early | 7.5 high | 6% | 2008-01-04 |
| CVE-2000-1075 EXP | Directory traversal vulnerability in iPlanet Certificate Management System 4.2 and Directory Server 4.12 allows remote attackers to read arbitrary fil… | Patch early | 5.0 medium | 6% | 2000-12-11 |
| CVE-2008-5824 EXP | Heap-based buffer overflow in msadpcm.c in libaudiofile in audiofile 0.2.6 allows context-dependent attackers to cause a denial of service (applicatio… | Patch early | 6.8 medium | 6% | 2009-01-02 |
| CVE-2000-0254 EXP | The dansie shopping cart application cart.pl allows remote attackers to obtain the shopping cart database and configuration information via a URL that… | Patch early | 5.0 medium | 6% | 2000-04-14 |
| CVE-2001-0200 EXP | HSWeb 2.0 HTTP server allows remote attackers to obtain the physical path of the server via a request to the /cgi/ directory, which will list the path… | Patch early | 5.0 medium | 6% | 2001-05-03 |
| CVE-2001-0788 EXP | Internet Software Solutions Air Messenger LAN Server (AMLServer) 3.4.2 allows remote attackers to obtain an absolute path for the server directory by… | Patch early | 5.0 medium | 6% | 2001-10-18 |
| CVE-2007-4508 EXP | Stack-based buffer overflow in Rebellion Asura engine, as used for the server in Rogue Trooper 1.0 and earlier and Prism 1.1.1.0 and earlier, allows r… | Patch early | 6.8 medium | 6% | 2007-08-23 |
| CVE-2010-4777 EXP | The Perl_reg_numbered_buff_fetch function in Perl 5.10.0, 5.12.0, 5.14.0, and other versions, when running with debugging enabled, allows context-depe… | Patch early | 4.3 medium | 6% | 2014-02-10 |
| CVE-2018-19371 EXP | The SaveUserSettings service in Content Manager in SDL Web 8.5.0 has an XXE Vulnerability that allows reading sensitive files from the system. | Patch early | 6.5 medium | 6% | 2019-01-02 |
| CVE-2004-0345 EXP | Buffer overflow in Red Faction client 1.20 and earlier allows remote servers to execute arbitrary code via a long server name. | Patch early | 10.0 high | 6% | 2004-11-23 |
| CVE-2005-4600 EXP | Directory traversal vulnerability in tiny_mce_gzip.php in TinyMCE Compressor PHP before 1.06 allows remote attackers to read or include arbitrary file… | Patch early | 6.4 medium | 6% | 2005-12-31 |
| CVE-2017-16716 EXP | A SQL Injection issue was discovered in WebAccess versions prior to 8.3. WebAccess does not properly sanitize its inputs for SQL commands. | Patch early | 9.8 critical | 6% | 2018-01-05 |
| CVE-2006-0806 EXP | Multiple cross-site scripting (XSS) vulnerabilities in ADOdb 4.71, as used in multiple packages such as phpESP, allow remote attackers to inject arbit… | Patch early | 4.3 medium | 6% | 2006-02-21 |
| CVE-2012-2270 EXP | Open redirect vulnerability in index.php (aka the Login Page) in ownCloud before 3.0.3 allows remote attackers to redirect users to arbitrary web site… | Patch early | 5.8 medium | 6% | 2012-04-20 |
| CVE-2008-7209 EXP | Unrestricted file upload vulnerability in the add2 action in a_upload.php in OneCMS 2.4, and possibly earlier, allows remote attackers to execute arbi… | Patch early | 7.5 high | 6% | 2009-09-11 |
| CVE-2010-2332 EXP | Impact Financials, Inc. Impact PDF Reader 2.0, 1.2, and other versions for iPhone and iPod touch allows remote attackers to cause a denial of service… | Patch early | 5.0 medium | 6% | 2010-06-18 |
| CVE-2007-2667 EXP | Buffer overflow in the DB Software Laboratory VImpX ActiveX control in VImpX.ocx 4.7.3 allows remote attackers to execute arbitrary code via a long Lo… | Patch early | 9.3 high | 6% | 2007-05-14 |
| CVE-2008-2283 EXP | IDAutomation allows remote attackers to overwrite arbitrary files via the argument to the (1) SaveBarCode and (2) SaveEnhWMF methods in (a) the IDAuto… | Patch early | 9.3 high | 6% | 2008-05-18 |
| CVE-2016-4312 EXP | XML external entity (XXE) vulnerability in the XACML flow feature in WSO2 Identity Server 5.1.0 before WSO2-CARBON-PATCH-4.4.0-0231 allows remote auth… | Patch early | 7.5 high | 6% | 2017-02-17 |
| CVE-2011-4431 EXP | Directory traversal vulnerability in main.php in Merethis Centreon before 2.3.2 allows remote authenticated users to execute arbitrary commands via a… | Patch early | 6.5 medium | 6% | 2011-11-10 |
| CVE-2002-0747 EXP | Buffer overflow in lsmcode in AIX 4.3.3. | Patch early | 10.0 high | 6% | 2002-08-12 |
| CVE-2001-0283 EXP | Directory traversal vulnerability in SunFTP build 9 allows remote attackers to read arbitrary files via .. (dot dot) characters in various commands, i… | Patch early | 6.4 medium | 6% | 2001-05-03 |
| CVE-2009-1668 EXP | TYPSoft FTP Server 1.11 allows remote attackers to cause a denial of service (CPU consumption) by sending an ABOR (abort) command without an active fi… | Patch early | 4.0 medium | 6% | 2009-05-18 |
| CVE-2018-5708 EXP | An issue was discovered on D-Link DIR-601 B1 2.02NA devices. Being on the same local network as, but being unauthenticated to, the administrator's pan… | Patch early | 8.0 high | 6% | 2018-03-30 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt