CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
404,492 CVEs
1,739 on KEV
17,299 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-12
25,091 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2018-19550 EXP | Interspire Email Marketer through 6.1.6 allows arbitrary file upload via a surveys_submit.php "create survey and submit survey" operation, which can c… | Patch early | 8.8 high | 6% | 2018-11-26 |
| CVE-2007-6542 EXP | PHP remote file inclusion vulnerability in admin/frontpage_right.php in Arcadem LE 2.04 and earlier allows remote attackers to execute arbitrary PHP c… | Patch early | 7.5 high | 6% | 2007-12-27 |
| CVE-2023-2779 EXP | The Social Share, Social Login and Social Comments WordPress plugin before 7.13.52 does not sanitise and escape a parameter before outputting it back… | Patch early | 6.1 medium | 6% | 2023-06-19 |
| CVE-2005-2543 EXP | Directory traversal vulnerability in wce.download.php in Comdev eCommerce 3.0 allows remote attackers to download arbitrary files via a .. (dot dot) i… | Patch early | 5.0 medium | 6% | 2005-08-10 |
| CVE-2007-4962 EXP | Directory traversal vulnerability in WinImage 8.10 and earlier allows user-assisted remote attackers to create or overwrite arbitrary files via a .. (… | Patch early | 9.3 high | 6% | 2007-09-18 |
| CVE-2020-16602 EXP | Razer Chroma SDK Rest Server through 3.12.17 allows remote attackers to execute arbitrary programs because there is a race condition in which a file c… | Patch early | 8.1 high | 6% | 2020-09-02 |
| CVE-2007-5583 EXP | Cisco IP Phone 7940 with firmware P0S3-08-7-00 allows remote attackers to cause a denial of service ("486 Busy" responses or device reboot) via a sequ… | Patch early | 7.8 high | 6% | 2007-12-18 |
| CVE-2003-0317 EXP | iisPROTECT 2.1 and 2.2 allows remote attackers to bypass authentication via an HTTP request containing URL-encoded characters. | Patch early | 7.5 high | 6% | 2003-12-31 |
| CVE-2017-3631 EXP | Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Kernel). The supported version that is affected is 11. Easi… | Patch early | 5.3 medium | 6% | 2017-06-22 |
| CVE-2013-4980 EXP | Buffer overflow in the RTSP Packet Handler in AVTECH AVN801 DVR with firmware 1017-1003-1009-1003 and earlier, and possibly other devices, allows remo… | Patch early | 9.0 high | 6% | 2014-03-03 |
| CVE-2013-4981 EXP | Buffer overflow in cgi-bin/user/Config.cgi in AVTECH AVN801 DVR with firmware 1017-1003-1009-1003 and earlier, and possibly other devices, allows remo… | Patch early | 9.0 high | 6% | 2014-03-03 |
| CVE-2010-4371 EXP | Buffer overflow in the in_mod plugin in Winamp before 5.6 allows remote attackers to have an unspecified impact via vectors related to the comment box… | Patch early | 9.3 high | 6% | 2010-12-02 |
| CVE-2018-7705 EXP | Directory traversal vulnerability in SecurEnvoy SecurMail before 9.2.501 allows remote authenticated users to read e-mail messages to arbitrary recipi… | Patch early | 8.1 high | 6% | 2018-03-15 |
| CVE-2007-3233 EXP | The TEC-IT TBarCode OCX ActiveX control (TBarCode7.ocx) 7.0.2.3524 allows remote attackers to overwrite arbitrary files via the SaveImage method. | Patch early | 5.0 medium | 6% | 2007-06-15 |
| CVE-1999-1553 EXP | Buffer overflow in XCmail 0.99.6 with autoquote enabled allows remote attackers to execute arbitrary commands via a long subject line. | Patch early | 10.0 high | 6% | 1999-05-01 |
| CVE-2000-0493 EXP | Buffer overflow in Simple Network Time Sync (SMTS) daemon allows remote attackers to cause a denial of service and possibly execute arbitrary commands… | Patch early | 10.0 high | 6% | 2000-06-01 |
| CVE-2006-3533 EXP | Multiple cross-site scripting (XSS) vulnerabilities in Pivot 1.30 RC2 and earlier, when register_globals is enabled, allow remote attackers to inject… | Patch early | 5.8 medium | 6% | 2006-07-12 |
| CVE-2011-5105 EXP | Multiple cross-site scripting (XSS) vulnerabilities in EmployeeSearch.cc in ZOHO ManageEngine ADSelfService Plus 4.5 Build 4521 allow remote attackers… | Patch early | 4.3 medium | 6% | 2012-08-23 |
| CVE-2000-1026 EXP | Multiple buffer overflows in LBNL tcpdump allow remote attackers to execute arbitrary commands. | Patch early | 10.0 high | 6% | 2000-12-11 |
| CVE-2012-2602 EXP | Multiple cross-site request forgery (CSRF) vulnerabilities in SolarWinds Orion Network Performance Monitor (NPM) before 10.3.1 allow remote attackers… | Patch early | 6.8 medium | 6% | 2012-08-12 |
| CVE-2006-5310 EXP | PHP remote file inclusion vulnerability in common/visiteurs/include/menus.inc.php in J-Pierre DEZELUS Les Visiteurs 2.0.1, as used in phpMyConferences… | Patch early | 6.8 medium | 6% | 2006-10-17 |
| CVE-2009-0855 EXP | Cross-site scripting (XSS) vulnerability in the administrative console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.23 on z/OS allows re… | Patch early | 4.3 medium | 6% | 2009-03-09 |
| CVE-2009-3664 EXP | Multiple directory traversal vulnerabilities in index.php in Nullam Blog 0.1.2 allow remote attackers to include or execute arbitrary files via a .. (… | Patch early | 7.5 high | 6% | 2009-10-11 |
| CVE-2021-44653 EXP | Online Magazine Management System 1.0 contains a SQL injection authentication bypass vulnerability. The Admin panel authentication can be bypassed due… | Patch early | 9.8 critical | 6% | 2021-12-15 |
| CVE-2021-44655 EXP | Online Pre-owned/Used Car Showroom Management System 1.0 contains a SQL injection authentication bypass vulnerability. Admin panel authentication can… | Patch early | 9.8 critical | 6% | 2021-12-15 |
| CVE-2006-6453 EXP | PHP remote file inclusion vulnerability in JOWAMP_ShowPage.php in J-OWAMP Web Interface 2.1 allows remote authenticated users to execute arbitrary PHP… | Patch early | 6.5 medium | 6% | 2006-12-10 |
| CVE-2014-3849 EXP | The iMember360 plugin 3.8.012 through 3.9.001 for WordPress does not properly restrict access, which allows remote attackers to delete arbitrary users… | Patch early | 4.3 medium | 6% | 2014-05-23 |
| CVE-2007-3365 EXP | MyServer 0.8.9 and earlier does not properly handle uppercase characters in filename extensions, which allows remote attackers to obtain sensitive inf… | Patch early | 7.5 high | 6% | 2007-06-22 |
| CVE-1999-0264 EXP | htmlscript CGI program allows remote read access to files. | Patch early | 5.0 medium | 6% | 1998-01-27 |
| CVE-2017-6074 EXP | The dccp_rcv_state_process function in net/dccp/input.c in the Linux kernel through 4.9.11 mishandles DCCP_PKT_REQUEST packet data structures in the L… | Patch early | 7.8 high | 6% | 2017-02-18 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt