CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
404,509 CVEs
1,739 on KEV
17,299 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-12
25,091 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2013-0663 EXP | Cross-site request forgery (CSRF) vulnerability on the Schneider Electric Quantum 140NOE77111, 140NOE77101, and 140NWM10000; M340 BMXNOC0401, BMXNOE01… | Patch early | 6.8 medium | 6% | 2013-04-04 |
| CVE-2002-0898 EXP | Opera 6.0.1 and 6.0.2 allows a remote web site to upload arbitrary files from the client system, without prompting the client, via an input type=file… | Patch early | 5.0 medium | 6% | 2002-10-04 |
| CVE-2004-0639 EXP | Multiple cross-site scripting (XSS) vulnerabilities in Squirrelmail 1.2.10 and earlier allow remote attackers to inject arbitrary HTML or script via (… | Patch early | 6.8 medium | 6% | 2004-08-06 |
| CVE-2015-0107 EXP | IBM Tivoli IT Asset Management for IT, Tivoli Service Request Manager, and Change and Configuration Management Database 7.1 through 7.1.1.8 and 7.2 an… | Patch early | 6.5 medium | 6% | 2017-04-24 |
| CVE-2023-3843 EXP | A vulnerability was found in mooSocial mooDating 1.2. It has been classified as problematic. Affected is an unknown function of the file /matchmakings… | Patch early | 3.5 low | 6% | 2023-07-23 |
| CVE-2023-3844 EXP | A vulnerability was found in mooSocial mooDating 1.2. It has been declared as problematic. Affected by this vulnerability is an unknown functionality… | Patch early | 3.5 low | 6% | 2023-07-23 |
| CVE-2023-3845 EXP | A vulnerability was found in mooSocial mooDating 1.2. It has been rated as problematic. Affected by this issue is some unknown functionality of the fi… | Patch early | 3.5 low | 6% | 2023-07-23 |
| CVE-2023-3846 EXP | A vulnerability classified as problematic has been found in mooSocial mooDating 1.2. This affects an unknown part of the file /pages of the component… | Patch early | 3.5 low | 6% | 2023-07-23 |
| CVE-2023-3847 EXP | A vulnerability classified as problematic was found in mooSocial mooDating 1.2. This vulnerability affects unknown code of the file /users of the comp… | Patch early | 3.5 low | 6% | 2023-07-23 |
| CVE-2023-3848 EXP | A vulnerability, which was classified as problematic, has been found in mooSocial mooDating 1.2. This issue affects some unknown processing of the fil… | Patch early | 3.5 low | 6% | 2023-07-23 |
| CVE-2023-3849 EXP | A vulnerability, which was classified as problematic, was found in mooSocial mooDating 1.2. Affected is an unknown function of the file /find-a-match… | Patch early | 3.5 low | 6% | 2023-07-23 |
| CVE-2007-2272 EXP | PHP remote file inclusion vulnerability in docs/front-end-demo/cart2.php in Advanced Webhost Billing System (AWBS) 2.4.0 allows remote attackers to ex… | Patch early | 7.5 high | 6% | 2007-04-25 |
| CVE-2001-1080 EXP | diagrpt in AIX 4.3.x and 5.1 uses the DIAGDATADIR environment variable to find and execute certain programs, which allows local users to gain privileg… | Patch early | 10.0 high | 6% | 2001-06-19 |
| CVE-2017-7183 EXP | The TFTP server in ExtraPuTTY 0.30 and earlier allows remote attackers to cause a denial of service (crash) via a large (1) read or (2) write TFTP pro… | Patch early | 7.5 high | 5.9% | 2017-03-27 |
| CVE-2018-16606 EXP | In ProConf before 6.1, an Insecure Direct Object Reference (IDOR) allows any author to view and grab all submitted papers (Title and Abstract) and the… | Patch early | 6.5 medium | 5.9% | 2018-09-06 |
| CVE-2009-1058 EXP | Stack-based buffer overflow in ZipGenius might allow remote attackers to execute arbitrary code via a crafted .zip file that triggers an SEH overwrite… | Patch early | 10.0 high | 5.9% | 2009-03-24 |
| CVE-2007-2169 EXP | Static code injection vulnerability in add.php in Mozzers SubSystem 1.0 allows remote attackers to inject PHP code into subs.php via the (1) Sub-name… | Patch early | 7.5 high | 5.9% | 2007-04-22 |
| CVE-2008-6519 EXP | Format string vulnerability in Xitami Web Server 2.2a through 2.5c2, and possibly other versions, allows remote attackers to cause a denial of service… | Patch early | 10.0 high | 5.9% | 2009-03-25 |
| CVE-2009-2396 EXP | PHP remote file inclusion vulnerability in template/album.php in DM Albums 1.9.2, as used standalone or as a WordPress plugin, allows remote attackers… | Patch early | 9.3 high | 5.9% | 2009-07-09 |
| CVE-2017-14939 EXP | decode_line_info in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, mishandles a length calcul… | Patch early | 5.5 medium | 5.9% | 2017-09-30 |
| CVE-2008-6745 EXP | index.php in BlogPHP 2.0 allows remote attackers to gain administrator privileges via a crafted email parameter in a register2 action. | Patch early | 7.5 high | 5.9% | 2009-04-23 |
| CVE-2008-4583 EXP | Insecure method vulnerability in the Chilkat FTP 2.0 ActiveX component (ChilkatCert.dll) allows remote attackers to overwrite arbitrary files via a fu… | Patch early | 7.5 high | 5.9% | 2008-10-15 |
| CVE-1999-1015 EXP | Buffer overflow in Apple AppleShare Mail Server 5.0.3 on MacOS 8.1 and earlier allows a remote attacker to cause a denial of service (crash) via a lon… | Patch early | 5.0 medium | 5.9% | 1998-04-08 |
| CVE-2009-1370 EXP | Stack-based buffer overflow in ape_plugin.plg in Xilisoft Video Converter 3.1.53.0704n and 5.1.23.0402 allows remote attackers to cause a denial of se… | Patch early | 9.3 high | 5.9% | 2009-04-22 |
| CVE-2019-7441 EXP | cgi-bin/webscr?cmd=_cart in the WooCommerce PayPal Checkout Payment Gateway plugin 1.6.8 for WordPress allows Parameter Tampering in an amount paramet… | Patch early | 6.5 medium | 5.9% | 2019-03-21 |
| CVE-2008-5991 EXP | Directory traversal vulnerability in docs.php in MailWatch for MailScanner 1.0.4 and earlier allows remote attackers to include and execute arbitrary… | Patch early | 7.5 high | 5.9% | 2009-01-28 |
| CVE-2006-7141 EXP | Absolute path traversal vulnerability in Oracle Database Server, when utl_file_dir is set to a wildcard value or "CREATE ANY DIRECTORY to PUBLIC" priv… | Patch early | 6.0 medium | 5.9% | 2007-03-07 |
| CVE-2009-2653 EXP | The NtUserConsoleControl function in win32k.sys in Microsoft Windows XP SP2 and SP3, and Server 2003 before SP1, allows local administrators to bypass… | Patch early | 4.6 medium | 5.9% | 2009-08-03 |
| CVE-2006-2119 EXP | PHP remote file inclusion vulnerability in event/index.php in Artmedic Event allows remote attackers to execute arbitrary code via a URL in the page p… | Patch early | 5.0 medium | 5.9% | 2006-05-01 |
| CVE-2013-2817 EXP | An ActiveX control in IcoLaunch.dll in Mitsubishi Electric Automation MC-WorX Suite 8.02 allows user-assisted remote attackers to execute arbitrary pr… | Patch early | 9.3 high | 5.9% | 2014-02-24 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt