CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
404,569 CVEs
1,739 on KEV
17,299 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-12
25,091 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2008-3024 EXP | Stack-based buffer overflow in phgrafx in QNX Momentics (aka RTOS) 6.3.2 and earlier allows local users to gain privileges via a long .pal filename in… | Patch early | 9.3 high | 5.9% | 2008-07-07 |
| CVE-2003-0647 EXP | Buffer overflow in the HTTP server for Cisco IOS 12.2 and earlier allows remote attackers to execute arbitrary code via an extremely long (2GB) HTTP G… | Patch early | 7.5 high | 5.9% | 2003-08-27 |
| CVE-2009-2333 EXP | Multiple directory traversal vulnerabilities in CMS Chainuk 1.2 and earlier allow remote attackers to include and execute arbitrary local files via a… | Patch early | 7.5 high | 5.9% | 2009-07-05 |
| CVE-2009-3053 EXP | Directory traversal vulnerability in the Agora (com_agora) component 3.0.0b for Joomla! allows remote attackers to include and execute arbitrary local… | Patch early | 6.8 medium | 5.9% | 2009-09-03 |
| CVE-2007-1582 EXP | The resource system in PHP 4.0.0 through 4.4.6 and 5.0.0 through 5.2.1 allows context-dependent attackers to execute arbitrary code by interrupting ce… | Patch early | 6.8 medium | 5.9% | 2007-03-21 |
| CVE-2007-6704 EXP | Multiple cross-site scripting (XSS) vulnerabilities in F5 FirePass 4100 SSL VPN 5.4.1 through 5.5.2 and 6.0 through 6.0.1, when pre-logon sequences ar… | Patch early | 2.6 low | 5.9% | 2008-03-05 |
| CVE-2014-8386 EXP | Multiple stack-based buffer overflows in Advantech AdamView 4.3 and earlier allow remote attackers to execute arbitrary code via a crafted (1) display… | Patch early | 7.5 high | 5.9% | 2015-01-20 |
| CVE-2019-12189 EXP | An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SearchN.do search field. | Patch early | 6.1 medium | 5.9% | 2019-05-21 |
| CVE-2000-0039 EXP | AltaVista search engine allows remote attackers to read files above the document root via a .. (dot dot) in the query.cgi CGI program. | Patch early | 5.0 medium | 5.9% | 1999-12-29 |
| CVE-2000-0174 EXP | StarOffice StarScheduler web server allows remote attackers to read arbitrary files via a .. (dot dot) attack. | Patch early | 5.0 medium | 5.9% | 2000-03-09 |
| CVE-2000-0192 EXP | The default installation of Caldera OpenLinux 2.3 includes the CGI program rpm_query, which allows remote attackers to determine what packages are ins… | Patch early | 5.0 medium | 5.9% | 2000-03-05 |
| CVE-2000-0236 EXP | Netscape Enterprise Server with Directory Indexing enabled allows remote attackers to list server directories via web publishing tags such as ?wp-ver-… | Patch early | 5.0 medium | 5.9% | 2000-03-17 |
| CVE-2000-0430 EXP | Cart32 allows remote attackers to access sensitive debugging information by appending /expdate to the URL request. | Patch early | 5.0 medium | 5.9% | 2000-05-03 |
| CVE-2022-31062 EXP | ### Impact A plugin public script can be used to read content of system files. ### Patches Upgrade to version 1.0.2. ### Workarounds `b/deploy/index.p… | Patch early | 5.3 medium | 5.9% | 2022-06-20 |
| CVE-2008-5765 EXP | WorkSimple 1.2.1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the datab… | Patch early | 5.0 medium | 5.9% | 2008-12-30 |
| CVE-2008-6872 EXP | ASPThai.NET ASPThai Forums 8.5 stores sensitive information under the web root with insufficient access control, which allows remote attackers to down… | Patch early | 5.0 medium | 5.9% | 2009-07-23 |
| CVE-2023-23161 EXP | A reflected cross-site scripting (XSS) vulnerability in Art Gallery Management System Project v1.0 allows attackers to execute arbitrary web scripts o… | Patch early | 6.1 medium | 5.9% | 2023-02-10 |
| CVE-2008-5862 EXP | Directory traversal vulnerability in webcamXP 5.3.2.375 and 5.3.2.410 build 2132 allows remote attackers to read arbitrary files via a ..%2F (encoded… | Patch early | 5.0 medium | 5.9% | 2009-01-06 |
| CVE-2006-1779 EXP | Cross-site scripting (XSS) vulnerability in login.php in Jeremy Ashcraft Simplog 0.9.2 and earlier allows remote attackers to inject arbitrary web scr… | Patch early | 6.8 medium | 5.9% | 2006-04-13 |
| CVE-2017-2521 EXP | An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. Safari before 10.1.1 is affected. tvOS before 10.2.1 is affected. wa… | Patch early | 8.8 high | 5.9% | 2017-05-22 |
| CVE-2009-3709 EXP | Stack-based buffer overflow in the Meta Content Optimizer in Konae Technologies Alleycode HTML Editor 2.21 allows user-assisted remote attackers to ex… | Patch early | 9.3 high | 5.9% | 2009-10-16 |
| CVE-2020-15363 EXP | The Nexos theme through 1.7 for WordPress allows side-map/?search_order= SQL Injection. | Patch early | 9.8 critical | 5.9% | 2020-06-28 |
| CVE-2006-3773 EXP | PHP remote file inclusion vulnerability in smf.php in the SMF-Forum 1.3.1.3 Bridge Component (com_smf) For Joomla! and Mambo 4.5.3+ allows remote atta… | Patch early | 6.8 medium | 5.9% | 2006-07-24 |
| CVE-2008-6770 EXP | YourPlace 1.0.2 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to a datab… | Patch early | 5.0 medium | 5.9% | 2009-04-29 |
| CVE-2008-6771 EXP | YourPlace 1.0.2 and earlier allows remote attackers to obtain sensitive system information via a direct request via a direct request to user/uploads/p… | Patch early | 5.0 medium | 5.9% | 2009-04-29 |
| CVE-2009-3646 EXP | InterVations NaviCOPA Web Server 3.01 allows remote attackers to obtain the source code for a web page via an HTTP request with the addition of ::$DAT… | Patch early | 5.0 medium | 5.9% | 2009-10-09 |
| CVE-2000-0384 EXP | NetStructure 7110 and 7180 have undocumented accounts (servnow, root, and wizard) whose passwords are easily guessable from the NetStructure's MAC add… | Patch early | 10.0 high | 5.9% | 2000-05-08 |
| CVE-2018-15917 EXP | Persistent cross-site scripting (XSS) issues in Jorani 0.6.5 allow remote attackers to inject arbitrary web script or HTML via the language parameter… | Patch early | 5.4 medium | 5.9% | 2018-09-05 |
| CVE-2002-1530 EXP | The administrative web interface (STEMWADM) for SurfControl SuperScout Email Filter allows users to obtain usernames and plaintext passwords via a req… | Patch early | 5.0 medium | 5.9% | 2003-03-31 |
| CVE-2000-0300 EXP | The default encryption method of PcAnywhere 9.x uses weak encryption, which allows remote attackers to sniff and decrypt PcAnywhere or NT domain accou… | Patch early | 10.0 high | 5.9% | 2000-04-06 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt