CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
404,621 CVEs
1,739 on KEV
17,299 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-12
25,091 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2017-5607 EXP | Splunk Enterprise 5.0.x before 5.0.18, 6.0.x before 6.0.14, 6.1.x before 6.1.13, 6.2.x before 6.2.13.1, 6.3.x before 6.3.10, 6.4.x before 6.4.6, and 6… | Patch early | 3.5 low | 5.9% | 2017-04-10 |
| CVE-2007-1398 EXP | The frag3 preprocessor in Snort 2.6.1.1, 2.6.1.2, and 2.7.0 beta, when configured for inline use on Linux without the ip_conntrack module loaded, allo… | Patch early | 7.1 high | 5.9% | 2007-03-10 |
| CVE-2011-1956 EXP | The bytes_repr_len function in Wireshark 1.4.5 uses an incorrect pointer argument, which allows remote attackers to cause a denial of service (NULL po… | Patch early | 4.3 medium | 5.9% | 2011-06-06 |
| CVE-2007-1690 EXP | Multiple stack-based buffer overflows in Second Sight Software ActiveGS ActiveX control (ActiveGS.ocx) allow remote attackers to execute arbitrary cod… | Patch early | 6.8 medium | 5.9% | 2007-04-19 |
| CVE-2007-1691 EXP | Stack-based buffer overflow in Second Sight Software ActiveMod ActiveX control (ActiveMod.ocx) allows remote attackers to execute arbitrary code via u… | Patch early | 6.8 medium | 5.9% | 2007-04-19 |
| CVE-2009-1329 EXP | Stack-based buffer overflow in Mini-stream Shadow Stream Recorder 3.0.1.7 allows remote attackers to execute arbitrary code via a long URI in a playli… | Patch early | 9.3 high | 5.8% | 2009-04-17 |
| CVE-2009-1815 EXP | Stack-based buffer overflow in Sonic Spot Audioactive Player 1.93b allows remote attackers to execute arbitrary code via a long string in a playlist f… | Patch early | 9.3 high | 5.8% | 2009-05-29 |
| CVE-2008-7216 EXP | Peter's Math Anti-Spam Spinoff plugin for WordPress generates audio CAPTCHA clips by concatenating static audio files without any additional distortio… | Patch early | 4.3 medium | 5.8% | 2009-09-11 |
| CVE-2012-5470 EXP | libpng_plugin in VideoLAN VLC media player 2.0.3 allows remote attackers to cause a denial of service (application crash) via a crafted PNG file. | Patch early | 4.3 medium | 5.8% | 2012-10-26 |
| CVE-2006-1584 EXP | Unspecified vulnerability in index.php in Warcraft III Replay Parser for PHP 1.8c allows remote attackers to inject arbitrary web script or HTML via t… | Patch early | 6.4 medium | 5.8% | 2006-04-02 |
| CVE-2010-2146 EXP | PHP remote file inclusion vulnerability in banned.php in Visitor Logger allows remote attackers to execute arbitrary PHP code via a URL in the VL_incl… | Patch early | 7.5 high | 5.8% | 2010-06-03 |
| CVE-1999-0455 EXP | The Expression Evaluator sample application in ColdFusion allows remote attackers to read or delete files on the server via exprcalc.cfm, which does n… | Patch early | 7.5 high | 5.8% | 1999-12-25 |
| CVE-2007-3071 EXP | Buffer overflow in the GetWebStoreURL function in a certain ActiveX control in eSellerateControl365.dll 3.6.5.0 in eSellerate SDK allows user-assisted… | Patch early | 9.3 high | 5.8% | 2007-06-06 |
| CVE-2011-4334 EXP | edit.php in LabWiki 1.1 and earlier does not properly verify uploaded user files, which allows remote authenticated users to upload arbitrary PHP file… | Patch early | 8.8 high | 5.8% | 2017-10-23 |
| CVE-1999-0215 EXP | Routed allows attackers to append data to files. | Patch early | 6.4 medium | 5.8% | 1998-10-26 |
| CVE-2022-2070 EXP | In Grandstream GSD3710 in its 1.0.11.13 version, it's possible to overflow the stack since it doesn't check the param length before using the sscanf i… | Patch early | 9.8 critical | 5.8% | 2022-09-23 |
| CVE-2019-17525 EXP | The login page on D-Link DIR-615 T1 20.10 devices allows remote attackers to bypass the CAPTCHA protection mechanism and conduct brute-force attacks. | Patch early | 8.8 high | 5.8% | 2020-04-21 |
| CVE-2014-3439 EXP | ConsoleServlet in Symantec Endpoint Protection Manager (SEPM) 12.1 before RU5 allows remote attackers to write to arbitrary files via unspecified vect… | Patch early | 6.1 medium | 5.8% | 2014-11-07 |
| CVE-2005-3189 EXP | Directory traversal vulnerability in Qualcomm WorldMail IMAP Server allows remote attackers to read arbitrary email messages via ".." sequences in the… | Patch early | 5.0 medium | 5.8% | 2005-11-18 |
| CVE-2015-3898 EXP | Multiple open redirect vulnerabilities in Bonita BPM Portal before 6.5.3 allow remote attackers to redirect users to arbitrary web sites and conduct p… | Patch early | 6.1 medium | 5.8% | 2018-02-28 |
| CVE-2006-4781 EXP | Heap-based buffer overflow in FutureSoft TFTP Server Multithreaded (MT) 1.1 allows remote attackers to cause a denial of service (crash) or possibly e… | Patch early | 7.5 high | 5.8% | 2006-09-14 |
| CVE-2003-1521 EXP | Sun Java Plug-In 1.4 through 1.4.2_02 allows remote attackers to repeatedly access the floppy drive via the createXmlDocument method in the org.apache… | Patch early | 6.4 medium | 5.8% | 2003-12-31 |
| CVE-2000-0054 EXP | search.cgi in the SolutionScripts Home Free package allows remote attackers to view directories via a .. (dot dot) attack. | Patch early | 5.0 medium | 5.8% | 1999-01-03 |
| CVE-2002-0874 EXP | Vulnerability in Interchange 4.8.6, 4.8.3, and other versions, when running in INET mode, allows remote attackers to read arbitrary files. | Patch early | 5.0 medium | 5.8% | 2002-09-05 |
| CVE-2008-0240 EXP | /idm/help/index.jsp in Sun Java System Identity Manager 6.0 SP1 through SP3, 7.0, and 7.1 allows remote attackers to inject frames from arbitrary web… | Patch early | 4.3 medium | 5.8% | 2008-01-11 |
| CVE-2017-6088 EXP | Multiple SQL injection vulnerabilities in EyesOfNetwork (aka EON) 5.0 and earlier allow remote authenticated users to execute arbitrary SQL commands v… | Patch early | 7.2 high | 5.8% | 2017-04-11 |
| CVE-2018-6323 EXP | The elf_object_p function in elfcode.h in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, has an unsigne… | Patch early | 7.8 high | 5.8% | 2018-01-26 |
| CVE-2010-4884 EXP | PHP remote file inclusion vulnerability in guestbook/gbook.php in Gaestebuch 1.2 allows remote attackers to execute arbitrary PHP code via a URL in th… | Patch early | 7.5 high | 5.8% | 2011-10-07 |
| CVE-2005-1105 EXP | Directory traversal vulnerability in the MimeBodyPart.getFileName method in JavaMail 1.3.2 allows remote attackers to write arbitrary files via a .. (… | Patch early | 5.0 medium | 5.8% | 2005-05-02 |
| CVE-2002-1951 EXP | Buffer overflow in GoAhead WebServer 2.1 allows remote attackers to execute arbitrary code via a long HTTP GET request with a large number of subdirec… | Patch early | 7.5 high | 5.8% | 2002-12-31 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt