CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
404,852 CVEs
1,739 on KEV
17,301 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-12
25,091 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2009-3338 EXP | Stack-based buffer overflow in EffectMatrix (E.M.) Magic Morph 1.95b allows remote attackers to execute arbitrary code via a long string in a .mor fil… | Patch early | 9.3 high | 5.8% | 2009-09-24 |
| CVE-2009-3670 EXP | Stack-based buffer overflow in KSP Sound Player 2009 R2 and R2.1 allows remote attackers to execute arbitrary code via a long string in a .m3u playlis… | Patch early | 9.3 high | 5.8% | 2009-10-11 |
| CVE-2009-4964 EXP | Stack-based buffer overflow in KSP 2006 FINAL allows remote attackers to execute arbitrary code via a long string in a .M3U playlist file. | Patch early | 9.3 high | 5.8% | 2010-07-28 |
| CVE-2008-6897 EXP | Multiple buffer overflows in Getleft.exe in Andres Garcia Getleft 1.2 allow remote attackers to cause a denial of service (crash) and possibly execute… | Patch early | 9.3 high | 5.8% | 2009-08-05 |
| CVE-2017-13784 EXP | An issue was discovered in certain Apple products. iOS before 11.1 is affected. Safari before 11.0.1 is affected. iCloud before 7.1 on Windows is affe… | Patch early | 8.8 high | 5.8% | 2017-11-13 |
| CVE-2017-13785 EXP | An issue was discovered in certain Apple products. iOS before 11.1 is affected. Safari before 11.0.1 is affected. iCloud before 7.1 on Windows is affe… | Patch early | 8.8 high | 5.8% | 2017-11-13 |
| CVE-2017-13792 EXP | An issue was discovered in certain Apple products. iOS before 11.1 is affected. Safari before 11.0.1 is affected. iCloud before 7.1 on Windows is affe… | Patch early | 8.8 high | 5.8% | 2017-11-13 |
| CVE-2017-13795 EXP | An issue was discovered in certain Apple products. iOS before 11.1 is affected. Safari before 11.0.1 is affected. iCloud before 7.1 on Windows is affe… | Patch early | 8.8 high | 5.8% | 2017-11-13 |
| CVE-2017-13802 EXP | An issue was discovered in certain Apple products. iOS before 11.1 is affected. Safari before 11.0.1 is affected. iCloud before 7.1 on Windows is affe… | Patch early | 8.8 high | 5.8% | 2017-11-13 |
| CVE-2005-3558 EXP | PHP file inclusion vulnerability in index.php in OSTE 1.0 allows remote attackers to execute arbitrary code via the (1) page and (2) site parameters. | Patch early | 7.5 high | 5.8% | 2005-11-16 |
| CVE-2006-1839 EXP | PHP remote file inclusion vulnerability in language.php in PHP Album 0.3.2.3, when register_globals is enabled, allows remote attackers to execute arb… | Patch early | 7.5 high | 5.8% | 2006-04-19 |
| CVE-2008-6983 EXP | modules/tool/hitcounter.php in devalcms 1.4a allows remote attackers to execute arbitrary PHP code via the HTTP Referer header with a target file spec… | Patch early | 7.5 high | 5.8% | 2009-08-19 |
| CVE-2008-0148 EXP | TUTOS 1.3 does not restrict access to php/admin/cmd.php, which allows remote attackers to execute arbitrary shell commands via the cmd parameter in a… | Patch early | 10.0 high | 5.8% | 2008-01-09 |
| CVE-2007-5309 EXP | PHP remote file inclusion vulnerability in admin.wmtgallery.php in the webmaster-tips.net Flash Image Gallery (com_wmtgallery) 1.0 component for Jooml… | Patch early | 6.8 medium | 5.8% | 2007-10-09 |
| CVE-2007-6057 EXP | PHP remote file inclusion vulnerability in index.php in datecomm Social Networking Script (aka Myspace Clone Script) allows remote attackers to execut… | Patch early | 6.8 medium | 5.8% | 2007-11-20 |
| CVE-2015-2292 EXP | Multiple SQL injection vulnerabilities in admin/class-bulk-editor-list-table.php in the WordPress SEO by Yoast plugin before 1.5.7, 1.6.x before 1.6.4… | Patch early | 6.5 medium | 5.8% | 2015-03-17 |
| CVE-2008-4321 EXP | Buffer overflow in FlashGet (formerly JetCar) FTP 1.9 allows remote FTP servers to execute arbitrary code via a long response to the PWD command. | Patch early | 9.3 high | 5.8% | 2008-09-29 |
| CVE-2014-4311 EXP | Epicor Enterprise 7.4 before FS74SP6_HotfixTL054181 allows attackers to obtain the (1) Database Connection and (2) E-mail Connection passwords by read… | Patch early | 5.0 medium | 5.8% | 2014-11-04 |
| CVE-2008-6982 EXP | Cross-site scripting (XSS) vulnerability in index.php in devalcms 1.4a allows remote attackers to inject arbitrary web script or HTML via the currentp… | Patch early | 4.3 medium | 5.8% | 2009-08-19 |
| CVE-2023-31714 EXP | Chitor-CMS before v1.1.2 was discovered to contain multiple SQL injection vulnerabilities. | Patch early | 9.8 critical | 5.8% | 2023-08-30 |
| CVE-2009-2820 EXP | The web interface in CUPS before 1.4.2, as used on Apple Mac OS X before 10.6.2 and other platforms, does not properly handle (1) HTTP headers and (2)… | Patch early | 4.3 medium | 5.8% | 2009-11-10 |
| CVE-2007-1622 EXP | Cross-site scripting (XSS) vulnerability in wp-admin/vars.php in WordPress before 2.0.10 RC2, and before 2.1.3 RC2 in the 2.1 series, allows remote au… | Patch early | 4.3 medium | 5.8% | 2007-03-23 |
| CVE-2003-1142 EXP | Help in NIPrint LPD-LPR Print Server 4.10 and earlier executes Windows Explorer with SYSTEM privileges, which allows local users to gain privileges. | Patch early | 10.0 high | 5.8% | 2003-11-03 |
| CVE-2017-5496 EXP | Sawmill Enterprise 8.7.9 allows remote attackers to gain login access by leveraging knowledge of a password hash. | Patch early | 9.8 critical | 5.8% | 2017-03-15 |
| CVE-2008-3234 EXP | sshd in OpenSSH 4 on Debian GNU/Linux, and the 20070303 OpenSSH snapshot, allows remote authenticated users to obtain access to arbitrary SELinux role… | Patch early | 6.5 medium | 5.8% | 2008-07-18 |
| CVE-2016-1828 EXP | The kernel in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1 allows attackers to execute arbitrary code in a… | Patch early | 7.8 high | 5.8% | 2016-05-20 |
| CVE-2008-6958 EXP | wap/index.php in Crossday Discuz! Board 6.x and 7.x allows remote authenticated users to execute arbitrary PHP code via the creditsformula parameter. | Patch early | 6.5 medium | 5.8% | 2009-08-12 |
| CVE-2013-7280 EXP | Buffer overflow in HansoTools Hanso Player 2.1.0, 2.5.0, and earlier allows remote attackers to cause a denial of service (crash) via a long string in… | Patch early | 4.3 medium | 5.8% | 2014-01-08 |
| CVE-2004-1745 EXP | Buffer overflow in Painkiller 1.3.1 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a… | Patch early | 5.0 medium | 5.8% | 2004-08-24 |
| CVE-2021-28142 EXP | CITSmart before 9.1.2.28 mishandles the "filtro de autocomplete." | Patch early | 8.8 high | 5.8% | 2021-04-06 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt