CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
404,941 CVEs
1,739 on KEV
17,301 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-12
25,091 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-1999-0887 EXP | FTGate web interface server allows remote attackers to read files via a .. (dot dot) attack. | Patch early | 5.0 medium | 5.8% | 1999-11-04 |
| CVE-1999-0927 EXP | NTMail allows remote attackers to read arbitrary files via a .. (dot dot) attack. | Patch early | 5.0 medium | 5.8% | 1999-05-26 |
| CVE-1999-0933 EXP | TeamTrack web server allows remote attackers to read arbitrary files via a .. (dot dot) attack. | Patch early | 5.0 medium | 5.8% | 1999-10-01 |
| CVE-2017-16780 EXP | The installer in MyBB before 1.8.13 allows remote attackers to execute arbitrary code by writing to the configuration file. | Patch early | 9.8 critical | 5.8% | 2017-11-10 |
| CVE-2017-2371 EXP | An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. The issue involves the "WebKit" component, which allows remote attac… | Patch early | 6.5 medium | 5.8% | 2017-02-20 |
| CVE-2006-4198 EXP | PHP remote file inclusion vulnerability in includes/session.php in Wheatblog (wB) 1.1 and earlier, when register_globals is enabled, allows remote att… | Patch early | 5.1 medium | 5.8% | 2006-08-17 |
| CVE-2007-3594 EXP | Multiple cross-site scripting (XSS) vulnerabilities in AdventNet ManageEngine OpManager 6 and 7 allow remote attackers to inject arbitrary web script… | Patch early | 2.6 low | 5.8% | 2007-07-06 |
| CVE-2017-17738 EXP | The BrightSign Digital Signage (4k242) device (Firmware 6.2.63 and below) allows renaming and modifying files via /tools.html. | Patch early | 7.5 high | 5.8% | 2017-12-18 |
| CVE-2019-19740 EXP | Octeth Oempro 4.7 and 4.8 allow SQL injection. The parameter CampaignID in Campaign.Get is vulnerable. | Patch early | 9.8 critical | 5.8% | 2019-12-12 |
| CVE-2004-0527 EXP | KDE Konqueror 2.1.1 and 2.2.2 allows remote attackers to spoof a legitimate URL in the status bar via A HREF tags with modified "alt" values that poin… | Patch early | 5.0 medium | 5.8% | 2004-08-06 |
| CVE-2002-1351 EXP | Buffer overflow in Melange Chat System 1.10 allows remote attackers to cause a denial of service (chat server crash) and possibly execute arbitrary co… | Patch early | 5.0 medium | 5.8% | 2002-12-24 |
| CVE-2007-5487 EXP | Stack-based buffer overflow in COWON America jetAudio Basic 7.0.3 allows user-assisted remote attackers to execute arbitrary code via a long URL in an… | Patch early | 9.3 high | 5.8% | 2007-10-16 |
| CVE-2008-7079 EXP | Buffer overflow in Nero ShowTime 5.0.15.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long… | Patch early | 9.3 high | 5.8% | 2009-08-25 |
| CVE-2009-1040 EXP | Buffer overflow in WinAsm Studio 5.1.5.0 allows user-assisted remote attackers to execute arbitrary code via a crafted project (.wap) file. | Patch early | 9.3 high | 5.8% | 2009-03-20 |
| CVE-2007-2062 EXP | Stack-based buffer overflow in VCDGear 3.55 and 3.56 BETA allows user-assisted remote attackers to execute arbitrary code via a long FILE argument in… | Patch early | 9.3 high | 5.8% | 2007-04-18 |
| CVE-2009-3811 EXP | Stack-based buffer overflow in Music Tag Editor 1.61 build 212 allows remote attackers to execute arbitrary code via an MP3 file with a long ID3 tag.… | Patch early | 9.3 high | 5.8% | 2009-10-27 |
| CVE-2009-4097 EXP | Stack-based buffer overflow in the MplayInputFile function in Serenity Audio Player 3.2.3 and earlier allows remote attackers to execute arbitrary cod… | Patch early | 9.3 high | 5.8% | 2009-11-29 |
| CVE-2009-4863 EXP | Stack-based buffer overflow in UltraPlayer Media Player 2.112 allows remote attackers to execute arbitrary code via a long string in a .usk file. | Patch early | 9.3 high | 5.8% | 2010-05-11 |
| CVE-2010-2311 EXP | Stack-based buffer overflow in Power Tab Editor 1.7 build 80 allows user-assisted remote attackers to execute arbitrary code via a .ptb file with a lo… | Patch early | 9.3 high | 5.8% | 2010-06-16 |
| CVE-2008-1973 EXP | Heap-based buffer overflow in SubEdit Player build 4056 and 4066 allows remote attackers to cause a denial of service (crash) or execute arbitrary cod… | Patch early | 9.3 high | 5.8% | 2008-04-27 |
| CVE-2023-0455 EXP | Unrestricted Upload of File with Dangerous Type in GitHub repository unilogies/bumsys prior to v1.0.3-beta. | Patch early | 8.8 high | 5.7% | 2023-01-26 |
| CVE-2007-4321 EXP | fail2ban 0.8 and earlier does not properly parse sshd log files, which allows remote attackers to add arbitrary hosts to the /etc/hosts.deny file and… | Patch early | 6.8 medium | 5.7% | 2007-08-14 |
| CVE-2002-0637 EXP | InterScan VirusWall 3.52 build 1462 allows remote attackers to bypass virus protection via e-mail messages with headers that violate RFC specification… | Patch early | 7.5 high | 5.7% | 2002-07-11 |
| CVE-2007-0885 EXP | Cross-site scripting (XSS) vulnerability in jira/secure/BrowseProject.jspa in Rainbow with the Zen (Rainbow.Zen) extension allows remote attackers to… | Patch early | 6.8 medium | 5.7% | 2007-02-12 |
| CVE-2004-2277 EXP | Buffer overflow in aGSM Half-Life client allows remote Half-Life servers to cause a denial of service (crash) and possibly execute arbitrary code via… | Patch early | 5.0 medium | 5.7% | 2004-12-31 |
| CVE-2009-1212 EXP | Multiple insecure method vulnerabilities in PRECIS~2.DLL in the PrecisionID Datamatrix ActiveX control (DMATRIXLib.Datamatrix) allow remote attackers… | Patch early | 7.8 high | 5.7% | 2009-04-01 |
| CVE-2012-1025 EXP | Absolute path traversal vulnerability in file in Enigma2 Webinterface 1.6.0 through 1.6.8, 1.6rc3, and 1.7.0 allows remote attackers to read arbitrary… | Patch early | 5.0 medium | 5.7% | 2012-02-08 |
| CVE-2011-0498 EXP | Stack-based buffer overflow in Nokia Multimedia Player 1.00.55.5010, and possibly other versions, allows user-assisted remote attackers to cause a den… | Patch early | 9.3 high | 5.7% | 2011-01-20 |
| CVE-2009-4032 EXP | Multiple cross-site scripting (XSS) vulnerabilities in Cacti 0.8.7e allow remote attackers to inject arbitrary web script or HTML via vectors related… | Patch early | 4.3 medium | 5.7% | 2009-11-29 |
| CVE-2011-3502 EXP | The web server in Cogent DataHub 7.1.1.63 and earlier allows remote attackers to obtain the source code of executable files via a request with a trail… | Patch early | 5.0 medium | 5.7% | 2011-09-16 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt