CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
404,941 CVEs
1,739 on KEV
17,301 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-12
25,091 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2006-2399 EXP | Stack-based buffer overflow in the ServerNetworking::incoming_client_data function in servnet.cpp in Outgun 1.0.3 bot 2 and earlier allows remote atta… | Patch early | 7.5 high | 5.7% | 2006-05-16 |
| CVE-2006-3401 EXP | Stack-based buffer overflow in Quake 3 Engine as used by Quake 3: Arena 1.32b and 1.32c allows remote attackers to cause a denial of service and possi… | Patch early | 7.5 high | 5.7% | 2006-07-06 |
| CVE-2004-0763 EXP | Mozilla Firefox 0.9.1 and 0.9.2 allows remote web sites to spoof certificates of trusted web sites via redirects and Javascript that uses the "onunloa… | Patch early | 5.0 medium | 5.7% | 2004-08-18 |
| CVE-2005-1507 EXP | Buffer overflow in the Tomcat plugin in 4d WebSTAR 5.33 and 5.4 allows remote attackers to cause a denial of service and possibly execute arbitrary co… | Patch early | 5.0 medium | 5.7% | 2005-05-11 |
| CVE-2002-0928 EXP | Buffer overflow in the Pirch 98 IRC client allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long hyperli… | Patch early | 7.5 high | 5.7% | 2002-10-04 |
| CVE-2002-1073 EXP | Buffer overflow in the control service for MERCUR Mailserver 4.2 allows remote attackers to execute arbitrary code via a long password. | Patch early | 7.5 high | 5.7% | 2002-10-04 |
| CVE-2002-1075 EXP | Buffer overflow in Pegasus mail client 4.01 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary co… | Patch early | 7.5 high | 5.7% | 2002-10-04 |
| CVE-2006-0628 EXP | myquiz.pl in Dale Ray MyQuiz 1.01 allows remote attackers to execute arbitrary commands via shell metacharacters in the URL, which are not properly ha… | Patch early | 7.5 high | 5.7% | 2006-02-10 |
| CVE-2025-69985 EXP | FUXA 1.2.8 and prior contains an Authentication Bypass vulnerability leading to Remote Code Execution (RCE). The vulnerability exists in the server/ap… | Patch early | 9.8 critical | 5.7% | 2026-02-24 |
| CVE-2008-0221 EXP | Directory traversal vulnerability in the WebLaunch.WeblaunchCtl.1 (aka CWebLaunchCtl) ActiveX control in weblaunch.ocx 1.0.0.1 in Gateway Weblaunch al… | Patch early | 9.3 high | 5.7% | 2008-01-10 |
| CVE-2012-5340 EXP | SumatraPDF 2.1.1/MuPDF 1.0 allows remote attackers to cause an Integer Overflow in the lex_number() function via a corrupt PDF file. | Patch early | 7.8 high | 5.7% | 2020-01-23 |
| CVE-2005-1403 EXP | Multiple cross-site scripting (XSS) vulnerabilities in JustWilliam's Amazon Webstore 04050100 allow remote attackers to inject arbitrary web script or… | Patch early | 6.8 medium | 5.7% | 2005-05-03 |
| CVE-2012-2627 EXP | d4d/uploader.php in the web console in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.0 allows remote attackers to create or overwrite… | Patch early | 9.4 high | 5.7% | 2012-07-31 |
| CVE-2013-1468 EXP | Cross-site request forgery (CSRF) vulnerability in the LocalFiles Editor plugin in Piwigo before 2.4.7 allows remote attackers to hijack the authentic… | Patch early | 7.6 high | 5.7% | 2013-03-14 |
| CVE-2008-6731 EXP | Unrestricted file upload vulnerability in submitlink.php in FlexPHPLink Pro 0.0.7 allows remote attackers to execute arbitrary PHP code by uploading a… | Patch early | 9.3 high | 5.7% | 2009-04-20 |
| CVE-2008-6959 EXP | Insecure method vulnerability in the Chilkat Socket ActiveX control (ChilkatSocket.ChilkatSocket.1) in ChilkatSocket.dll 2.3.1.1 allows remote attacke… | Patch early | 9.3 high | 5.7% | 2009-08-12 |
| CVE-2022-0448 EXP | The CP Blocks WordPress plugin before 1.0.15 does not sanitise and escape its "License ID" settings, which could allow high privilege users to perform… | Patch early | 4.8 medium | 5.7% | 2022-03-07 |
| CVE-2008-1690 EXP | WebContainer.exe 1.0.0.336 and earlier in SLMail Pro 6.3.1.0 and earlier allows remote attackers to cause a denial of service (memory corruption and d… | Patch early | 10.0 high | 5.7% | 2008-04-07 |
| CVE-2008-6841 EXP | PHP remote file inclusion vulnerability in the Green Mountain Information Technology and Consulting Database Query (com_dbquery) component 1.4.1.1 and… | Patch early | 7.5 high | 5.7% | 2009-07-01 |
| CVE-2005-1013 EXP | The SMTP service in MailEnable Enterprise 1.04 and earlier and Professional 1.54 and earlier allows remote attackers to cause a denial of service (ser… | Patch early | 5.0 medium | 5.7% | 2005-05-02 |
| CVE-2007-0059 EXP | Cross-zone scripting vulnerability in Apple Quicktime 3 to 7.1.3 allows remote user-assisted attackers to execute arbitrary code and list filesystem c… | Patch early | 6.8 medium | 5.7% | 2007-01-05 |
| CVE-2008-4508 EXP | Stack-based buffer overflow in the file parsing function in Tonec Internet Download Manager, possibly 5.14 and earlier, allows remote attackers to cau… | Patch early | 7.8 high | 5.7% | 2008-10-09 |
| CVE-2021-24245 EXP | The Stop Spammers WordPress plugin before 2021.9 did not escape user input when blocking requests (such as matching a spam word), outputting it in an… | Patch early | 6.1 medium | 5.7% | 2021-05-06 |
| CVE-2009-3573 EXP | Multiple insecure method vulnerabilities in the PDIControl.PDI.1 ActiveX control (PDIControl.dll) 2.2.3160.0 in EMC Captiva PixTools Distributed Imagi… | Patch early | 9.3 high | 5.7% | 2009-10-06 |
| CVE-2023-33131 EXP | Microsoft Outlook Remote Code Execution Vulnerability | Patch early | 8.8 high | 5.7% | 2023-06-14 |
| CVE-2008-1702 EXP | Absolute path traversal vulnerability in dload.php in the my_gallery 2.3 plugin for e107 allows remote attackers to obtain sensitive information via a… | Patch early | 4.3 medium | 5.7% | 2008-04-08 |
| CVE-2011-4684 EXP | Opera before 11.60 does not properly handle certificate revocation, which has unspecified impact and remote attack vectors related to "corner cases." | Patch early | 10.0 high | 5.7% | 2011-12-07 |
| CVE-2000-1176 EXP | Directory traversal vulnerability in YaBB search.pl CGI script allows remote attackers to read arbitrary files via a .. (dot dot) attack in the "catse… | Patch early | 7.5 high | 5.7% | 2001-01-09 |
| CVE-2020-12352 EXP | Improper access control in BlueZ may allow an unauthenticated user to potentially enable information disclosure via adjacent access. | Patch early | 6.5 medium | 5.7% | 2020-11-23 |
| CVE-2007-4031 EXP | Directory traversal vulnerability in a certain ActiveX control in Nessus Vulnerability Scanner 3.0.6 allows remote attackers to delete arbitrary files… | Patch early | 7.8 high | 5.7% | 2007-07-27 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt