CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
405,125 CVEs
1,739 on KEV
17,301 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-13
25,091 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2005-2420 EXP | flsearch.pl in FtpLocate 2.02 allows remote attackers to execute arbitrary commands via shell metacharacters in an HTTP GET request. | Patch early | 10.0 high | 5.6% | 2005-08-03 |
| CVE-2016-6186 EXP | Cross-site scripting (XSS) vulnerability in the dismissChangeRelatedObjectPopup function in contrib/admin/static/admin/js/admin/RelatedObjectLookups.j… | Patch early | 6.1 medium | 5.6% | 2016-08-05 |
| CVE-2005-3955 EXP | Multiple cross-site scripting (XSS) vulnerabilities in MagpieRSS 7.1, as used in (a) blogBuddiesv 0.3, (b) Jaws 0.6.2, and possibly other products, al… | Patch early | 4.3 medium | 5.6% | 2005-12-01 |
| CVE-2008-3207 EXP | PHP remote file inclusion vulnerability in cms/modules/form.lib.php in Pragyan CMS 2.6.2, when register_globals is enabled, allows remote attackers to… | Patch early | 9.3 high | 5.6% | 2008-07-18 |
| CVE-2009-4761 EXP | Stack-based buffer overflow in Mini-stream RM Downloader allows remote attackers to execute arbitrary code via a long string in a .smi file. | Patch early | 9.3 high | 5.6% | 2010-03-29 |
| CVE-2010-2348 EXP | Stack-based buffer overflow in Batch Audio Converter Lite Edition 1.0.0.0 and earlier allows remote attackers to execute arbitrary code via a long lin… | Patch early | 9.3 high | 5.6% | 2010-06-21 |
| CVE-2007-1037 EXP | Stack-based buffer overflow in News File Grabber 4.1.0.1 and earlier allows remote attackers to execute arbitrary code via a .nzb file with a long sub… | Patch early | 9.3 high | 5.6% | 2007-02-21 |
| CVE-2010-5096 EXP | Multiple SQL injection vulnerabilities in MyBB (aka MyBulletinBoard) before 1.6.1 allow remote attackers to execute arbitrary SQL commands via the key… | Patch early | 7.5 high | 5.6% | 2012-08-13 |
| CVE-2011-3483 EXP | Wireshark 1.6.x before 1.6.2 allows remote attackers to cause a denial of service (application crash) via a malformed capture file that leads to an in… | Patch early | 4.3 medium | 5.6% | 2011-09-20 |
| CVE-1999-0360 EXP | MS Site Server 2.0 with IIS 4 can allow users to upload content, including ASP, to the target web site, thus allowing them to execute commands remotel… | Patch early | 7.2 high | 5.6% | 1999-01-30 |
| CVE-2000-0971 EXP | Avirt Mail 4.0 and 4.2 allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a long "RCPT TO" or "MAIL FROM… | Patch early | 10.0 high | 5.6% | 2000-12-19 |
| CVE-2015-2679 EXP | Multiple SQL injection vulnerabilities in MetalGenix GeniXCMS before 0.0.2 allow remote attackers to execute arbitrary SQL commands via the (1) page p… | Patch early | 7.5 high | 5.6% | 2015-03-23 |
| CVE-2007-4850 EXP | curl/interface.c in the cURL library (aka libcurl) in PHP 5.2.4 and 5.2.5 allows context-dependent attackers to bypass safe_mode and open_basedir rest… | Patch early | 5.0 medium | 5.6% | 2008-01-25 |
| CVE-2001-0471 EXP | SSH daemon version 1 (aka SSHD-1 or SSH-1) 1.2.30 and earlier does not log repeated login attempts, which could allow remote attackers to compromise a… | Patch early | 7.5 high | 5.6% | 2001-06-27 |
| CVE-2006-5045 EXP | Unspecified vulnerability in PollXT component (com_pollxt) 1.22.07 and earlier for Joomla! has unspecified impact and attack vectors, probably related… | Patch early | 6.8 medium | 5.6% | 2006-09-27 |
| CVE-2014-6235 EXP | Unspecified vulnerability in the ke DomPDF extension before 0.0.5 for TYPO3 allows remote attackers to execute arbitrary code via unknown vectors. | Patch early | 7.5 high | 5.6% | 2014-09-11 |
| CVE-2008-5839 EXP | Buffer overflow in Foxmail 6.5 allows remote attackers to execute arbitrary code via a long mailto URI in the HREF attribute of an A element. | Patch early | 9.3 high | 5.6% | 2009-01-05 |
| CVE-2008-3300 EXP | AlphAdmin CMS 1.0.5/03 allows remote attackers to bypass authentication and gain administrative access by setting the aa_login cookie value to 1. NOT… | Patch early | 7.5 high | 5.6% | 2008-07-25 |
| CVE-2008-1410 EXP | Directory traversal vulnerability in the PXE Server (pxesrv.exe) in Acronis Snap Deploy 2.0.0.1076 and earlier allows remote attackers to read arbitra… | Patch early | 4.3 medium | 5.6% | 2008-03-20 |
| CVE-2003-1165 EXP | Buffer overflow in BRS WebWeaver 1.06 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via… | Patch early | 5.0 medium | 5.6% | 2003-12-31 |
| CVE-2005-1086 EXP | Buffer overflow in the cmdIS.DLL plugin for AN HTTPD Server 1.42n allows remote attackers to execute arbitrary code via an HTTP request with a long Us… | Patch early | 6.4 medium | 5.6% | 2005-05-02 |
| CVE-2005-1162 EXP | Multiple cross-site scripting (XSS) vulnerabilities in OneWorldStore allow remote attackers to inject arbitrary web script or HTML via the (1) sEmail… | Patch early | 5.8 medium | 5.6% | 2005-05-02 |
| CVE-2009-1312 EXP | Mozilla Firefox before 3.0.9 and SeaMonkey 1.1.17 do not block javascript: URIs in Refresh headers in HTTP responses, which allows remote attackers to… | Patch early | 4.3 medium | 5.6% | 2009-04-22 |
| CVE-2017-11319 EXP | Perspective ICM Investigation & Case 5.1.1.16 allows remote authenticated users to modify access level permissions and consequently gain privileges by… | Patch early | 8.8 high | 5.6% | 2017-12-11 |
| CVE-2009-2379 EXP | Directory traversal vulnerability in public/index.php in BIGACE Web CMS 2.6 allows remote attackers to include and execute arbitrary local files via a… | Patch early | 6.8 medium | 5.6% | 2009-07-08 |
| CVE-2000-0670 EXP | The cvsweb CGI script in CVSWeb 1.80 allows remote attackers with write access to a CVS repository to execute arbitrary commands via shell metacharact… | Patch early | 7.2 high | 5.6% | 2000-07-12 |
| CVE-2010-4399 EXP | Directory traversal vulnerability in languages.inc.php in DynPG CMS 4.1.1 and 4.2.0, when magic_quotes_gpc is disabled, allows remote attackers to rea… | Patch early | 4.3 medium | 5.6% | 2010-12-06 |
| CVE-2019-7400 EXP | Rukovoditel before 2.4.1 allows XSS. | Patch early | 6.1 medium | 5.6% | 2019-02-05 |
| CVE-2017-16543 EXP | Zoho ManageEngine Applications Manager 13 before build 13500 allows SQL injection via GraphicalView.do, as demonstrated by a crafted viewProps yCanvas… | Patch early | 9.8 critical | 5.6% | 2017-11-05 |
| CVE-2020-15716 EXP | RosarioSIS 6.7.2 is vulnerable to XSS, caused by improper validation of user-supplied input by the Preferences.php script. A remote attacker could exp… | Patch early | 6.1 medium | 5.6% | 2020-07-15 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt