CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
405,135 CVEs
1,739 on KEV
17,301 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-13
25,091 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2008-0952 EXP | The AppendStringToFile function in the HPISDataManagerLib.Datamgr ActiveX control in HPISDataManager.dll in HP Instant Support before 1.0.0.24 allows… | Patch early | 9.3 high | 5.5% | 2008-06-04 |
| CVE-2005-3135 EXP | Buffer overflow in Virtools Web Player 3.0.0.100 and earlier allows remote attackers to execute arbitrary code via a long filename. | Patch early | 7.5 high | 5.5% | 2005-10-04 |
| CVE-2006-5301 EXP | PHP remote file inclusion vulnerability in includes/antispam.php in the SpamBlockerMODv 1.0.2 and earlier module for phpBB allows remote attackers to… | Patch early | 6.8 medium | 5.5% | 2006-10-17 |
| CVE-2007-1263 EXP | GnuPG 1.4.6 and earlier and GPGME before 1.1.4, when run from the command line, does not visually distinguish signed and unsigned portions of OpenPGP… | Patch early | 5.0 medium | 5.5% | 2007-03-06 |
| CVE-2011-4814 EXP | Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr 3.1.0 RC and probably earlier allow remote attackers to inject arbitrary web script or… | Patch early | 4.3 medium | 5.5% | 2011-12-14 |
| CVE-2003-0274 EXP | Buffer overflow in catmail for ListProc 8.2.09 and earlier allows remote attackers to execute arbitrary code via a long ULISTPROC_UMASK value. | Patch early | 10.0 high | 5.5% | 2003-05-27 |
| CVE-2002-0770 EXP | Quake 2 (Q2) server 3.20 and 3.21 allows remote attackers to obtain sensitive server cvar variables, obtain directory listings, and execute Q2 server… | Patch early | 5.0 medium | 5.5% | 2002-08-12 |
| CVE-2007-5821 EXP | Multiple directory traversal vulnerabilities in DM Guestbook 0.4.1 and earlier allow remote attackers to include and execute arbitrary local files via… | Patch early | 6.8 medium | 5.5% | 2007-11-05 |
| CVE-2023-30198 EXP | Prestashop winbizpayment <= 1.0.2 is vulnerable to Incorrect Access Control via modules/winbizpayment/downloads/download.php. | Patch early | 7.5 high | 5.5% | 2023-06-12 |
| CVE-2004-1728 EXP | Buffer overflow in British National Corpus SARA (sarad) allows remote attackers to execute arbitrary code by calling the client with a long string. | Patch early | 7.5 high | 5.5% | 2004-08-20 |
| CVE-1999-0441 EXP | Remote attackers can perform a denial of service in WinGate machines using a buffer overflow in the Winsock Redirector Service. | Patch early | 5.0 medium | 5.5% | 1999-02-22 |
| CVE-1999-1113 EXP | Buffer overflow in Eudora Internet Mail Server (EIMS) 2.01 and earlier on MacOS systems allows remote attackers to cause a denial of service via a lon… | Patch early | 5.0 medium | 5.5% | 1998-04-14 |
| CVE-2008-7162 EXP | Buffer overflow in Hero Super Player 3000 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long… | Patch early | 9.3 high | 5.5% | 2009-09-04 |
| CVE-2008-4932 EXP | webmail/modules/filesystem/edit.php in U-Mail Webmail server 4.91 allows remote attackers to overwrite arbitrary files via an absolute pathname in the… | Patch early | 9.0 high | 5.5% | 2008-11-05 |
| CVE-2020-5191 EXP | PHPGurukul Hospital Management System in PHP v4.0 suffers from multiple Persistent XSS vulnerabilities. | Patch early | 6.1 medium | 5.5% | 2020-01-06 |
| CVE-2012-5991 EXP | screens/base/web_auth_custom.html on Cisco Wireless LAN Controller (WLC) devices with software 7.2.110.0 allows remote authenticated users to cause a… | Patch early | 6.3 medium | 5.5% | 2012-12-19 |
| CVE-2010-3007 EXP | Unspecified vulnerability in HP Data Protector Express, and Data Protector Express Single Server Edition (SSE), 3.x before build 56936 and 4.x before… | Patch early | 7.2 high | 5.5% | 2010-09-09 |
| CVE-2011-4614 EXP | PHP remote file inclusion vulnerability in Classes/Controller/AbstractController.php in the workspaces system extension in TYPO3 4.5.x before 4.5.9, 4… | Patch early | 6.8 medium | 5.5% | 2012-02-18 |
| CVE-2002-1428 EXP | index.php in dotProject 0.2.1.5 allows remote attackers to bypass authentication via a cookie or URL with the user_cookie parameter set to 1. | Patch early | 10.0 high | 5.5% | 2003-04-11 |
| CVE-2017-11663 EXP | The _WM_SetupMidiEvent function in internal_midi.c:2315 in WildMIDI 0.4.2 can cause a denial of service (invalid memory read and application crash) vi… | Patch early | 6.5 medium | 5.5% | 2017-08-17 |
| CVE-2017-15950 EXP | Flexense SyncBreeze Enterprise version 10.1.16 is vulnerable to a buffer overflow that can be exploited for arbitrary code execution. The flaw is trig… | Patch early | 7.8 high | 5.5% | 2017-10-31 |
| CVE-2020-16171 EXP | An issue was discovered in Acronis Cyber Backup before 12.5 Build 16342. Some API endpoints on port 9877 under /api/ams/ accept an additional custom S… | Patch early | 6.5 medium | 5.5% | 2020-09-21 |
| CVE-2015-2841 EXP | Citrix NetScaler AppFirewall, as used in NetScaler 10.5, allows remote attackers to bypass intended firewall restrictions via a crafted Content-Type h… | Patch early | 5.0 medium | 5.5% | 2015-04-03 |
| CVE-2010-4401 EXP | languages.inc.php in DynPG CMS 4.2.0 allows remote attackers to obtain sensitive information via a direct request, which reveals the installation path… | Patch early | 5.0 medium | 5.5% | 2010-12-06 |
| CVE-2017-14083 EXP | A vulnerability in Trend Micro OfficeScan 11.0 and XG allows remote unauthenticated users who can access the system to download the OfficeScan encrypt… | Patch early | 7.5 high | 5.5% | 2017-10-06 |
| CVE-2021-24299 EXP | The ReDi Restaurant Reservation WordPress plugin before 21.0426 provides the functionality to let users make restaurant reservations. These reservatio… | Patch early | 6.1 medium | 5.5% | 2021-05-17 |
| CVE-2007-0955 EXP | The NTLM_UnPack_Type3 function in MENTLM.dll in MailEnable Professional 2.35 and earlier allows remote attackers to cause a denial of service (applica… | Patch early | 7.8 high | 5.5% | 2007-02-15 |
| CVE-2008-5756 EXP | Buffer overflow in BreakPoint Software Hex Workshop 5.1.4 allows user-assisted attackers to cause a denial of service and possibly execute arbitrary c… | Patch early | 9.3 high | 5.5% | 2008-12-30 |
| CVE-2018-10757 EXP | CSP MySQL User Manager 2.3.1 allows SQL injection, and resultant Authentication Bypass, via a crafted username during a login attempt. | Patch early | 9.8 critical | 5.5% | 2018-05-05 |
| CVE-2005-4195 EXP | Multiple SQL injection vulnerabilities in Scout Portal Toolkit (SPT) 1.3.1 and earlier allow remote attackers to execute arbitrary SQL commands via (1… | Patch early | 7.5 high | 5.5% | 2005-12-13 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt