CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
405,135 CVEs
1,739 on KEV
17,301 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-13
25,091 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2019-6218 EXP | A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 12.1.3, macOS Mojave 10.14.3, tvOS 12.1.2. A malici… | Patch early | 7.8 high | 5.5% | 2019-03-05 |
| CVE-2013-1942 EXP | Multiple cross-site scripting (XSS) vulnerabilities in actionscript/Jplayer.as in the Flash SWF component (jplayer.swf) in jPlayer before 2.2.20, as u… | Patch early | 4.3 medium | 5.5% | 2013-08-15 |
| CVE-2009-4168 EXP | Cross-site scripting (XSS) vulnerability in Roy Tanck tagcloud.swf, as used in the WP-Cumulus plugin before 1.23 for WordPress and the Joomulus module… | Patch early | 4.3 medium | 5.5% | 2009-12-02 |
| CVE-2016-1848 EXP | QuickTime in Apple OS X before 10.11.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafte… | Patch early | 7.8 high | 5.5% | 2016-05-20 |
| CVE-2000-0152 EXP | Remote attackers can cause a denial of service in Novell BorderManager 3.5 by pressing the enter key in a telnet connection to port 2000. | Patch early | 5.0 medium | 5.5% | 2000-03-30 |
| CVE-2000-1083 EXP | The xp_showcolv function in SQL Server and Microsoft SQL Server Desktop Engine (MSDE) does not properly restrict the length of a buffer before calling… | Patch early | 2.1 low | 5.5% | 2001-01-09 |
| CVE-2005-4270 EXP | Buffer overflow in Watchfire AppScan QA 5.0.609 and 5.0.134 allows remote web servers to execute arbitrary code via an HTTP 401 response with a WWW-Au… | Patch early | 7.5 high | 5.5% | 2005-12-15 |
| CVE-2023-31067 EXP | An issue was discovered in TSplus Remote Access through 16.0.2.14. There are Full Control permissions for Everyone on some directories under %PROGRAMF… | Patch early | 9.8 critical | 5.5% | 2023-09-11 |
| CVE-2017-16542 EXP | Zoho ManageEngine Applications Manager 13 before build 13500 allows Post-authentication SQL injection via the name parameter in a manageApplications.d… | Patch early | 8.8 high | 5.5% | 2017-11-05 |
| CVE-2009-4148 EXP | DAZ Studio 2.3.3.161, 2.3.3.163, and 3.0.1.135 allows remote attackers to execute arbitrary JavaScript code via a (1) .ds, (2) .dsa, (3) .dse, or (4)… | Patch early | 9.3 high | 5.5% | 2009-12-04 |
| CVE-2014-0866 EXP | RICOS in IBM Algo Credit Limits (aka ACLM) 4.5.0 through 4.7.0 before 4.7.0.03 FP5 in IBM Algorithmics sends cleartext credentials over HTTP, which al… | Patch early | 4.3 medium | 5.5% | 2014-07-07 |
| CVE-2014-0869 EXP | The decrypt function in RICOS in IBM Algo Credit Limits (aka ACLM) 4.5.0 through 4.7.0 before 4.7.0.03 FP5 in IBM Algorithmics does not require a key,… | Patch early | 4.3 medium | 5.5% | 2014-07-07 |
| CVE-2002-1773 EXP | Buffer overflow in ICQ 2.6x for MacOS X 10.0 through 10.1.2 allows remote attackers to cause a denial of service and possibly execute arbitrary code v… | Patch early | 7.5 high | 5.5% | 2002-12-31 |
| CVE-2013-3240 EXP | Directory traversal vulnerability in the Export feature in phpMyAdmin 4.x before 4.0.0-rc3 allows remote authenticated users to read arbitrary files o… | Patch early | 6.5 medium | 5.5% | 2013-04-26 |
| CVE-2007-2744 EXP | Stack-based buffer overflow in the PrecisionID Barcode 1.9 ActiveX control in PrecisionID_Barcode.dll allows remote attackers to cause a denial of ser… | Patch early | 7.5 high | 5.5% | 2007-05-17 |
| CVE-2007-2814 EXP | Multiple stack-based buffer overflows in the Pegasus ImagN' ActiveX control (IMW32O40.OCX) 4.00.041 allow remote attackers to execute arbitrary code v… | Patch early | 7.5 high | 5.5% | 2007-05-22 |
| CVE-2008-3158 EXP | Unspecified vulnerability in NWFS.SYS in Novell Client for Windows 4.91 SP4 has unknown impact and attack vectors, possibly related to IOCTL requests… | Patch early | 6.9 medium | 5.5% | 2008-07-11 |
| CVE-2009-0260 EXP | Multiple cross-site scripting (XSS) vulnerabilities in action/AttachFile.py in MoinMoin before 1.8.1 allow remote attackers to inject arbitrary web sc… | Patch early | 4.3 medium | 5.5% | 2009-01-23 |
| CVE-2007-0911 EXP | Off-by-one error in the str_ireplace function in PHP 5.2.1 might allow context-dependent attackers to cause a denial of service (crash). | Patch early | 7.8 high | 5.5% | 2007-02-13 |
| CVE-2017-18016 EXP | Parity Browser 1.6.10 and earlier allows remote attackers to bypass the Same Origin Policy and obtain sensitive information by requesting other websit… | Patch early | 5.3 medium | 5.5% | 2018-01-11 |
| CVE-2009-4511 EXP | Multiple directory traversal vulnerabilities in the web administration interface on the TANDBERG Video Communication Server (VCS) before X5.1 allow re… | Patch early | 4.0 medium | 5.5% | 2010-04-13 |
| CVE-2009-3518 EXP | Argument injection vulnerability in the iim: URI handler in IBMIM.exe in IBM Installation Manager 1.3.2 and earlier, as used in IBM Rational Robot and… | Patch early | 9.3 high | 5.5% | 2009-10-01 |
| CVE-2011-3010 EXP | Multiple cross-site scripting (XSS) vulnerabilities in TWiki before 5.1.0 allow remote attackers to inject arbitrary web script or HTML via (1) the ne… | Patch early | 4.3 medium | 5.5% | 2011-09-30 |
| CVE-2025-31131 EXP | YesWiki is a wiki system written in PHP. The squelette parameter is vulnerable to path traversal attacks, enabling read access to arbitrary files on t… | Patch early | 8.6 high | 5.5% | 2025-04-01 |
| CVE-2009-1232 EXP | Mozilla Firefox 3.0.8 and earlier 3.0.x versions allows remote attackers to cause a denial of service (memory corruption) via an XML document composed… | Patch early | 4.3 medium | 5.5% | 2009-04-02 |
| CVE-2006-1960 EXP | Cross-site scripting (XSS) vulnerability in the appliance web user interface in Cisco CiscoWorks Wireless LAN Solution Engine (WLSE) and WLSE Express… | Patch early | 5.8 medium | 5.5% | 2006-04-21 |
| CVE-2015-8285 EXP | The webssx.sys driver in QuickHeal 16.00 allows remote attackers to cause a denial of service. | Patch early | 7.5 high | 5.5% | 2017-04-20 |
| CVE-2006-1595 EXP | Cross-site scripting (XSS) vulnerability in document/rqmkhtml.php in Claroline 1.7.4 and earlier allows remote attackers to read arbitrary files via "… | Patch early | 4.3 medium | 5.5% | 2006-04-03 |
| CVE-2006-0841 EXP | Multiple cross-site scripting (XSS) vulnerabilities in Mantis 1.00rc4 and earlier allow remote attackers to inject arbitrary web script or HTML via th… | Patch early | 4.3 medium | 5.5% | 2006-02-22 |
| CVE-2014-1564 EXP | Mozilla Firefox before 32.0, Firefox ESR 31.x before 31.1, and Thunderbird 31.x before 31.1 do not properly initialize memory for GIF rendering, which… | Patch early | 4.3 medium | 5.5% | 2014-09-03 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt