CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
424,962 CVEs
1,779 on KEV
17,545 EPSS ≥ 10%
25,095 with exploits
synced 2026-11-13
12,664 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2007-2937 EXP | PHP remote file inclusion vulnerability in admin/admin.php in TROforum 0.1 allows remote attackers to execute arbitrary PHP code via a URL in the site… | Patch early | 7.5 high | 64.4% | 2007-05-31 |
| CVE-2007-3325 EXP | PHP remote file inclusion vulnerability in lib/language.php in LAN Management System (LMS) 1.9.6 and earlier allows remote attackers to execute arbitr… | Patch early | 7.5 high | 64.4% | 2007-06-21 |
| CVE-2007-2986 EXP | PHP remote file inclusion vulnerability in lib/live_status.lib.php in AdminBot MX 9.0.5 allows remote attackers to execute arbitrary PHP code via a UR… | Patch early | 7.5 high | 64.4% | 2007-06-01 |
| CVE-2007-3306 EXP | PHP remote file inclusion vulnerability in crontab/run_billing.php in MiniBill 1.2.5 allows remote attackers to execute arbitrary PHP code via a URL i… | Patch early | 7.5 high | 64.4% | 2007-06-21 |
| CVE-2022-44149 EXP | The web service on Nexxt Amp300 ARN02304U8 42.103.1.5095 and 80.103.2.5045 devices allows remote OS command execution by placing &telnetd in the JSON… | Patch early | 8.8 high | 64.4% | 2023-01-06 |
| CVE-2014-7186 EXP | The redirection implementation in parse.y in GNU Bash through 4.3 bash43-026 allows remote attackers to cause a denial of service (out-of-bounds array… | Patch early | 10.0 high | 64.3% | 2014-09-28 |
| CVE-2011-4828 EXP | Unrestricted file upload vulnerability in includes/inline_image_upload.php in AutoSec Tools V-CMS 1.0 allows remote attackers to execute arbitrary cod… | Patch early | 7.5 high | 64.3% | 2011-12-15 |
| CVE-2014-6277 EXP | GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to… | Patch early | 10.0 high | 64.3% | 2014-09-27 |
| CVE-1999-0504 EXP | A Windows NT local user or administrator account has a default, null, blank, or missing password. | Patch early | 7.5 high | 64.3% | 1997-01-01 |
| CVE-2011-0922 EXP | The client in HP Data Protector allows remote attackers to execute arbitrary programs via an EXEC_SETUP command that references a UNC share pathname. | Patch early | 10.0 high | 64.2% | 2011-02-09 |
| CVE-2006-5216 EXP | Stack-based buffer overflow in Sergey Lyubka Simple HTTPD (shttpd) 1.34 allows remote attackers to execute arbitrary code via a long URI. | Patch early | 7.5 high | 64.2% | 2006-10-10 |
| CVE-2017-11861 EXP | Microsoft Edge in Windows 10 1607, 1703, 1709, Windows Server 2016 and Windows Server, version 1709 allows an attacker to gain the same user rights as… | Patch early | 7.5 high | 64.2% | 2017-11-15 |
| CVE-2016-1593 EXP | Directory traversal vulnerability in the import users feature in Micro Focus Novell Service Desk before 7.2 allows remote authenticated administrators… | Patch early | 7.2 high | 64.1% | 2016-04-22 |
| CVE-2018-8384 EXP | A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scri… | Patch early | 7.5 high | 64.1% | 2018-08-15 |
| CVE-2008-5053 EXP | PHP remote file inclusion vulnerability in admin.rssreader.php in the Simple RSS Reader (com_rssreader) 1.0 component for Joomla! allows remote attack… | Patch early | 10.0 high | 64.1% | 2008-11-13 |
| CVE-2011-1565 EXP | Directory traversal vulnerability in IGSSdataServer.exe 9.00.00.11063 and earlier in 7-Technologies Interactive Graphical SCADA System (IGSS) allows r… | Patch early | 10.0 high | 64.1% | 2011-04-05 |
| CVE-2014-8636 EXP | The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with a DOM object that has a named… | Patch early | 7.5 high | 63.9% | 2015-01-14 |
| CVE-2009-3711 EXP | Stack-based buffer overflow in the h_handlepeer function in http.cpp in httpdx 1.4, and possibly 1.4.3, allows remote attackers to cause a denial of s… | Patch early | 10.0 high | 63.9% | 2009-10-16 |
| CVE-2012-2019 EXP | Unspecified vulnerability in HP Operations Agent before 11.03.12 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-13… | Patch early | 10.0 high | 63.9% | 2012-07-11 |
| CVE-2009-2936 EXP | The Command Line Interface (aka Server CLI or administration interface) in the master process in the reverse proxy server in Varnish before 2.1.0 does… | Patch early | 7.5 high | 63.8% | 2010-04-05 |
| CVE-2019-6447 EXP | The ES File Explorer File Manager application through 4.1.9.7.4 for Android allows remote attackers to read arbitrary files or execute applications vi… | Patch early | 8.1 high | 63.8% | 2019-01-16 |
| CVE-2019-14287 EXP | In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and session PAM modules, and can cau… | Patch early | 8.8 high | 63.8% | 2019-10-17 |
| CVE-2012-5201 EXP | Unspecified vulnerability in HP Intelligent Management Center (iMC) and Intelligent Management Center for Automated Network Manager (ANM) before 5.2 E… | Patch early | 10.0 high | 63.7% | 2013-03-09 |
| CVE-2012-6329 EXP | The _compile function in Maketext.pm in the Locale::Maketext implementation in Perl before 5.17.7 does not properly handle backslashes and fully quali… | Patch early | 7.5 high | 63.7% | 2013-01-04 |
| CVE-2012-0299 EXP | The file-management scripts in the management GUI in Symantec Web Gateway 5.0.x before 5.0.3 allow remote attackers to upload arbitrary code to a desi… | Patch early | 10.0 high | 63.7% | 2012-05-21 |
| CVE-2005-3155 EXP | Buffer overflow in the W3C logging for MailEnable Enterprise 1.1 and Professional 1.6 allows remote attackers to execute arbitrary code. | Patch early | 7.5 high | 63.7% | 2005-10-05 |
| CVE-2011-0647 EXP | The irccd.exe service in EMC Replication Manager Client before 5.3 and NetWorker Module for Microsoft Applications 2.1.x and 2.2.x allows remote attac… | Patch early | 10.0 high | 63.7% | 2011-02-10 |
| CVE-2017-11799 EXP | ChakraCore and Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in… | Patch early | 7.5 high | 63.7% | 2017-10-13 |
| CVE-2004-0932 EXP | McAfee Anti-Virus Engine DATS drivers before 4398 released on Oct 13th 2004 and DATS Driver before 4397 October 6th 2004 allows remote attackers to by… | Patch early | 7.5 high | 63.6% | 2005-01-27 |
| CVE-2004-0313 EXP | Buffer overflow in PSOProxy 0.91 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long HTTP request, as… | Patch early | 10.0 high | 63.6% | 2004-11-23 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt