CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
398,648 CVEs
1,728 on KEV
17,267 EPSS ≥ 10%
25,086 with exploits
synced 2026-09-28
12,661 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2012-1875 EXP | Microsoft Internet Explorer 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a delet… | Patch early | 9.3 high | 61.7% | 2012-06-12 |
| CVE-2015-7602 EXP | Directory traversal vulnerability in BisonWare BisonFTP 3.5 allows remote attackers to read arbitrary files via a ../ (dot dot slash) in a RETR comman… | Patch early | 7.8 high | 61.5% | 2015-09-29 |
| CVE-2012-4711 EXP | Buffer overflow in kingMess.exe 65.20.2003.10300 in WellinTech KingView 6.52, kingMess.exe 65.20.2003.10400 in KingView 6.53, and kingMess.exe 65.50.2… | Patch early | 10.0 high | 61.5% | 2013-02-15 |
| CVE-2005-2123 EXP | Multiple integer overflows in the Graphics Rendering Engine (GDI32.DLL) in Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 allow remote attacker… | Patch early | 7.5 high | 61.5% | 2005-11-29 |
| CVE-2014-2206 EXP | Stack-based buffer overflow in GetGo Download Manager 4.9.0.1982, 4.8.2.1346, 4.4.5.502, and earlier allows remote attackers to cause a denial of serv… | Patch early | 10.0 high | 61.4% | 2014-03-05 |
| CVE-2006-4868 EXP | Stack-based buffer overflow in the Vector Graphics Rendering engine (vgx.dll), as used in Microsoft Outlook and Internet Explorer 6.0 on Windows XP SP… | Patch early | 9.3 high | 61.4% | 2006-09-19 |
| CVE-2006-1189 EXP | Buffer overflow in URLMON.DLL in Microsoft Internet Explorer 5.01 through 6 allows remote attackers to execute arbitrary code via a crafted URL with a… | Patch early | 10.0 high | 61.4% | 2006-04-11 |
| CVE-2014-2364 EXP | Multiple stack-based buffer overflows in Advantech WebAccess before 7.2 allow remote attackers to execute arbitrary code via a long string in the (1)… | Patch early | 7.5 high | 61.4% | 2014-07-19 |
| CVE-2015-4133 EXP | Unrestricted file upload vulnerability in admin/scripts/FileUploader/php.php in the ReFlex Gallery plugin before 3.1.4 for WordPress allows remote att… | Patch early | 7.5 high | 61.4% | 2015-05-28 |
| CVE-2017-1000119 EXP | October CMS build 412 is vulnerable to PHP code execution in the file upload functionality resulting in site compromise and possibly other application… | Patch early | 7.2 high | 61.3% | 2017-10-05 |
| CVE-2010-1807 EXP | WebKit in Apple Safari 4.x before 4.1.2 and 5.x before 5.0.2; Android before 2.2; and webkitgtk before 1.2.6; does not properly validate floating-poin… | Patch early | 9.3 high | 61.3% | 2010-09-10 |
| CVE-2008-5457 EXP | Unspecified vulnerability in the Oracle BEA WebLogic Server Plugins for Apache, Sun and IIS web servers component in BEA Product Suite 10.3, 10.0 MP1,… | Patch early | 10.0 high | 61.3% | 2009-01-14 |
| CVE-2006-1190 EXP | Microsoft Internet Explorer 5.01 through 6 does not always return the correct IOleClientSite information when dynamically creating an embedded object,… | Patch early | 10.0 high | 61.3% | 2006-04-11 |
| CVE-2008-0065 EXP | Multiple stack-based buffer overflows in in_mp3.dll in Winamp 5.21, 5.5, and 5.51 allow remote attackers to execute arbitrary code via a long (1) arti… | Patch early | 10.0 high | 61.3% | 2008-01-22 |
| CVE-2010-0239 EXP | The TCP/IP implementation in Microsoft Windows Vista Gold, SP1, and SP2 and Server 2008 Gold and SP2, when IPv6 is enabled, does not properly perform… | Patch early | 10.0 high | 61.3% | 2010-02-10 |
| CVE-2007-1675 EXP | Buffer overflow in the CRAM-MD5 authentication mechanism in the IMAP server (nimap.exe) in IBM Lotus Domino before 6.5.6 and 7.x before 7.0.2 FP1 allo… | Patch early | 10.0 high | 61.2% | 2007-03-28 |
| CVE-2006-1314 EXP | Heap-based buffer overflow in the Server Service (SRV.SYS driver) in Microsoft Windows 2000 SP4, XP SP1 and SP2, Server 2003 up to SP1, and other prod… | Patch early | 7.5 high | 61.2% | 2006-07-11 |
| CVE-2006-4379 EXP | Stack-based buffer overflow in the SMTP Daemon in Ipswitch Collaboration 2006 Suite Premium and Standard Editions, IMail, IMail Plus, and IMail Secure… | Patch early | 7.5 high | 61.1% | 2006-09-08 |
| CVE-2008-2703 EXP | Multiple stack-based buffer overflows in Novell GroupWise Messenger (GWIM) Client before 2.0.3 HP1 for Windows allow remote attackers to execute arbit… | Patch early | 10.0 high | 61.1% | 2008-06-13 |
| CVE-2004-0549 EXP | The WebBrowser ActiveX control, or the Internet Explorer HTML rendering engine (MSHTML), as used in Internet Explorer 6, allows remote attackers to ex… | Patch early | 10.0 high | 61.1% | 2004-08-06 |
| CVE-2025-31650 EXP | Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean… | Patch early | 7.5 high | 61% | 2025-04-28 |
| CVE-2003-0717 EXP | The Messenger Service for Windows NT through Server 2003 does not properly verify the length of the message, which allows remote attackers to execute… | Patch early | 7.5 high | 61% | 2003-11-17 |
| CVE-2003-0471 EXP | Buffer overflow in WebAdmin.exe for WebAdmin allows remote attackers to execute arbitrary code via an HTTP request to WebAdmin.dll with a long USER ar… | Patch early | 7.5 high | 61% | 2003-08-07 |
| CVE-2011-0807 EXP | Unspecified vulnerability in Oracle Sun GlassFish Enterprise Server 2.1, 2.1.1, and 3.0.1, and Sun Java System Application Server 9.1, allows remote a… | Patch early | 10.0 high | 60.9% | 2011-04-20 |
| CVE-2006-5792 EXP | Unspecified vulnerability in XLink Omni-NFS Enterprise allows remote attackers to execute arbitrary code via unspecified vectors, as demonstrated by v… | Patch early | 7.5 high | 60.9% | 2006-11-07 |
| CVE-2014-3913 EXP | Stack-based buffer overflow in AccessServer32.exe in Ericom AccessNow Server allows remote attackers to execute arbitrary code via a request for a non… | Patch early | 10.0 high | 60.9% | 2014-06-04 |
| CVE-2013-0757 EXP | The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird… | Patch early | 9.3 high | 60.9% | 2013-01-13 |
| CVE-2011-1260 EXP | Microsoft Internet Explorer 8 and 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a… | Patch early | 9.3 high | 60.8% | 2011-06-16 |
| CVE-2023-27179 EXP | GDidees CMS v3.9.1 and lower was discovered to contain an arbitrary file download vulenrability via the filename parameter at /_admin/imgdownload.php. | Patch early | 7.5 high | 60.8% | 2023-04-11 |
| CVE-2018-18982 EXP | NUUO CMS All versions 3.3 and prior the web server application allows injection of arbitrary SQL characters, which can be used to inject SQL into an e… | Patch early | 8.8 high | 60.8% | 2018-11-27 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt