CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
398,648 CVEs
1,728 on KEV
17,267 EPSS ≥ 10%
25,086 with exploits
synced 2026-09-28
25,086 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2010-1240 EXP | Adobe Reader and Acrobat 9.x before 9.3.3, and 8.x before 8.2.3 on Windows and Mac OS X, do not restrict the contents of one text field in the Launch… | Patch early | 9.3 high | 73.6% | 2010-04-05 |
| CVE-2015-8249 EXP | The FileUploadServlet class in ManageEngine Desktop Central 9 before build 91093 allows remote attackers to upload and execute arbitrary files via the… | Patch early | 9.8 critical | 73.6% | 2017-09-28 |
| CVE-2006-3838 EXP | Multiple stack-based buffer overflows in eIQnetworks Enterprise Security Analyzer (ESA) before 2.5.0, as used in products including (a) Sidewinder, (b… | Patch early | 10.0 high | 73.6% | 2006-07-27 |
| CVE-2006-2630 EXP | Stack-based buffer overflow in Symantec Antivirus 10.1 and Client Security 3.1 allows remote attackers to execute arbitrary code via unknown attack ve… | Patch early | 10.0 high | 73.6% | 2006-05-27 |
| CVE-2004-0608 EXP | The Unreal Engine, as used in DeusEx 1.112fm and earlier, Devastation 390 and earlier, Mobile Forces 20000 and earlier, Nerf Arena Blast 1.2 and earli… | Patch early | 10.0 high | 73.5% | 2004-12-06 |
| CVE-2012-4958 EXP | Directory traversal vulnerability in NFRAgent.exe in Novell File Reporter 1.0.2 allows remote attackers to read arbitrary files via a 126 /FSF/CMD req… | Patch early | 7.8 high | 73.5% | 2012-11-18 |
| CVE-2022-29885 EXP | The documentation of Apache Tomcat 10.1.0-M1 to 10.1.0-M14, 10.0.0-M1 to 10.0.20, 9.0.13 to 9.0.62 and 8.5.38 to 8.5.78 for the EncryptInterceptor inc… | Patch early | 7.5 high | 73.5% | 2022-05-12 |
| CVE-2015-2284 EXP | userlogin.jsp in SolarWinds Firewall Security Manager (FSM) before 6.6.5 HotFix1 allows remote attackers to gain privileges and execute arbitrary code… | Patch early | 10.0 high | 73.5% | 2015-03-24 |
| CVE-2020-24881 EXP | SSRF exists in osTicket before 1.14.3, where an attacker can add malicious file to server or perform port scanning. | Patch early | 9.8 critical | 73.4% | 2020-11-02 |
| CVE-2017-17560 EXP | An issue was discovered on Western Digital MyCloud PR4100 2.30.172 devices. The web administration component, /web/jquery/uploader/multi_uploadify.php… | Patch early | 9.8 critical | 73.4% | 2017-12-12 |
| CVE-2009-3867 EXP | Stack-based buffer overflow in the HsbParser.getSoundBank function in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17,… | Patch early | 9.3 high | 73.4% | 2009-11-05 |
| CVE-2013-0758 EXP | Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 an… | Patch early | 9.3 high | 73.4% | 2013-01-13 |
| CVE-2008-0621 EXP | Buffer overflow in SAPLPD 6.28 and earlier included in SAP GUI 7.10 and SAPSprint before 1018 allows remote attackers to execute arbitrary code via lo… | Patch early | 7.5 high | 73.4% | 2008-02-06 |
| CVE-2007-2815 EXP | The "hit-highlighting" functionality in webhits.dll in Microsoft Internet Information Services (IIS) Web Server 5.0 only uses Windows NT ACL configura… | Patch early | 10.0 high | 73.4% | 2007-05-22 |
| CVE-2004-0362 EXP | Multiple stack-based buffer overflows in the ICQ parsing routines of the ISS Protocol Analysis Module (PAM) component, as used in various RealSecure,… | Patch early | 7.5 high | 73.3% | 2004-04-15 |
| CVE-2014-7868 EXP | Multiple SQL injection vulnerabilities in ZOHO ManageEngine OpManager 11.3 and 11.4, IT360 10.3 and 10.4, and Social IT Plus 11.0 allow remote attacke… | Patch early | 7.5 high | 73.3% | 2014-12-04 |
| CVE-2021-24862 EXP | The RegistrationMagic WordPress plugin before 5.0.1.6 does not escape user input in its rm_chronos_ajax AJAX action before using it in a SQL statement… | Patch early | 7.2 high | 73.3% | 2022-01-10 |
| CVE-2016-7202 EXP | The scripting engines in Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denia… | Patch early | 7.5 high | 73.3% | 2016-11-10 |
| CVE-2005-0059 EXP | Buffer overflow in the Message Queuing component of Microsoft Windows 2000 and Windows XP SP1 allows remote attackers to execute arbitrary code via a… | Patch early | 10.0 high | 73.3% | 2005-05-02 |
| CVE-2007-5067 EXP | Multiple buffer overflows in iMatix Xitami Web Server 2.5c2 allow remote attackers to execute arbitrary code via a long If-Modified-Since header to (1… | Patch early | 7.5 high | 73.2% | 2007-09-24 |
| CVE-2020-11698 EXP | An issue was discovered in Titan SpamTitan 7.07. Improper input sanitization of the parameter community on the page snmp-x.php would allow a remote at… | Patch early | 9.8 critical | 73.2% | 2020-09-17 |
| CVE-2017-11467 EXP | OrientDB through 2.2.22 does not enforce privilege requirements during "where" or "fetchplan" or "order by" use, which allows remote attackers to exec… | Patch early | 9.8 critical | 73.1% | 2017-07-20 |
| CVE-2017-5637 EXP | Two four letter word commands "wchp/wchc" are CPU intensive and could cause spike of CPU utilization on Apache ZooKeeper server if abused, which leads… | Patch early | 7.5 high | 73.1% | 2017-10-10 |
| CVE-2018-20526 EXP | Roxy Fileman 1.4.5 allows unrestricted file upload in upload.php. | Patch early | 9.8 critical | 73.1% | 2019-03-21 |
| CVE-2005-2428 EXP | Lotus Domino R5 and R6 WebMail, with "Generate HTML for all fields" enabled, stores sensitive data from names.nsf in hidden form fields, which allows… | Patch early | 5.0 medium | 73% | 2005-08-03 |
| CVE-2006-1148 EXP | Multiple stack-based buffer overflows in the procConnectArgs function in servmgr.cpp in PeerCast before 0.1217 allow remote attackers to execute arbit… | Patch early | 7.5 high | 73% | 2006-03-10 |
| CVE-2007-1697 EXP | PHP remote file inclusion vulnerability in header.inc.php in Philex 0.2.3 and earlier allows remote attackers to execute arbitrary PHP code via a URL… | Patch early | 10.0 high | 73% | 2007-03-27 |
| CVE-2007-1070 EXP | Multiple stack-based buffer overflows in Trend Micro ServerProtect for Windows and EMC 5.58, and for Network Appliance Filer 5.61 and 5.62, allow remo… | Patch early | 10.0 high | 73% | 2007-02-21 |
| CVE-2012-0297 EXP | The management GUI in Symantec Web Gateway 5.0.x before 5.0.3 does not properly restrict access to application scripts, which allows remote attackers… | Patch early | 10.0 high | 73% | 2012-05-21 |
| CVE-2012-0394 EXP | The DebuggingInterceptor component in Apache Struts before 2.3.1.1, when developer mode is used, allows remote attackers to execute arbitrary commands… | Patch early | 6.8 medium | 72.9% | 2012-01-08 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt