CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
398,733 CVEs
1,728 on KEV
17,267 EPSS ≥ 10%
25,086 with exploits
synced 2026-09-28
12,661 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2017-7310 EXP | A buffer overflow vulnerability in Import Command in SyncBreeze before 10.6, DiskSorter before 10.6, DiskBoss before 8.9, DiskPulse before 10.6, DiskS… | Patch early | 7.8 high | 53.7% | 2017-03-29 |
| CVE-2002-1254 EXP | Internet Explorer 5.5 and 6.0 allows remote attackers to bypass the cross-domain security model and access information on the local system or in other… | Patch early | 7.5 high | 53.5% | 2002-12-11 |
| CVE-2021-23017 EXP | A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS server to cause 1-byte… | Patch early | 7.7 high | 53.5% | 2021-06-01 |
| CVE-2011-0104 EXP | Microsoft Excel 2002 SP3 and 2003 SP3, Office 2004 and 2008 for Mac, and Open XML File Format Converter for Mac allow remote attackers to execute arbi… | Patch early | 9.3 high | 53.4% | 2011-04-13 |
| CVE-2005-1978 EXP | COM+ in Microsoft Windows does not properly "create and use memory structures," which allows local users or remote attackers to execute arbitrary code… | Patch early | 7.5 high | 53.4% | 2005-10-12 |
| CVE-2005-2847 EXP | img.pl in Barracuda Spam Firewall running firmware 3.1.16 and 3.1.17 allows remote attackers to execute arbitrary commands via shell metacharacters in… | Patch early | 7.5 high | 53.4% | 2005-09-08 |
| CVE-2014-9118 EXP | The web administrative portal in Zhone zNID GPON 2426A before S3.0.501 allows remote attackers to execute arbitrary commands via shell metacharacters… | Patch early | 8.8 high | 53.4% | 2017-10-17 |
| CVE-2014-0644 EXP | EMC Cloud Tiering Appliance (CTA) 10 through SP1 allows remote attackers to read arbitrary files via an api/login request containing an XML external e… | Patch early | 7.8 high | 53.3% | 2014-04-17 |
| CVE-1999-0502 EXP | A Unix account has a default, null, blank, or missing password. | Patch early | 7.5 high | 53.3% | 1998-03-01 |
| CVE-2015-7007 EXP | Script Editor in Apple OS X before 10.11.1 allows remote attackers to bypass an intended user-confirmation requirement for AppleScript execution via u… | Patch early | 7.5 high | 53.3% | 2015-10-23 |
| CVE-2018-4233 EXP | An issue was discovered in certain Apple products. iOS before 11.4 is affected. Safari before 11.1.1 is affected. iCloud before 7.5 on Windows is affe… | Patch early | 8.8 high | 53.3% | 2018-06-08 |
| CVE-2009-0043 EXP | The smmsnmpd service in CA Service Metric Analysis r11.0 through r11.1 SP1 and Service Level Management 3.5 does not properly restrict access, which a… | Patch early | 10.0 high | 53.3% | 2009-01-08 |
| CVE-2008-3922 EXP | awstatstotals.php in AWStats Totals 1.0 through 1.14 allows remote attackers to execute arbitrary code via PHP sequences in the sort parameter, which… | Patch early | 9.3 high | 53.2% | 2008-09-04 |
| CVE-2010-0248 EXP | Microsoft Internet Explorer 6, 6 SP1, 7, and 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by… | Patch early | 8.1 high | 53.1% | 2010-01-22 |
| CVE-2018-0840 EXP | Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, and Internet Exp… | Patch early | 7.5 high | 53.1% | 2018-02-15 |
| CVE-2009-1955 EXP | The expat XML parser in the apr_xml_* interface in xml/apr_xml.c in Apache APR-util before 1.3.7, as used in the mod_dav and mod_dav_svn modules in th… | Patch early | 7.5 high | 53% | 2009-06-08 |
| CVE-2007-5099 EXP | PHP remote file inclusion vulnerability in show.php in David Watters Helplink 0.1.0 allows remote attackers to execute arbitrary PHP code via a URL in… | Patch early | 7.5 high | 53% | 2007-09-26 |
| CVE-2023-24078 EXP | Real Time Logic FuguHub v8.1 and earlier was discovered to contain a remote code execution (RCE) vulnerability via the component /FuguHub/cmsdocs/. | Patch early | 8.8 high | 53% | 2023-02-17 |
| CVE-2016-7434 EXP | The read_mru_list function in NTP before 4.2.8p9 allows remote attackers to cause a denial of service (crash) via a crafted mrulist query. | Patch early | 7.5 high | 52.9% | 2017-01-13 |
| CVE-2021-41381 EXP | Payara Micro Community 5.2021.6 and below allows Directory Traversal. | Patch early | 7.5 high | 52.9% | 2021-09-23 |
| CVE-2007-5348 EXP | Integer overflow in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 2008, Offic… | Patch early | 9.3 high | 52.9% | 2008-09-11 |
| CVE-2005-3589 EXP | Buffer overflow in FileZilla Server Terminal 0.9.4d may allow remote attackers to cause a denial of service (terminal crash) via a long USER ftp comma… | Patch early | 7.8 high | 52.9% | 2005-11-16 |
| CVE-2001-0538 EXP | Microsoft Outlook View ActiveX Control in Microsoft Outlook 2002 and earlier allows remote attackers to execute arbitrary commands via a malicious HTM… | Patch early | 10.0 high | 52.9% | 2001-08-14 |
| CVE-2014-1903 EXP | admin/libraries/view.functions.php in FreePBX 2.9 before 2.9.0.14, 2.10 before 2.10.1.15, 2.11 before 2.11.0.23, and 12 before 12.0.1alpha22 does not… | Patch early | 7.5 high | 52.8% | 2014-02-18 |
| CVE-2007-4921 EXP | PHP remote file inclusion vulnerability in _includes/settings.inc.php in Ajax File Browser 3 Beta allows remote attackers to execute arbitrary PHP cod… | Patch early | 7.5 high | 52.8% | 2007-09-17 |
| CVE-2000-0457 EXP | ISM.DLL in IIS 4.0 and 5.0 allows remote attackers to read file contents by requesting the file and appending a large number of encoded spaces (%20) a… | Patch early | 7.5 high | 52.8% | 2000-05-11 |
| CVE-2012-5691 EXP | Buffer overflow in RealNetworks RealPlayer before 16.0.0.282 and RealPlayer SP 1.0 through 1.1.5 allows remote attackers to execute arbitrary code via… | Patch early | 9.3 high | 52.7% | 2012-12-19 |
| CVE-2008-0108 EXP | Stack-based buffer overflow in wkcvqd01.dll in Microsoft Works 6 File Converter, as used in Office 2003 SP2 and SP3, Works 8.0, and Works Suite 2005,… | Patch early | 9.3 high | 52.6% | 2008-02-12 |
| CVE-2003-1041 EXP | Internet Explorer 5.x and 6.0 allows remote attackers to execute arbitrary programs via a modified directory traversal attack using a URL containing "… | Patch early | 7.5 high | 52.6% | 2004-06-14 |
| CVE-2009-3958 EXP | Multiple stack-based buffer overflows in the NOS Microsystems getPlus Helper ActiveX control before 1.6.2.49 in gp.ocx in the Download Manager in Adob… | Patch early | 10.0 high | 52.6% | 2010-01-13 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt