CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
425,036 CVEs
1,779 on KEV
17,545 EPSS ≥ 10%
25,095 with exploits
synced 2026-11-13
12,664 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2017-8731 EXP | Microsoft Edge in Microsoft Windows 10 1607 and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user, d… | Patch early | 7.5 high | 51.6% | 2017-09-13 |
| CVE-2002-0061 EXP | Apache for Win32 before 1.3.24, and 2.0.x before 2.0.34-beta, allows remote attackers to execute arbitrary commands via shell metacharacters (a | pipe… | Patch early | 7.5 high | 51.5% | 2002-03-21 |
| CVE-2017-8496 EXP | Microsoft Edge in Windows 10 1607 and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user when Microso… | Patch early | 7.5 high | 51.5% | 2017-06-15 |
| CVE-2006-1551 EXP | Eval injection vulnerability in pajax_call_dispatcher.php in PAJAX 0.5.1 and earlier allows remote attackers to execute arbitrary code via the (1) $me… | Patch early | 7.5 high | 51.4% | 2006-04-13 |
| CVE-2017-13772 EXP | Multiple stack-based buffer overflows in TP-Link WR940N WiFi routers with hardware version 4 allow remote authenticated users to execute arbitrary cod… | Patch early | 8.8 high | 51.4% | 2017-10-23 |
| CVE-2013-0753 EXP | Use-after-free vulnerability in the serializeToStream implementation in the XMLSerializer component in Mozilla Firefox before 18.0, Firefox ESR 10.x b… | Patch early | 9.3 high | 51.3% | 2013-01-13 |
| CVE-2022-36633 EXP | Teleport 9.3.6 is vulnerable to Command injection leading to Remote Code Execution. An attacker can craft a malicious ssh agent installation link by U… | Patch early | 8.8 high | 51.3% | 2022-08-24 |
| CVE-2022-0557 EXP | OS Command Injection in Packagist microweber/microweber prior to 1.2.11. | Patch early | 7.2 high | 51.2% | 2022-02-11 |
| CVE-2016-0956 EXP | The Servlets Post component 2.3.6 in Apache Sling, as used in Adobe Experience Manager 5.6.1, 6.0.0, and 6.1.0, allows remote attackers to obtain sens… | Patch early | 7.5 high | 51.2% | 2016-02-10 |
| CVE-2018-0946 EXP | A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka "Scripting Engine M… | Patch early | 7.5 high | 51.1% | 2018-05-09 |
| CVE-2017-1000083 EXP | backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote attackers to execute arbitrary commands via… | Patch early | 7.8 high | 51.1% | 2017-09-05 |
| CVE-2010-0033 EXP | Stack-based buffer overflow in Microsoft Office PowerPoint 2003 SP3 allows remote attackers to execute arbitrary code via a crafted PowerPoint documen… | Patch early | 9.3 high | 51.1% | 2010-02-10 |
| CVE-2016-0199 EXP | Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf… | Patch early | 8.8 high | 51% | 2016-06-16 |
| CVE-2018-8552 EXP | An information disclosure vulnerability exists when VBScript improperly discloses the contents of its memory, which could provide an attacker with inf… | Patch early | 7.5 high | 51% | 2018-11-14 |
| CVE-2014-0282 EXP | Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf… | Patch early | 9.3 high | 50.9% | 2014-06-11 |
| CVE-2008-0111 EXP | Unspecified vulnerability in Microsoft Excel 2000 SP3 through 2007, Viewer 2003, Compatibility Pack, and Office 2004 for Mac allows user-assisted remo… | Patch early | 9.3 high | 50.9% | 2008-03-11 |
| CVE-2002-0013 EXP | Vulnerabilities in the SNMPv1 request handling of a large number of SNMP implementations allow remote attackers to cause a denial of service or gain p… | Patch early | 10.0 high | 50.8% | 2002-02-13 |
| CVE-2010-2309 EXP | Buffer overflow in the web server for EvoLogical EvoCam 3.6.6 and 3.6.7 allows remote attackers to execute arbitrary code via a long GET request. | Patch early | 7.5 high | 50.8% | 2010-06-16 |
| CVE-2001-0167 EXP | Buffer overflow in AT&T WinVNC (Virtual Network Computing) client 3.3.3r7 and earlier allows remote attackers to execute arbitrary commands via a long… | Patch early | 7.6 high | 50.8% | 2001-05-03 |
| CVE-2007-1567 EXP | Stack-based buffer overflow in War FTP Daemon 1.65, and possibly earlier, allows remote attackers to cause a denial of service or execute arbitrary co… | Patch early | 10.0 high | 50.8% | 2007-03-21 |
| CVE-2018-1418 EXP | IBM Security QRadar SIEM 7.2 and 7.3 could allow a user to bypass authentication which could lead to code execution. IBM X-Force ID: 138824. | Patch early | 8.8 high | 50.7% | 2018-04-26 |
| CVE-2020-15050 EXP | An issue was discovered in the Video Extension in Suprema BioStar 2 before 2.8.2. Remote attackers can read arbitrary files from the server via Direct… | Patch early | 7.5 high | 50.7% | 2020-07-13 |
| CVE-2015-5131 EXP | Buffer overflow in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR S… | Patch early | 10.0 high | 50.7% | 2015-08-14 |
| CVE-2015-5132 EXP | Buffer overflow in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR S… | Patch early | 10.0 high | 50.7% | 2015-08-14 |
| CVE-2015-5133 EXP | Buffer overflow in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR S… | Patch early | 10.0 high | 50.7% | 2015-08-14 |
| CVE-2010-0266 EXP | Microsoft Office Outlook 2002 SP3, 2003 SP3, and 2007 SP1 and SP2 does not properly verify e-mail attachments with a PR_ATTACH_METHOD property value o… | Patch early | 9.3 high | 50.7% | 2010-07-15 |
| CVE-2014-7146 EXP | The XmlImportExport plugin in MantisBT 1.2.17 and earlier allows remote attackers to execute arbitrary PHP code via a crafted (1) description field or… | Patch early | 7.5 high | 50.6% | 2014-11-18 |
| CVE-2009-4655 EXP | The dhost web service in Novell eDirectory 8.8.5 uses a predictable session cookie, which makes it easier for remote attackers to hijack sessions via… | Patch early | 7.5 high | 50.5% | 2010-02-26 |
| CVE-2016-3304 EXP | The Windows font library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Office 2007 SP3, Office 2010 SP2, Word Vie… | Patch early | 7.8 high | 50.5% | 2016-08-09 |
| CVE-2016-3303 EXP | The Windows font library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Office 2007 SP3, Office 2010 SP2, Word Vie… | Patch early | 7.8 high | 50.5% | 2016-08-09 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt