CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
425,731 CVEs
1,781 on KEV
17,555 EPSS ≥ 10%
25,095 with exploits
synced 2026-11-14
25,095 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2015-7611 EXP | Apache James Server 2.3.2, when configured with file-based user repositories, allows attackers to execute arbitrary system commands via unspecified ve… | Patch early | 8.1 high | 68.6% | 2016-06-07 |
| CVE-2009-0695 EXP | hagent.exe in Wyse Device Manager (WDM) 4.7.x does not require authentication for commands, which allows remote attackers to obtain management access… | Patch early | 7.5 high | 68.6% | 2012-06-19 |
| CVE-2009-2227 EXP | Stack-based buffer overflow in B Labs Bopup Communication Server 3.2.26.5460 allows remote attackers to execute arbitrary code via a crafted request t… | Patch early | 10.0 high | 68.6% | 2009-06-26 |
| CVE-2019-9053 EXP | An issue was discovered in CMS Made Simple 2.2.8. It is possible with the News module, through a crafted URL, to achieve unauthenticated blind time-ba… | Patch early | 8.1 high | 68.6% | 2019-03-26 |
| CVE-2020-13951 EXP | Attackers can use public NetTest web service of Apache OpenMeetings 4.0.0-5.0.0 to organize denial of service attack. | Patch early | 7.5 high | 68.6% | 2020-09-30 |
| CVE-2009-2990 EXP | Array index error in Adobe Reader and Acrobat 9.x before 9.2, 8.x before 8.1.7, and possibly 7.x through 7.1.4 might allow attackers to execute arbitr… | Patch early | 9.3 high | 68.6% | 2009-10-19 |
| CVE-2012-1195 EXP | Unrestricted file upload vulnerability in andesk/managementsuite/core/core.anonymous/ServerSetup.asmx in the ServerSetup web service in Lenovo ThinkMa… | Patch early | 7.5 high | 68.6% | 2012-02-18 |
| CVE-2005-0684 EXP | Multiple buffer overflows in the web tool for MySQL MaxDB before 7.5.00.26 allows remote attackers to execute arbitrary code via (1) an HTTP GET reque… | Patch early | 10.0 high | 68.5% | 2005-04-25 |
| CVE-2007-0785 EXP | PHP remote file inclusion vulnerability in previewtheme.php in Flipsource Flip 2.01-final 1.0 and earlier allows remote attackers to execute arbitrary… | Patch early | 7.5 high | 68.5% | 2007-02-06 |
| CVE-2018-8631 EXP | A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory Corruption Vu… | Patch early | 7.5 high | 68.5% | 2018-12-12 |
| CVE-2017-11893 EXP | ChakraCore and Microsoft Edge in Windows 10 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to execute arbitrary code in the contex… | Patch early | 7.5 high | 68.5% | 2017-12-12 |
| CVE-2013-4547 EXP | nginx 0.8.41 through 1.4.3 and 1.5.x before 1.5.7 allows remote attackers to bypass intended restrictions via an unescaped space character in a URI. | Patch early | 7.5 high | 68.5% | 2013-11-23 |
| CVE-2007-0213 EXP | Microsoft Exchange Server 2000 SP3, 2003 SP1 and SP2, and 2007 does not properly decode certain MIME encoded e-mails, which allows remote attackers to… | Patch early | 10.0 high | 68.5% | 2007-05-08 |
| CVE-2001-0537 EXP | HTTP server for Cisco IOS 11.3 to 12.2 allows attackers to bypass authentication and execute arbitrary commands, when local authorization is being use… | Patch early | 9.3 high | 68.5% | 2001-07-21 |
| CVE-2018-0860 EXP | Microsoft Edge and ChakraCore in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how t… | Patch early | 7.5 high | 68.4% | 2018-02-15 |
| CVE-2017-14496 EXP | Integer underflow in the add_pseudoheader function in dnsmasq before 2.78 , when the --add-mac, --add-cpe-id or --add-subnet option is specified, allo… | Patch early | 7.5 high | 68.4% | 2017-10-03 |
| CVE-2003-0727 EXP | Multiple buffer overflows in the XML Database (XDB) functionality for Oracle 9i Database Release 2 allow local users to cause a denial of service or h… | Patch early | 2.1 low | 68.4% | 2003-10-20 |
| CVE-2006-0460 EXP | Multiple buffer overflows in BomberClone before 0.11.6.2 allow remote attackers to execute arbitrary code via long error messages. | Patch early | 7.5 high | 68.4% | 2006-02-17 |
| CVE-2006-1359 EXP | Microsoft Internet Explorer 6 and 7 Beta 2 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a certain crea… | Patch early | 9.3 high | 68.3% | 2006-03-23 |
| CVE-2001-1320 EXP | Network Associates PGP Keyserver 7.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via exceptional… | Patch early | 7.5 high | 68.3% | 2001-07-16 |
| CVE-2003-1141 EXP | Buffer overflow in NIPrint 4.10 allows remote attackers to execute arbitrary code via a long string to TCP port 515. | Patch early | 7.5 high | 68.3% | 2003-11-04 |
| CVE-2000-0284 EXP | Buffer overflow in University of Washington imapd version 4.7 allows users with a valid account to execute commands via LIST or other commands. | Patch early | 7.5 high | 68.3% | 2000-04-16 |
| CVE-2018-10594 EXP | Delta Industrial Automation COMMGR from Delta Electronics versions 1.08 and prior with accompanying PLC Simulators (DVPSimulator EH2, EH3, ES2, SE, SS… | Patch early | 9.8 critical | 68.3% | 2018-06-26 |
| CVE-2024-28000 EXP | Incorrect Privilege Assignment vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache.This issue affects LiteSpeed Cache: from n/a th… | Patch early | 9.8 critical | 68.3% | 2024-08-21 |
| CVE-2017-9833 EXP | /cgi-bin/wapopen in Boa 0.94.14rc21 allows the injection of "../.." using the FILECAMERA variable (sent by GET) to read files with root privileges. NO… | Patch early | 7.5 high | 68.2% | 2017-06-24 |
| CVE-2010-3332 EXP | Microsoft .NET Framework 1.1 SP1, 2.0 SP1 and SP2, 3.5, 3.5 SP1, 3.5.1, and 4.0, as used for ASP.NET in Microsoft Internet Information Services (IIS),… | Patch early | 6.4 medium | 68.2% | 2010-09-22 |
| CVE-2000-0630 EXP | IIS 4.0 and 5.0 allows remote attackers to obtain fragments of source code by appending a +.htr to the URL, a variant of the "File Fragment Reading vi… | Patch early | 5.0 medium | 68.2% | 2000-07-17 |
| CVE-2017-12477 EXP | It was discovered that the bpserverd proprietary protocol in Unitrends Backup (UB) before 10.0.0, as invoked through xinetd, has an issue in which its… | Patch early | 9.8 critical | 68.2% | 2017-08-07 |
| CVE-2004-1388 EXP | Format string vulnerability in the gpsd_report function for BerliOS GPD daemon (gpsd, formerly pygps) 1.9.0 through 2.7 allows remote attackers to exe… | Patch early | 7.5 high | 68.2% | 2004-12-31 |
| CVE-2018-10093 EXP | AudioCodes IP phone 420HD devices using firmware version 2.2.12.126 allow Remote Code Execution. | Patch early | 8.8 high | 68.2% | 2019-03-21 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt