CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
425,731 CVEs
1,781 on KEV
17,555 EPSS ≥ 10%
25,095 with exploits
synced 2026-11-14
25,095 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2007-3237 EXP | PHP remote file inclusion vulnerability in admin/spaw/spaw_control.class.php in the TinyContent 1.5 module for XOOPS allows remote attackers to execut… | Patch early | 6.8 medium | 67.7% | 2007-06-15 |
| CVE-2008-1611 EXP | Stack-based buffer overflow in TFTP Server SP 1.4 for Windows allows remote attackers to cause a denial of service or execute arbitrary code via a lon… | Patch early | 10.0 high | 67.6% | 2008-04-01 |
| CVE-2006-6251 EXP | Stack-based buffer overflow in VUPlayer 2.44 and earlier allows remote attackers to execute arbitrary code via a long string in an M3U file, aka an "M… | Patch early | 7.5 high | 67.6% | 2006-12-04 |
| CVE-2012-4957 EXP | Absolute path traversal vulnerability in NFRAgent.exe in Novell File Reporter 1.0.2 allows remote attackers to read arbitrary files via a /FSF/CMD req… | Patch early | 7.8 high | 67.6% | 2012-11-18 |
| CVE-2014-0783 EXP | Stack-based buffer overflow in BKHOdeq.exe in Yokogawa CENTUM CS 3000 R3.09.50 and earlier allows remote attackers to execute arbitrary code via a cra… | Patch early | 9.0 high | 67.6% | 2014-03-14 |
| CVE-2017-8548 EXP | Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an attacker to obtain information to further comprom… | Patch early | 7.5 high | 67.6% | 2017-06-15 |
| CVE-2013-5014 EXP | The management console in Symantec Endpoint Protection Manager (SEPM) 11.0 before 11.0.7405.1424 and 12.1 before 12.1.4023.4080, and Symantec Protecti… | Patch early | 7.5 high | 67.6% | 2014-02-14 |
| CVE-2020-0610 EXP | A remote code execution vulnerability exists in Windows Remote Desktop Gateway (RD Gateway) when an unauthenticated attacker connects to the target sy… | Patch early | 9.8 critical | 67.6% | 2020-01-14 |
| CVE-2004-0396 EXP | Heap-based buffer overflow in CVS 1.11.x up to 1.11.15, and 1.12.x up to 1.12.7, when using the pserver mechanism allows remote attackers to execute a… | Patch early | 7.5 high | 67.5% | 2004-06-14 |
| CVE-2026-23744 EXP | MCPJam inspector is the local-first development platform for MCP servers. Versions 1.4.2 and earlier are vulnerable to remote code execution (RCE) vul… | Patch early | 9.8 critical | 67.5% | 2026-01-16 |
| CVE-2006-3524 EXP | Buffer overflow in SIPfoundry sipXtapi released before 20060324 allows remote attackers to execute arbitrary code via a long CSeq field value in an IN… | Patch early | 7.5 high | 67.5% | 2006-07-12 |
| CVE-2018-11646 EXP | webkitFaviconDatabaseSetIconForPageURL and webkitFaviconDatabaseSetIconURLForPageURL in UIProcess/API/glib/WebKitFaviconDatabase.cpp in WebKit, as use… | Patch early | 7.5 high | 67.5% | 2018-06-01 |
| CVE-2008-1602 EXP | Stack-based buffer overflow in Orbit downloader 2.6.3 and 2.6.4 allows remote attackers to execute arbitrary code via a long download URL, which is no… | Patch early | 10.0 high | 67.5% | 2008-04-06 |
| CVE-2014-1635 EXP | Buffer overflow in login.cgi in MiniHttpd in Belkin N750 Router with firmware before F9K1103_WW_1.10.17m allows remote attackers to execute arbitrary… | Patch early | 10.0 high | 67.5% | 2014-11-12 |
| CVE-2013-3628 EXP | Zabbix 2.0.9 has an Arbitrary Command Execution Vulnerability | Patch early | 8.8 high | 67.5% | 2020-02-07 |
| CVE-2007-3228 EXP | PHP remote file inclusion vulnerability in saf/lib/PEAR/PhpDocumentor/Documentation/tests/bug-559668.php in Sitellite CMS 4.2.12 and earlier might all… | Patch early | 6.8 medium | 67.5% | 2007-06-14 |
| CVE-2016-7237 EXP | Local Security Authority Subsystem Service (LSASS) in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Win… | Patch early | 6.5 medium | 67.5% | 2016-11-10 |
| CVE-2008-4687 EXP | manage_proj_page.php in Mantis before 1.1.4 allows remote authenticated users to execute arbitrary code via a sort parameter containing PHP sequences,… | Patch early | 9.0 high | 67.5% | 2008-10-22 |
| CVE-2006-5112 EXP | Buffer overflow in InterVations NaviCOPA Web Server 2.01 allows remote attackers to execute arbitrary code via a long HTTP GET request. | Patch early | 7.5 high | 67.4% | 2006-10-03 |
| CVE-2012-2953 EXP | The management console in Symantec Web Gateway 5.0.x before 5.0.3.18 allows remote attackers to execute arbitrary commands via crafted input to applic… | Patch early | 10.0 high | 67.4% | 2012-07-23 |
| CVE-2004-1626 EXP | Buffer overflow in Ability Server 2.34, and possibly other versions, allows remote attackers to execute arbitrary code via a long STOR command. | Patch early | 5.0 medium | 67.4% | 2004-10-22 |
| CVE-2018-8353 EXP | A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scripting Engin… | Patch early | 7.5 high | 67.3% | 2018-08-15 |
| CVE-2011-1260 EXP | Microsoft Internet Explorer 8 and 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a… | Patch early | 9.3 high | 67.3% | 2011-06-16 |
| CVE-2018-16858 EXP | It was found that libreoffice before versions 6.0.7 and 6.1.3 was vulnerable to a directory traversal attack which could be used to execute arbitrary… | Patch early | 7.8 high | 67.3% | 2019-03-25 |
| CVE-2010-1961 EXP | Buffer overflow in ovutil.dll in ovwebsnmpsrv.exe in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53 allows remote attackers to execute arbitr… | Patch early | 10.0 high | 67.3% | 2010-06-10 |
| CVE-2010-1960 EXP | Buffer overflow in the error handling functionality in ovwebsnmpsrv.exe in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53 allows remote attac… | Patch early | 10.0 high | 67.3% | 2010-06-10 |
| CVE-2010-1681 EXP | Buffer overflow in VISIODWG.DLL before 10.0.6880.4 in Microsoft Office Visio allows user-assisted remote attackers to execute arbitrary code via a cra… | Patch early | 7.6 high | 67.3% | 2010-05-06 |
| CVE-2006-6576 EXP | Heap-based buffer overflow in Golden FTP Server (goldenftpd) 1.92 allows remote attackers to cause a denial of service (application crash) and possibl… | Patch early | 7.5 high | 67.3% | 2006-12-15 |
| CVE-2020-24949 EXP | Privilege escalation in PHP-Fusion 9.03.50 downloads/downloads.php allows an authenticated user (not admin) to send a crafted request to the server an… | Patch early | 8.8 high | 67.3% | 2020-09-03 |
| CVE-2015-7765 EXP | ZOHO ManageEngine OpManager 11.5 build 11600 and earlier uses a hardcoded password of "plugin" for the IntegrationUser account, which allows remote au… | Patch early | 9.0 high | 67.3% | 2015-10-09 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt