CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
425,731 CVEs
1,781 on KEV
17,555 EPSS ≥ 10%
25,095 with exploits
synced 2026-11-14
25,095 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2007-5208 EXP | hpssd in Hewlett-Packard Linux Imaging and Printing Project (hplip) 1.x and 2.x before 2.7.10 allows context-dependent attackers to execute arbitrary… | Patch early | 7.6 high | 67.3% | 2007-10-13 |
| CVE-2007-5003 EXP | Multiple stack-based buffer overflows in CA (Computer Associates) BrightStor ARCserve Backup for Laptops and Desktops r11.0 through r11.5 allow remote… | Patch early | 10.0 high | 67.2% | 2007-10-01 |
| CVE-2006-5650 EXP | The ICQPhone.SipxPhoneManager ActiveX control in America Online ICQ 5.1 allows remote attackers to download and execute arbitrary code via the Downloa… | Patch early | 7.5 high | 67.2% | 2006-11-07 |
| CVE-2025-55315 EXP | Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an authorized attacker to bypass a security fe… | Patch early | 9.9 critical | 67.2% | 2025-10-14 |
| CVE-2012-0694 EXP | SugarCRM CE <= 6.3.1 contains scripts that use "unserialize()" with user controlled input which allows remote attackers to execute arbitrary PHP code. | Patch early | 9.8 critical | 67.1% | 2019-10-29 |
| CVE-2004-0176 EXP | Multiple buffer overflows in Ethereal 0.8.13 to 0.10.2 allow remote attackers to cause a denial of service and possibly execute arbitrary code via the… | Patch early | 5.0 medium | 67.1% | 2004-05-04 |
| CVE-2019-13101 EXP | An issue was discovered on D-Link DIR-600M 3.02, 3.03, 3.04, and 3.06 devices. wan.htm can be accessed directly without authentication, which can lead… | Patch early | 9.8 critical | 67.1% | 2019-08-08 |
| CVE-1999-1510 EXP | Buffer overflows in Bisonware FTP server prior to 4.1 allow remote attackers to cause a denial of service, and possibly execute arbitrary commands, vi… | Patch early | 7.5 high | 67.1% | 1999-05-17 |
| CVE-2010-1552 EXP | Stack-based buffer overflow in the doLoad function in snmpviewer.exe in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allows remote a… | Patch early | 10.0 high | 67.1% | 2010-05-13 |
| CVE-2004-1050 EXP | Heap-based buffer overflow in Internet Explorer 6 allows remote attackers to execute arbitrary code via long (1) SRC or (2) NAME attributes in IFRAME,… | Patch early | 10.0 high | 67.1% | 2004-12-31 |
| CVE-2009-0133 EXP | Buffer overflow in Microsoft HTML Help Workshop 4.74 and earlier allows context-dependent attackers to execute arbitrary code via a .hhp file with a l… | Patch early | 10.0 high | 67% | 2009-01-15 |
| CVE-2013-4988 EXP | Stack-based buffer overflow in IcoFX 2.5 and earlier allows remote attackers to execute arbitrary code via a long idCount value in an ICONDIR structur… | Patch early | 9.3 high | 67% | 2013-12-13 |
| CVE-2011-1566 EXP | Directory traversal vulnerability in dc.exe 9.00.00.11059 and earlier in 7-Technologies Interactive Graphical SCADA System (IGSS) allows remote attack… | Patch early | 10.0 high | 67% | 2011-04-05 |
| CVE-2009-4179 EXP | Stack-based buffer overflow in ovalarm.exe in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allows remote attackers to execute arbitr… | Patch early | 10.0 high | 67% | 2009-12-10 |
| CVE-2013-4798 EXP | Unspecified vulnerability in HP LoadRunner before 11.52 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1705. | Patch early | 10.0 high | 67% | 2013-07-29 |
| CVE-2006-1016 EXP | Buffer overflow in the IsComponentInstalled method in Internet Explorer 6.0, when used on Windows 2000 before SP4 or Windows XP before SP1, allows rem… | Patch early | 7.5 high | 67% | 2006-03-07 |
| CVE-2016-7190 EXP | The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via… | Patch early | 7.5 high | 66.9% | 2016-10-14 |
| CVE-2017-8601 EXP | Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow an attacker to execute arbitrary code in the context… | Patch early | 7.5 high | 66.9% | 2017-07-11 |
| CVE-2013-7260 EXP | Multiple stack-based buffer overflows in RealNetworks RealPlayer before 17.0.4.61 on Windows, and Mac RealPlayer before 12.0.1.1738, allow remote atta… | Patch early | 7.5 high | 66.9% | 2014-01-03 |
| CVE-2019-6443 EXP | An issue was discovered in NTPsec before 1.1.3. Because of a bug in ctl_getitem, there is a stack-based buffer over-read in read_sysvars in ntp_contro… | Patch early | 9.1 critical | 66.9% | 2019-01-16 |
| CVE-2006-3952 EXP | Stack-based buffer overflow in EFS Software Easy File Sharing FTP Server 2.0 allows remote attackers to execute arbitrary code via a long argument to… | Patch early | 7.5 high | 66.8% | 2006-08-01 |
| CVE-2006-6184 EXP | Multiple stack-based buffer overflows in Allied Telesyn TFTP Server (AT-TFTP) 1.9, and possibly earlier, allow remote attackers to cause a denial of s… | Patch early | 10.0 high | 66.8% | 2006-12-01 |
| CVE-2012-2962 EXP | SQL injection vulnerability in d4d/statusFilter.php in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.2 allows remote authenticated us… | Patch early | 6.5 medium | 66.8% | 2012-07-30 |
| CVE-2005-4267 EXP | Stack-based buffer overflow in Qualcomm WorldMail 3.0 allows remote attackers to execute arbitrary code via a long IMAP command that ends with a "}" c… | Patch early | 7.5 high | 66.8% | 2005-12-21 |
| CVE-2017-11394 EXP | Proxy command injection vulnerability in Trend Micro OfficeScan 11 and XG (12) allows remote attackers to execute arbitrary code on vulnerable install… | Patch early | 9.8 critical | 66.8% | 2017-08-03 |
| CVE-2013-4730 EXP | Buffer overflow in PCMan's FTP Server 2.0.7 allows remote attackers to execute arbitrary code via a long string in a USER command. | Patch early | 10.0 high | 66.7% | 2014-05-15 |
| CVE-2015-2049 EXP | Unrestricted file upload vulnerability in D-Link DCS-931L with firmware 1.04 and earlier allows remote authenticated users to execute arbitrary code b… | Patch early | 9.0 high | 66.7% | 2015-02-23 |
| CVE-2018-8145 EXP | An information disclosure vulnerability exists when Chakra improperly discloses the contents of its memory, which could provide an attacker with infor… | Patch early | 7.5 high | 66.6% | 2018-05-09 |
| CVE-2002-1120 EXP | Buffer overflow in Savant Web Server 3.1 and earlier allows remote attackers to execute arbitrary code via a long HTTP GET request. | Patch early | 7.5 high | 66.6% | 2002-09-24 |
| CVE-2013-3576 EXP | ginkgosnmp.inc in HP System Management Homepage (SMH) allows remote authenticated users to execute arbitrary commands via shell metacharacters in the… | Patch early | 9.0 high | 66.6% | 2013-06-14 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt