CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
398,831 CVEs
1,728 on KEV
17,272 EPSS ≥ 10%
25,086 with exploits
synced 2026-09-28
25,086 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2013-4798 EXP | Unspecified vulnerability in HP LoadRunner before 11.52 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1705. | Patch early | 10.0 high | 67% | 2013-07-29 |
| CVE-2006-1016 EXP | Buffer overflow in the IsComponentInstalled method in Internet Explorer 6.0, when used on Windows 2000 before SP4 or Windows XP before SP1, allows rem… | Patch early | 7.5 high | 67% | 2006-03-07 |
| CVE-2015-0816 EXP | Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 do not properly restrict resource: URLs, which makes it easier… | Patch early | 5.0 medium | 66.9% | 2015-04-01 |
| CVE-2016-7237 EXP | Local Security Authority Subsystem Service (LSASS) in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Win… | Patch early | 6.5 medium | 66.9% | 2016-11-10 |
| CVE-2016-7190 EXP | The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via… | Patch early | 7.5 high | 66.9% | 2016-10-14 |
| CVE-2017-8601 EXP | Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow an attacker to execute arbitrary code in the context… | Patch early | 7.5 high | 66.9% | 2017-07-11 |
| CVE-2006-5112 EXP | Buffer overflow in InterVations NaviCOPA Web Server 2.01 allows remote attackers to execute arbitrary code via a long HTTP GET request. | Patch early | 7.5 high | 66.9% | 2006-10-03 |
| CVE-2013-7260 EXP | Multiple stack-based buffer overflows in RealNetworks RealPlayer before 17.0.4.61 on Windows, and Mac RealPlayer before 12.0.1.1738, allow remote atta… | Patch early | 7.5 high | 66.9% | 2014-01-03 |
| CVE-2019-6443 EXP | An issue was discovered in NTPsec before 1.1.3. Because of a bug in ctl_getitem, there is a stack-based buffer over-read in read_sysvars in ntp_contro… | Patch early | 9.1 critical | 66.9% | 2019-01-16 |
| CVE-2018-0953 EXP | A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka "Scripting Engine M… | Patch early | 7.5 high | 66.8% | 2018-05-09 |
| CVE-2018-8139 EXP | A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka "Scripting Engine M… | Patch early | 7.5 high | 66.8% | 2018-05-09 |
| CVE-2006-3952 EXP | Stack-based buffer overflow in EFS Software Easy File Sharing FTP Server 2.0 allows remote attackers to execute arbitrary code via a long argument to… | Patch early | 7.5 high | 66.8% | 2006-08-01 |
| CVE-2012-2962 EXP | SQL injection vulnerability in d4d/statusFilter.php in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.2 allows remote authenticated us… | Patch early | 6.5 medium | 66.8% | 2012-07-30 |
| CVE-2005-4267 EXP | Stack-based buffer overflow in Qualcomm WorldMail 3.0 allows remote attackers to execute arbitrary code via a long IMAP command that ends with a "}" c… | Patch early | 7.5 high | 66.8% | 2005-12-21 |
| CVE-2017-11394 EXP | Proxy command injection vulnerability in Trend Micro OfficeScan 11 and XG (12) allows remote attackers to execute arbitrary code on vulnerable install… | Patch early | 9.8 critical | 66.8% | 2017-08-03 |
| CVE-2007-1404 EXP | tftpd.exe in ProSysInfo TFTP Server TFTPDWIN 0.4.2 allows remote attackers to cause a denial of service via a long UDP packet that is not properly han… | Patch early | 7.3 high | 66.7% | 2007-03-10 |
| CVE-2015-2049 EXP | Unrestricted file upload vulnerability in D-Link DCS-931L with firmware 1.04 and earlier allows remote authenticated users to execute arbitrary code b… | Patch early | 9.0 high | 66.7% | 2015-02-23 |
| CVE-2017-7411 EXP | An issue was discovered in Enalean Tuleap 9.6 and prior versions. The vulnerability exists because the User::getRecentElements() method is using the u… | Patch early | 8.8 high | 66.6% | 2017-10-30 |
| CVE-2002-1120 EXP | Buffer overflow in Savant Web Server 3.1 and earlier allows remote attackers to execute arbitrary code via a long HTTP GET request. | Patch early | 7.5 high | 66.6% | 2002-09-24 |
| CVE-2013-3576 EXP | ginkgosnmp.inc in HP System Management Homepage (SMH) allows remote authenticated users to execute arbitrary commands via shell metacharacters in the… | Patch early | 9.0 high | 66.6% | 2013-06-14 |
| CVE-2015-6133 EXP | Microsoft Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 Gold and 1511 mishandle library loading, wh… | Patch early | 7.2 high | 66.6% | 2015-12-09 |
| CVE-2004-0363 EXP | Stack-based buffer overflow in the SymSpamHelper ActiveX component (symspam.dll) in Norton AntiSpam 2004, as used in Norton Internet Security 2004, al… | Patch early | 7.5 high | 66.6% | 2004-04-15 |
| CVE-2009-0183 EXP | Stack-based buffer overflow in Remote Control Server in Free Download Manager (FDM) 2.5 Build 758 and 3.0 Build 844 allows remote attackers to execute… | Patch early | 10.0 high | 66.5% | 2009-02-03 |
| CVE-2008-4844 EXP | Use-after-free vulnerability in the CRecordInstance::TransferToDestination function in mshtml.dll in Microsoft Internet Explorer 5.01, 6, 6 SP1, and 7… | Patch early | 9.3 high | 66.5% | 2008-12-11 |
| CVE-2005-0478 EXP | Multiple buffer overflows in TrackerCam 5.12 and earlier allow remote attackers to cause a denial of service and possibly execute arbitrary code via (… | Patch early | 5.0 medium | 66.5% | 2005-03-30 |
| CVE-2016-7240 EXP | The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corrup… | Patch early | 7.5 high | 66.5% | 2016-11-10 |
| CVE-2013-4730 EXP | Buffer overflow in PCMan's FTP Server 2.0.7 allows remote attackers to execute arbitrary code via a long string in a USER command. | Patch early | 10.0 high | 66.5% | 2014-05-15 |
| CVE-2012-6096 EXP | Multiple stack-based buffer overflows in the get_history function in history.cgi in Nagios Core before 3.4.4, and Icinga 1.6.x before 1.6.2, 1.7.x bef… | Patch early | 7.5 high | 66.5% | 2013-01-22 |
| CVE-2021-32172 EXP | Maian Cart v3.8 contains a preauthorization remote code execution (RCE) exploit via a broken access control issue in the Elfinder plugin. | Patch early | 9.8 critical | 66.4% | 2021-10-07 |
| CVE-2007-6377 EXP | Stack-based buffer overflow in the PassThru functionality in ext.dll in BadBlue 2.72b and earlier allows remote attackers to execute arbitrary code vi… | Patch early | 7.5 high | 66.4% | 2007-12-15 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt