CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
398,882 CVEs
1,728 on KEV
17,272 EPSS ≥ 10%
25,086 with exploits
synced 2026-09-28
12,661 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2013-0209 EXP | lib/MT/Upgrade.pm in mt-upgrade.cgi in Movable Type 4.2x and 4.3x through 4.38 does not require authentication for requests to database-migration func… | Patch early | 7.5 high | 45.2% | 2013-01-23 |
| CVE-2008-5789 EXP | Multiple PHP remote file inclusion vulnerabilities in the Recly Interactive Feederator (com_feederator) component 1.0.5 for Joomla! allow remote attac… | Patch early | 7.5 high | 45% | 2008-12-31 |
| CVE-2007-0927 EXP | Heap-based buffer overflow in uTorrent 1.6 allows remote attackers to execute arbitrary code via a torrent file with a crafted announce header. | Patch early | 7.5 high | 45% | 2007-02-14 |
| CVE-2018-8619 EXP | A remote code execution vulnerability exists when the Internet Explorer VBScript execution policy does not properly restrict VBScript under specific c… | Patch early | 7.5 high | 44.8% | 2018-12-12 |
| CVE-2008-0144 EXP | PHP remote file inclusion vulnerability in index.php in NetRisk 1.9.7 and earlier allows remote attackers to execute arbitrary PHP code via a URL in t… | Patch early | 7.5 high | 44.8% | 2008-01-08 |
| CVE-2003-0150 EXP | MySQL 3.23.55 and earlier creates world-writeable files and allows mysql users to gain root privileges by using the "SELECT * INFO OUTFILE" operator t… | Patch early | 9.0 high | 44.8% | 2003-03-24 |
| CVE-2015-5561 EXP | Use-after-free vulnerability in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199… | Patch early | 10.0 high | 44.8% | 2015-08-14 |
| CVE-2015-5550 EXP | Use-after-free vulnerability in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199… | Patch early | 10.0 high | 44.8% | 2015-08-14 |
| CVE-2015-5551 EXP | Use-after-free vulnerability in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199… | Patch early | 10.0 high | 44.8% | 2015-08-14 |
| CVE-2015-5557 EXP | Use-after-free vulnerability in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199… | Patch early | 10.0 high | 44.8% | 2015-08-14 |
| CVE-2015-5556 EXP | Use-after-free vulnerability in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199… | Patch early | 10.0 high | 44.8% | 2015-08-14 |
| CVE-2007-6165 EXP | Mail in Apple Mac OS X Leopard (10.5.1) allows user-assisted remote attackers to execute arbitrary code via an AppleDouble attachment containing an ap… | Patch early | 9.3 high | 44.7% | 2007-11-29 |
| CVE-2003-0469 EXP | Buffer overflow in the HTML Converter (HTML32.cnv) on various Windows operating systems allows remote attackers to cause a denial of service (crash) a… | Patch early | 7.5 high | 44.6% | 2003-08-07 |
| CVE-2019-11932 EXP | A double free vulnerability in the DDGifSlurp function in decoding.c in the android-gif-drawable library before version 1.2.18, as used in WhatsApp fo… | Patch early | 8.8 high | 44.5% | 2019-10-03 |
| CVE-2016-3301 EXP | The Windows font library in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and… | Patch early | 7.8 high | 44.5% | 2016-08-09 |
| CVE-2007-2167 EXP | Static code injection vulnerability in process.php in AimStats 3.2 allows remote attackers to inject PHP code into config.php via the number parameter… | Patch early | 7.5 high | 44.4% | 2007-04-22 |
| CVE-2018-10201 EXP | An issue was discovered in NcMonitorServer.exe in NC Monitor Server in NComputing vSpace Pro 10 and 11. It is possible to read arbitrary files outside… | Patch early | 7.5 high | 44.4% | 2018-04-20 |
| CVE-2015-5562 EXP | Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.19… | Patch early | 10.0 high | 44.4% | 2015-08-14 |
| CVE-2007-3111 EXP | Buffer overflow in the Provideo Camimage ActiveX control in ISSCamControl.dll 1.0.1.5, when Internet Explorer 6 is used on Windows 2000 SP4, allows re… | Patch early | 10.0 high | 44.4% | 2007-06-07 |
| CVE-2018-16299 EXP | The Localize My Post plugin 1.0 for WordPress allows Directory Traversal via the ajax/include.php file parameter. | Patch early | 7.5 high | 44.4% | 2018-09-24 |
| CVE-2005-3792 EXP | Multiple SQL injection vulnerabilities in the Search module in PHP-Nuke 7.8, and possibly other versions before 7.9 with patch 3.1, allows remote atta… | Patch early | 7.5 high | 44.3% | 2005-11-24 |
| CVE-2012-2611 EXP | The DiagTraceR3Info function in the Dialog processor in disp+work.exe 7010.29.15.58313 and 7200.70.18.23869 in the Dispatcher in SAP NetWeaver 7.0 EHP… | Patch early | 9.3 high | 44.3% | 2012-05-15 |
| CVE-2008-4726 EXP | Stack-based buffer overflow in the SFTP subsystem in GoodTech SSH 6.4 allows remote authenticated users to execute arbitrary code via a long string to… | Patch early | 9.0 high | 44.3% | 2008-10-24 |
| CVE-2008-1060 EXP | Eval injection vulnerability in modules/execute.php in the Sniplets 1.1.2 and 1.2.2 plugin for WordPress allows remote attackers to execute arbitrary… | Patch early | 7.5 high | 44.2% | 2008-02-28 |
| CVE-2012-3815 EXP | Buffer overflow in RunTime.exe in Sielco Sistemi Winlog Pro SCADA before 2.07.18 and Winlog Lite SCADA before 2.07.18 allows remote attackers to execu… | Patch early | 9.3 high | 44.2% | 2012-06-27 |
| CVE-2015-1587 EXP | Unrestricted file upload vulnerability in file_to_index.php in Maarch LetterBox 2.8 and earlier and GEC/GED 1.4 and earlier allows remote attackers to… | Patch early | 7.5 high | 44.2% | 2015-02-19 |
| CVE-2007-4474 EXP | Multiple stack-based buffer overflows in the IBM Lotus Domino Web Access ActiveX control, as provided by inotes6.dll, inotes6w.dll, dwa7.dll, and dwa7… | Patch early | 9.3 high | 44.2% | 2007-12-27 |
| CVE-2023-24709 EXP | An issue found in Paradox Security Systems IPR512 allows attackers to cause a denial of service via the login.html and login.xml parameters. | Patch early | 7.5 high | 44.2% | 2023-03-21 |
| CVE-2012-1775 EXP | Stack-based buffer overflow in VideoLAN VLC media player before 2.0.1 allows remote attackers to execute arbitrary code via a crafted MMS:// stream. | Patch early | 9.3 high | 44.1% | 2012-03-19 |
| CVE-2018-15710 EXP | Nagios XI 5.5.6 allows local authenticated attackers to escalate privileges to root via Autodiscover_new.php. | Patch early | 7.8 high | 44.1% | 2018-11-14 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt