CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
425,632 CVEs
1,781 on KEV
17,555 EPSS ≥ 10%
25,095 with exploits
synced 2026-11-13
10,150 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2011-1487 EXP | The (1) lc, (2) lcfirst, (3) uc, and (4) ucfirst functions in Perl 5.10.x, 5.11.x, and 5.12.x through 5.12.3, and 5.13.x through 5.13.11, do not apply… | Patch early | 5.0 medium | 10.6% | 2011-04-11 |
| CVE-2006-3472 EXP | Microsoft Internet Explorer 6.0 and 6.0 SP1 allows remote attackers to cause a denial of service via an HTML page with an A tag containing a long titl… | Patch early | 5.0 medium | 10.6% | 2006-07-10 |
| CVE-2007-6325 EXP | PHP remote file inclusion vulnerability in adminbereich/designconfig.php in Fastpublish CMS 1.9999 allows remote attackers to execute arbitrary PHP co… | Patch early | 6.8 medium | 10.6% | 2007-12-13 |
| CVE-2006-6811 EXP | KsIRC 1.3.12 allows remote attackers to cause a denial of service (crash) via a long PRIVMSG string when connecting to an Internet Relay Chat (IRC) se… | Patch early | 6.5 medium | 10.6% | 2006-12-29 |
| CVE-2012-6499 EXP | Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows remote attackers to redirect u… | Patch early | 5.8 medium | 10.6% | 2013-01-12 |
| CVE-2010-3573 EXP | Unspecified vulnerability in the Networking component in Oracle Java SE and Java for Business 6 Update 21 and 5.0 Update 25 allows remote attackers to… | Patch early | 5.1 medium | 10.6% | 2010-10-19 |
| CVE-2010-2621 EXP | The QSslSocketBackendPrivate::transmit function in src_network_ssl_qsslsocket_openssl.cpp in Qt 4.6.3 and earlier allows remote attackers to cause a d… | Patch early | 5.0 medium | 10.5% | 2010-07-02 |
| CVE-2001-0557 EXP | T. Hauck Jana Webserver 1.46 and earlier allows a remote attacker to view arbitrary files via a '..' (dot dot) attack which is URL encoded (%2e%2e). | Patch early | 5.0 medium | 10.5% | 2001-08-14 |
| CVE-2019-0612 EXP | A security feature bypass vulnerability exists when Click2Play protection in Microsoft Edge improperly handles flash objects. By itself, this bypass v… | Patch early | 5.3 medium | 10.5% | 2019-04-08 |
| CVE-2021-31682 EXP | The login portal for the Automated Logic WebCTRL/WebCTRL OEM web application contains a vulnerability that allows for reflected XSS attacks due to the… | Patch early | 6.1 medium | 10.5% | 2021-10-22 |
| CVE-2012-0698 EXP | tcsd in TrouSerS before 0.3.10 allows remote attackers to cause a denial of service (daemon crash) via a crafted type_offset value in a TCP packet to… | Patch early | 5.0 medium | 10.5% | 2012-11-26 |
| CVE-2012-3796 EXP | Pro-face WinGP PC Runtime 3.1.00 and earlier, and ProServr.exe in Pro-face Pro-Server EX 1.30.000 and earlier, allows remote attackers to obtain sensi… | Patch early | 5.0 medium | 10.5% | 2012-06-25 |
| CVE-2006-0354 EXP | Cisco IOS before 12.3-7-JA2 on Aironet Wireless Access Points (WAP) allows remote authenticated users to cause a denial of service (termination of pac… | Patch early | 5.5 medium | 10.5% | 2006-01-22 |
| CVE-2014-0995 EXP | The Standalone Enqueue Server in SAP Netweaver 7.20, 7.01, and earlier allows remote attackers to cause a denial of service (uncontrolled recursion an… | Patch early | 5.0 medium | 10.5% | 2014-11-06 |
| CVE-2013-4474 EXP | Format string vulnerability in the extractPages function in utils/pdfseparate.cc in poppler before 0.24.3 allows remote attackers to cause a denial of… | Patch early | 5.0 medium | 10.5% | 2013-11-23 |
| CVE-2020-25820 EXP | BigBlueButton before 2.2.7 allows remote authenticated users to read local files and conduct SSRF attacks via an uploaded Office document that has a c… | Patch early | 6.5 medium | 10.5% | 2020-10-21 |
| CVE-2008-2719 EXP | Off-by-one error in the ppscan function (preproc.c) in Netwide Assembler (NASM) 2.02 allows context-dependent attackers to cause a denial of service (… | Patch early | 6.8 medium | 10.5% | 2008-06-16 |
| CVE-2019-7272 EXP | Optergy Proton/Enterprise devices allow Username Disclosure. | Patch early | 5.3 medium | 10.5% | 2019-07-01 |
| CVE-2004-2549 EXP | Nortel Wireless LAN (WLAN) Access Point (AP) 2220, 2221, and 2225 allow remote attackers to cause a denial of service (service crash) via a TCP reques… | Patch early | 5.0 medium | 10.5% | 2004-12-31 |
| CVE-2020-23839 EXP | A Reflected Cross-Site Scripting (XSS) vulnerability in GetSimple CMS v3.3.16, in the admin/index.php login portal webpage, allows remote attackers to… | Patch early | 6.1 medium | 10.5% | 2020-09-01 |
| CVE-2000-1061 EXP | Microsoft Virtual Machine (VM) in Internet Explorer 4.x and 5.x allows an unsigned applet to create and use ActiveX controls, which allows a remote at… | Patch early | 5.1 medium | 10.5% | 2000-12-11 |
| CVE-2012-4768 EXP | Cross-site scripting (XSS) vulnerability in the Download Monitor plugin before 3.3.5.9 for WordPress allows remote attackers to inject arbitrary web s… | Patch early | 4.3 medium | 10.5% | 2014-09-04 |
| CVE-2010-1152 EXP | memcached.c in memcached before 1.4.3 allows remote attackers to cause a denial of service (daemon hang or crash) via a long line that triggers excess… | Patch early | 5.0 medium | 10.4% | 2010-04-12 |
| CVE-2013-1596 EXP | An Authentication Bypass Vulnerability exists in Vivotek PT7135 IP Camera 0300a and 0400a via specially crafted RTSP packets to TCP port 554. | Patch early | 5.3 medium | 10.4% | 2020-01-24 |
| CVE-2015-6830 EXP | libraries/plugins/auth/AuthenticationCookie.class.php in phpMyAdmin 4.3.x before 4.3.13.2 and 4.4.x before 4.4.14.1 allows remote attackers to bypass… | Patch early | 5.0 medium | 10.4% | 2015-09-14 |
| CVE-2006-1931 EXP | The HTTP/XMLRPC server in Ruby before 1.8.2 uses blocking sockets, which allows attackers to cause a denial of service (blocked connections) via a lar… | Patch early | 5.0 medium | 10.4% | 2006-04-20 |
| CVE-2011-5181 EXP | Cross-site scripting (XSS) vulnerability in clickdesk.php in ClickDesk Live Support - Live Chat plugin 2.0 for WordPress allows remote attackers to in… | Patch early | 4.3 medium | 10.4% | 2012-09-20 |
| CVE-2015-4616 EXP | Directory traversal vulnerability in includes/MapPinImageSave.php in the Easy2Map plugin before 1.2.5 for WordPress allows remote attackers to create… | Patch early | 5.0 medium | 10.4% | 2015-07-08 |
| CVE-2012-3588 EXP | Directory traversal vulnerability in preview.php in the Plugin Newsletter plugin 1.5 for WordPress allows remote attackers to read arbitrary files via… | Patch early | 5.0 medium | 10.4% | 2012-06-19 |
| CVE-2004-0270 EXP | libclamav in Clam AntiVirus 0.65 allows remote attackers to cause a denial of service (crash) via a uuencoded e-mail message with an invalid line leng… | Patch early | 5.0 medium | 10.4% | 2004-11-23 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt