CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
398,831 CVEs
1,728 on KEV
17,272 EPSS ≥ 10%
25,086 with exploits
synced 2026-09-28
25,086 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2013-2347 EXP | The Backup Client Service (OmniInet.exe) in HP Storage Data Protector 6.2X allows remote attackers to execute arbitrary commands or cause a denial of… | Patch early | 10.0 high | 66.4% | 2014-01-04 |
| CVE-2014-6593 EXP | Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25; Java SE Embedded 7u71 and 8u6; and JRockit 27.8.4 and 28.3.4 allows remote a… | Patch early | 4.0 medium | 66.4% | 2015-01-21 |
| CVE-2017-14496 EXP | Integer underflow in the add_pseudoheader function in dnsmasq before 2.78 , when the --add-mac, --add-cpe-id or --add-subnet option is specified, allo… | Patch early | 7.5 high | 66.3% | 2017-10-03 |
| CVE-2018-0933 EXP | ChakraCore and Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the Chakra scriptin… | Patch early | 7.5 high | 66.3% | 2018-03-14 |
| CVE-2018-0980 EXP | A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scri… | Patch early | 7.5 high | 66.3% | 2018-04-12 |
| CVE-2021-37425 EXP | Altova MobileTogether Server before 7.3 SP1 allows XXE attacks, such as an InfoSetChanges/Changes attack against /workflowmanagement, or reading mobil… | Patch early | 9.1 critical | 66.3% | 2021-08-10 |
| CVE-2013-3205 EXP | Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craft… | Patch early | 9.3 high | 66.3% | 2013-09-11 |
| CVE-2012-2926 EXP | Atlassian JIRA before 5.0.1; Confluence before 3.5.16, 4.0 before 4.0.7, and 4.1 before 4.1.10; FishEye and Crucible before 2.5.8, 2.6 before 2.6.8, a… | Patch early | 9.1 critical | 66.3% | 2012-05-22 |
| CVE-2018-0934 EXP | ChakraCore and Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the Chakra scriptin… | Patch early | 7.5 high | 66.2% | 2018-03-14 |
| CVE-2018-7284 EXP | A Buffer Overflow issue was discovered in Asterisk through 13.19.1, 14.x through 14.7.5, and 15.x through 15.2.1, and Certified Asterisk through 13.18… | Patch early | 7.5 high | 66.2% | 2018-02-22 |
| CVE-2007-0213 EXP | Microsoft Exchange Server 2000 SP3, 2003 SP1 and SP2, and 2007 does not properly decode certain MIME encoded e-mails, which allows remote attackers to… | Patch early | 10.0 high | 66.2% | 2007-05-08 |
| CVE-2007-3522 EXP | Multiple PHP remote file inclusion vulnerabilities in sPHPell 1.01 allow remote attackers to execute arbitrary PHP code via a URL in the SpellIncPath… | Patch early | 6.8 medium | 66.2% | 2007-07-03 |
| CVE-2017-6360 EXP | QNAP QTS before 4.2.4 Build 20170313 allows attackers to gain administrator privileges and obtain sensitive information via unspecified vectors. | Patch early | 9.8 critical | 66.1% | 2017-03-23 |
| CVE-2010-1964 EXP | Buffer overflow in ovwebsnmpsrv.exe in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53 allows remote attackers to execute arbitrary code via u… | Patch early | 7.5 high | 66.1% | 2010-06-17 |
| CVE-2005-1272 EXP | Stack-based buffer overflow in the Backup Agent for Microsoft SQL Server in BrightStor ARCserve Backup Agent for SQL Server 11.0 allows remote attacke… | Patch early | 7.5 high | 66.1% | 2005-08-05 |
| CVE-2005-1543 EXP | Multiple stack-based and heap-based buffer overflows in Remote Management authentication (zenrem32.exe) on Novell ZENworks 6.5 Desktop and Server Mana… | Patch early | 7.5 high | 66.1% | 2005-05-25 |
| CVE-2007-3566 EXP | Stack-based buffer overflow in the database service (ibserver.exe) in Borland InterBase 2007 before SP2 allows remote attackers to execute arbitrary c… | Patch early | 7.5 high | 66.1% | 2007-07-26 |
| CVE-2011-3175 EXP | Stack-based buffer overflow in the Preboot Service in Novell ZENworks Configuration Management (ZCM) 11.1 and 11.1a allows remote attackers to execute… | Patch early | 10.0 high | 66.1% | 2012-04-09 |
| CVE-2004-0636 EXP | Buffer overflow in the goaway function in the aim:goaway URI handler for AOL Instant Messenger (AIM) 5.5, including 5.5.3595, allows remote attackers… | Patch early | 10.0 high | 66% | 2004-11-23 |
| CVE-2019-12181 EXP | A privilege escalation vulnerability exists in SolarWinds Serv-U before 15.1.7 for Linux. | Patch early | 8.8 high | 66% | 2019-06-17 |
| CVE-2015-5560 EXP | Integer overflow in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR… | Patch early | 10.0 high | 66% | 2015-08-14 |
| CVE-2025-55315 EXP | Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an authorized attacker to bypass a security fe… | Patch early | 9.9 critical | 65.9% | 2025-10-14 |
| CVE-2009-1350 EXP | Unspecified vulnerability in xtagent.exe in Novell NetIdentity Client before 1.2.4 allows remote attackers to execute arbitrary code by establishing a… | Patch early | 10.0 high | 65.9% | 2009-04-21 |
| CVE-2005-4085 EXP | Buffer overflow in BlueCoat (a) WinProxy before 6.1a and (b) the web console access functionality in ProxyAV before 2.4.2.3 allows remote attackers to… | Patch early | 7.5 high | 65.9% | 2005-12-31 |
| CVE-2013-6194 EXP | Unspecified vulnerability in HP Storage Data Protector 6.2X allows remote attackers to execute arbitrary code or cause a denial of service via unknown… | Patch early | 10.0 high | 65.9% | 2014-01-04 |
| CVE-2010-1554 EXP | Stack-based buffer overflow in getnnmdata.exe in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allows remote attackers to execute arb… | Patch early | 10.0 high | 65.9% | 2010-05-13 |
| CVE-2006-6184 EXP | Multiple stack-based buffer overflows in Allied Telesyn TFTP Server (AT-TFTP) 1.9, and possibly earlier, allow remote attackers to cause a denial of s… | Patch early | 10.0 high | 65.9% | 2006-12-01 |
| CVE-2019-10123 EXP | SQL Injection in Advanced InfoData Systems (AIS) ESEL-Server 67 (which is the backend for the AIS logistics mobile app) allows an anonymous attacker t… | Patch early | 9.8 critical | 65.9% | 2019-05-31 |
| CVE-2021-39316 EXP | The Zoomsounds plugin <= 6.45 for WordPress allows arbitrary files, including sensitive configuration files such as wp-config.php, to be downloaded vi… | Patch early | 7.5 high | 65.8% | 2021-08-31 |
| CVE-2013-1362 EXP | Incomplete blacklist vulnerability in nrpc.c in Nagios Remote Plug-In Executor (NRPE) before 2.14 might allow remote attackers to execute arbitrary sh… | Patch early | 7.5 high | 65.7% | 2013-07-09 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt