CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
425,632 CVEs
1,781 on KEV
17,555 EPSS ≥ 10%
25,095 with exploits
synced 2026-11-13
12,664 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2015-8429 EXP | Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 o… | Patch early | 10.0 high | 43.4% | 2015-12-10 |
| CVE-2015-8422 EXP | Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 o… | Patch early | 10.0 high | 43.4% | 2015-12-10 |
| CVE-2015-8424 EXP | Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 o… | Patch early | 10.0 high | 43.4% | 2015-12-10 |
| CVE-2015-8421 EXP | Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 o… | Patch early | 10.0 high | 43.4% | 2015-12-10 |
| CVE-2015-8420 EXP | Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 o… | Patch early | 10.0 high | 43.4% | 2015-12-10 |
| CVE-2015-8431 EXP | Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 o… | Patch early | 10.0 high | 43.4% | 2015-12-10 |
| CVE-2015-8430 EXP | Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 o… | Patch early | 10.0 high | 43.4% | 2015-12-10 |
| CVE-2015-8423 EXP | Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 o… | Patch early | 10.0 high | 43.4% | 2015-12-10 |
| CVE-2015-2468 EXP | Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office for Mac 2011, Office for Mac 2016, Office Compatibili… | Patch early | 9.3 high | 43.4% | 2015-08-15 |
| CVE-2003-0003 EXP | Buffer overflow in the RPC Locator service for Microsoft Windows NT 4.0, Windows NT 4.0 Terminal Server Edition, Windows 2000, and Windows XP allows l… | Patch early | 7.5 high | 43.4% | 2003-02-07 |
| CVE-2015-5554 EXP | Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.19… | Patch early | 10.0 high | 43.4% | 2015-08-14 |
| CVE-2015-5558 EXP | Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.19… | Patch early | 10.0 high | 43.4% | 2015-08-14 |
| CVE-2015-5555 EXP | Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.19… | Patch early | 10.0 high | 43.4% | 2015-08-14 |
| CVE-2013-4710 EXP | Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly implement the WebView class, whic… | Patch early | 9.3 high | 43.4% | 2014-03-03 |
| CVE-2014-9567 EXP | Unrestricted file upload vulnerability in process-upload.php in ProjectSend (formerly cFTP) r100 through r561 allows remote attackers to execute arbit… | Patch early | 7.5 high | 43.3% | 2015-01-07 |
| CVE-2006-6561 EXP | Unspecified vulnerability in Microsoft Word 2000, 2002, and Word Viewer 2003 allows user-assisted remote attackers to execute arbitrary code via a cra… | Patch early | 9.3 high | 43.2% | 2006-12-14 |
| CVE-2011-1774 EXP | WebKit in Apple Safari before 5.0.6 has improper libxslt security settings, which allows remote attackers to create arbitrary files, and consequently… | Patch early | 8.8 high | 43.2% | 2011-07-21 |
| CVE-2015-1587 EXP | Unrestricted file upload vulnerability in file_to_index.php in Maarch LetterBox 2.8 and earlier and GEC/GED 1.4 and earlier allows remote attackers to… | Patch early | 7.5 high | 43.2% | 2015-02-19 |
| CVE-2013-3591 EXP | vTiger CRM 5.3 and 5.4: 'files' Upload Folder Arbitrary PHP Code Execution Vulnerability | Patch early | 8.8 high | 43.1% | 2020-02-07 |
| CVE-2013-3629 EXP | ISPConfig 3.0.5.2 has Arbitrary PHP Code Execution | Patch early | 8.8 high | 43.1% | 2020-02-07 |
| CVE-2003-0659 EXP | Buffer overflow in a function in User32.dll on Windows NT through Server 2003 allows local users to execute arbitrary code via long (1) LB_DIR message… | Patch early | 7.2 high | 43% | 2003-11-17 |
| CVE-2008-4841 EXP | The WordPad Text Converter for Word 97 files in Microsoft Windows 2000 SP4, XP SP2, and Server 2003 SP1 and SP2 allows remote attackers to execute arb… | Patch early | 9.3 high | 43% | 2008-12-10 |
| CVE-2014-1691 EXP | The framework/Util/lib/Horde/Variables.php script in the Util library in Horde before 5.1.1 allows remote attackers to conduct object injection attack… | Patch early | 7.5 high | 42.9% | 2014-04-01 |
| CVE-2005-1255 EXP | Multiple stack-based buffer overflows in the IMAP server in IMail 8.12 and 8.13 in Ipswitch Collaboration Suite (ICS), and other versions before IMail… | Patch early | 10.0 high | 42.8% | 2005-05-25 |
| CVE-2015-0273 EXP | Multiple use-after-free vulnerabilities in ext/date/php_date.c in PHP before 5.4.38, 5.5.x before 5.5.22, and 5.6.x before 5.6.6 allow remote attacker… | Patch early | 7.5 high | 42.8% | 2015-03-30 |
| CVE-2017-0088 EXP | Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to execute arbitrary code via… | Patch early | 8.8 high | 42.8% | 2017-03-17 |
| CVE-2005-4832 EXP | SQL injection vulnerability in the Oracle Database Server 10g allows remote authenticated users to execute arbitrary SQL commands with elevated privil… | Patch early | 7.5 high | 42.7% | 2005-12-31 |
| CVE-2009-1260 EXP | Multiple stack-based buffer overflows in UltraISO 9.3.3.2685 and earlier allow remote attackers to cause a denial of service (crash) or execute arbitr… | Patch early | 9.3 high | 42.7% | 2009-04-07 |
| CVE-2010-1818 EXP | The IPersistPropertyBag2::Read function in QTPlugin.ocx in Apple QuickTime 6.x, 7.x before 7.6.8, and other versions allows remote attackers to execut… | Patch early | 9.3 high | 42.7% | 2010-08-31 |
| CVE-2018-0114 EXP | A vulnerability in the Cisco node-jose open source library before 0.11.0 could allow an unauthenticated, remote attacker to re-sign tokens using a key… | Patch early | 7.5 high | 42.7% | 2018-01-04 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt