CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
398,903 CVEs
1,728 on KEV
17,272 EPSS ≥ 10%
25,086 with exploits
synced 2026-09-29
25,086 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2004-0574 EXP | The Network News Transfer Protocol (NNTP) component of Microsoft Windows NT Server 4.0, Windows 2000 Server, Windows Server 2003, Exchange 2000 Server… | Patch early | 10.0 high | 64.4% | 2004-11-03 |
| CVE-2017-11764 EXP | Microsoft Edge in Microsoft Windows 10 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current… | Patch early | 7.5 high | 64.4% | 2017-09-13 |
| CVE-2011-4789 EXP | Stack-based buffer overflow in magentservice.exe in the server in HP LoadRunner 11.00 before patch 4 allows remote attackers to execute arbitrary code… | Patch early | 10.0 high | 64.4% | 2012-01-13 |
| CVE-2018-6328 EXP | It was discovered that the Unitrends Backup (UB) before 10.1.0 user interface was exposed to an authentication bypass, which then could allow an unaut… | Patch early | 9.8 critical | 64.4% | 2018-03-14 |
| CVE-2011-5001 EXP | Stack-based buffer overflow in the CGenericScheduler::AddTask function in cmdHandlerRedAlertController.dll in CmdProcessor.exe in Trend Micro Control… | Patch early | 10.0 high | 64.4% | 2011-12-25 |
| CVE-2007-2937 EXP | PHP remote file inclusion vulnerability in admin/admin.php in TROforum 0.1 allows remote attackers to execute arbitrary PHP code via a URL in the site… | Patch early | 7.5 high | 64.4% | 2007-05-31 |
| CVE-2007-2986 EXP | PHP remote file inclusion vulnerability in lib/live_status.lib.php in AdminBot MX 9.0.5 allows remote attackers to execute arbitrary PHP code via a UR… | Patch early | 7.5 high | 64.4% | 2007-06-01 |
| CVE-2007-3325 EXP | PHP remote file inclusion vulnerability in lib/language.php in LAN Management System (LMS) 1.9.6 and earlier allows remote attackers to execute arbitr… | Patch early | 7.5 high | 64.4% | 2007-06-21 |
| CVE-2007-3306 EXP | PHP remote file inclusion vulnerability in crontab/run_billing.php in MiniBill 1.2.5 allows remote attackers to execute arbitrary PHP code via a URL i… | Patch early | 7.5 high | 64.4% | 2007-06-21 |
| CVE-2022-44149 EXP | The web service on Nexxt Amp300 ARN02304U8 42.103.1.5095 and 80.103.2.5045 devices allows remote OS command execution by placing &telnetd in the JSON… | Patch early | 8.8 high | 64.4% | 2023-01-06 |
| CVE-1999-0504 EXP | A Windows NT local user or administrator account has a default, null, blank, or missing password. | Patch early | 7.5 high | 64.3% | 1997-01-01 |
| CVE-2018-19422 EXP | /panel/uploads in Subrion CMS 4.2.1 allows remote attackers to execute arbitrary PHP code via a .pht or .phar file, because the .htaccess file omits t… | Patch early | 7.2 high | 64.3% | 2018-11-21 |
| CVE-2016-2296 EXP | Meteocontrol WEB'log Basic 100, Light, Pro, and Pro Unlimited does not require authentication for "post-admin" login pages, which allows remote attack… | Patch early | 9.4 critical | 64.3% | 2016-05-14 |
| CVE-2018-7297 EXP | Remote Code Execution in the TCL script interpreter in eQ-3 AG Homematic CCU2 2.29.2 and earlier allows remote attackers to obtain read/write access a… | Patch early | 9.8 critical | 64.3% | 2018-02-22 |
| CVE-2011-0922 EXP | The client in HP Data Protector allows remote attackers to execute arbitrary programs via an EXEC_SETUP command that references a UNC share pathname. | Patch early | 10.0 high | 64.2% | 2011-02-09 |
| CVE-2007-3524 EXP | Multiple PHP remote file inclusion vulnerabilities in Ripe Website Manager 0.8.9 and earlier allow remote attackers to execute arbitrary PHP code via… | Patch early | 6.8 medium | 64.2% | 2007-07-03 |
| CVE-2017-11861 EXP | Microsoft Edge in Windows 10 1607, 1703, 1709, Windows Server 2016 and Windows Server, version 1709 allows an attacker to gain the same user rights as… | Patch early | 7.5 high | 64.2% | 2017-11-15 |
| CVE-2016-1593 EXP | Directory traversal vulnerability in the import users feature in Micro Focus Novell Service Desk before 7.2 allows remote authenticated administrators… | Patch early | 7.2 high | 64.1% | 2016-04-22 |
| CVE-2008-5053 EXP | PHP remote file inclusion vulnerability in admin.rssreader.php in the Simple RSS Reader (com_rssreader) 1.0 component for Joomla! allows remote attack… | Patch early | 10.0 high | 64.1% | 2008-11-13 |
| CVE-2011-1565 EXP | Directory traversal vulnerability in IGSSdataServer.exe 9.00.00.11063 and earlier in 7-Technologies Interactive Graphical SCADA System (IGSS) allows r… | Patch early | 10.0 high | 64.1% | 2011-04-05 |
| CVE-2007-2939 EXP | Multiple PHP remote file inclusion vulnerabilities in Mazen's PHP Chat 3.0.0 allow remote attackers to execute arbitrary PHP code via a URL in the bas… | Patch early | 6.8 medium | 64% | 2007-05-31 |
| CVE-2017-9417 EXP | Broadcom BCM43xx Wi-Fi chips allow remote attackers to execute arbitrary code via unspecified vectors, aka the "Broadpwn" issue. | Patch early | 9.8 critical | 64% | 2017-06-04 |
| CVE-2012-5067 EXP | Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allows remote attackers to affect c… | Patch early | 5.0 medium | 64% | 2012-10-16 |
| CVE-2009-3711 EXP | Stack-based buffer overflow in the h_handlepeer function in http.cpp in httpdx 1.4, and possibly 1.4.3, allows remote attackers to cause a denial of s… | Patch early | 10.0 high | 63.9% | 2009-10-16 |
| CVE-2014-5350 EXP | Multiple directory traversal vulnerabilities in Bitdefender GravityZone before 5.1.11.432 allow remote attackers to read arbitrary files via a (1) ..… | Patch early | 5.0 medium | 63.9% | 2014-08-19 |
| CVE-2017-11165 EXP | dataTaker DT80 dEX 1.50.012 allows remote attackers to obtain sensitive credential and configuration information via a direct request for the /service… | Patch early | 9.8 critical | 63.9% | 2017-07-12 |
| CVE-2009-2936 EXP | The Command Line Interface (aka Server CLI or administration interface) in the master process in the reverse proxy server in Varnish before 2.1.0 does… | Patch early | 7.5 high | 63.8% | 2010-04-05 |
| CVE-2006-3730 EXP | Integer overflow in Microsoft Internet Explorer 6 on Windows XP SP2 allows remote attackers to cause a denial of service (crash) and execute arbitrary… | Patch early | 8.8 high | 63.8% | 2006-07-21 |
| CVE-2019-6447 EXP | The ES File Explorer File Manager application through 4.1.9.7.4 for Android allows remote attackers to read arbitrary files or execute applications vi… | Patch early | 8.1 high | 63.8% | 2019-01-16 |
| CVE-2019-14287 EXP | In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and session PAM modules, and can cau… | Patch early | 8.8 high | 63.8% | 2019-10-17 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt