CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
398,917 CVEs
1,728 on KEV
17,272 EPSS ≥ 10%
25,086 with exploits
synced 2026-09-29
12,661 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2008-5036 EXP | Stack-based buffer overflow in VideoLAN VLC media player 0.9.x before 0.9.6 might allow user-assisted attackers to execute arbitrary code via an an in… | Patch early | 9.3 high | 41.4% | 2008-11-10 |
| CVE-2009-2261 EXP | PeaZIP 2.6.1, 2.5.1, and earlier on Windows allows user-assisted remote attackers to execute arbitrary commands via a .zip archive with a .txt file wh… | Patch early | 9.3 high | 41.4% | 2009-06-30 |
| CVE-2007-2217 EXP | Kodak Image Viewer in Microsoft Windows 2000 SP4, and in some cases XP SP2 and Server 2003 SP1 and SP2, allows remote attackers to execute arbitrary c… | Patch early | 9.3 high | 41.4% | 2007-10-09 |
| CVE-2009-0553 EXP | Microsoft Internet Explorer 6 SP1, 6 and 7 on Windows XP SP2 and SP3, 6 and 7 on Windows Server 2003 SP1 and SP2, 7 on Windows Vista Gold and SP1, and… | Patch early | 9.3 high | 41.4% | 2009-04-15 |
| CVE-2021-3317 EXP | KLog Server through 2.4.1 allows authenticated command injection. async.php calls shell_exec() on the original value of the source parameter. | Patch early | 8.8 high | 41.4% | 2021-01-26 |
| CVE-2007-2216 EXP | The tblinf32.dll (aka vstlbinf.dll) ActiveX control for Internet Explorer 5.01, 6 SP1, and 7 uses an incorrect IObjectsafety implementation, which all… | Patch early | 9.3 high | 41.4% | 2007-08-14 |
| CVE-2020-10882 EXP | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1… | Patch early | 8.8 high | 41.4% | 2020-03-25 |
| CVE-2002-0866 EXP | Java Database Connectivity (JDBC) classes in Microsoft Virtual Machine (VM) up to and including 5.0.3805 allow remote attackers to load and execute DL… | Patch early | 7.5 high | 41.4% | 2002-10-11 |
| CVE-2016-3386 EXP | The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via… | Patch early | 7.5 high | 41.3% | 2016-10-14 |
| CVE-2006-6561 EXP | Unspecified vulnerability in Microsoft Word 2000, 2002, and Word Viewer 2003 allows user-assisted remote attackers to execute arbitrary code via a cra… | Patch early | 9.3 high | 41.3% | 2006-12-14 |
| CVE-2010-0231 EXP | The SMB implementation in the Server service in Microsoft Windows 2000 SP4, Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista Gold, SP1,… | Patch early | 10.0 high | 41.3% | 2010-02-10 |
| CVE-2005-3757 EXP | The Saxon XSLT parser in Google Mini Search Appliance, and possibly Google Search Appliance, allows remote attackers to obtain sensitive information a… | Patch early | 7.5 high | 41.3% | 2005-11-22 |
| CVE-2008-0955 EXP | Stack-based buffer overflow in the Creative Software AutoUpdate Engine ActiveX control in CTSUEng.ocx allows remote attackers to execute arbitrary cod… | Patch early | 9.3 high | 41.2% | 2008-05-29 |
| CVE-2007-2365 EXP | Buffer overflow in Adobe Photoshop CS2 and CS3, Photoshop Elements 5.0, Illustrator CS3, and GoLive 9 allows user-assisted remote attackers to execute… | Patch early | 9.3 high | 41.2% | 2007-04-30 |
| CVE-2020-14425 EXP | Foxit Reader before 10.0 allows Remote Command Execution via the app.opencPDFWebPage JavsScript API. An attacker can execute local files and bypass th… | Patch early | 7.8 high | 41.1% | 2020-11-02 |
| CVE-2016-0122 EXP | Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Word 2016 for Mac, Office Compatibility Pack SP3, and Excel V… | Patch early | 7.8 high | 41.1% | 2016-04-12 |
| CVE-2006-3059 EXP | Unspecified vulnerability in Microsoft Excel 2000 through 2004 allows remote user-assisted attackers to execute arbitrary code via unspecified vectors… | Patch early | 9.3 high | 41.1% | 2006-06-17 |
| CVE-2015-2065 EXP | SQL injection vulnerability in videogalleryrss.php in the Apptha WordPress Video Gallery (contus-video-gallery) plugin before 2.8 for WordPress allows… | Patch early | 7.5 high | 41.1% | 2015-02-24 |
| CVE-2005-0416 EXP | The Windows Animated Cursor (ANI) capability in Windows NT, Windows 2000 through SP4, Windows XP through SP1, and Windows 2003 allows remote attackers… | Patch early | 7.5 high | 41% | 2005-04-27 |
| CVE-2019-12593 EXP | IceWarp Mail Server through 10.4.4 is prone to a local file inclusion vulnerability via webmail/calendar/minimizer/index.php?style=..%5c directory tra… | Patch early | 7.5 high | 41% | 2019-06-03 |
| CVE-2015-0097 EXP | Microsoft Excel 2007 SP3, PowerPoint 2007 SP3, Word 2007 SP3, Excel 2010 SP2, PowerPoint 2010 SP2, and Word 2010 SP2 allow remote attackers to execute… | Patch early | 9.3 high | 40.9% | 2015-03-11 |
| CVE-2003-0434 EXP | Various PDF viewers including (1) Adobe Acrobat 5.06 and (2) Xpdf 1.01 allow remote attackers to execute arbitrary commands via shell metacharacters i… | Patch early | 7.5 high | 40.9% | 2003-07-24 |
| CVE-2015-5621 EXP | The snmp_pdu_parse function in snmp_api.c in net-snmp 5.7.2 and earlier does not remove the varBind variable in a netsnmp_variable_list item when pars… | Patch early | 7.5 high | 40.9% | 2015-08-19 |
| CVE-2017-7442 EXP | Nitro Pro 11.0.3.173 allows remote attackers to execute arbitrary code via saveAs and launchURL calls with directory traversal sequences. | Patch early | 8.8 high | 40.7% | 2017-08-03 |
| CVE-2015-8044 EXP | Use-after-free vulnerability in Adobe Flash Player before 18.0.0.261 and 19.x before 19.0.0.245 on Windows and OS X and before 11.2.202.548 on Linux,… | Patch early | 10.0 high | 40.7% | 2015-11-11 |
| CVE-2008-5002 EXP | Insecure method vulnerability in the ChilkatCrypt2.ChilkatCrypt2.1 ActiveX control (ChilkatCrypt2.dll 4.3.2.1) in Chilkat Crypt ActiveX Component allo… | Patch early | 9.3 high | 40.7% | 2008-11-10 |
| CVE-2012-5223 EXP | The proc_deutf function in includes/functions_vbseocp_abstract.php in vBSEO 3.5.0, 3.5.1, 3.5.2, 3.6.0, and earlier allows remote attackers to insert… | Patch early | 7.5 high | 40.5% | 2012-10-01 |
| CVE-2007-2938 EXP | Buffer overflow in the BaseRunner ActiveX control in the Ademco ATNBaseLoader100 Module (ATNBaseLoader100.dll) 5.4.0.6, when Internet Explorer 6 is us… | Patch early | 10.0 high | 40.5% | 2007-05-31 |
| CVE-2009-0565 EXP | Buffer overflow in Microsoft Office Word 2000 SP3, 2002 SP3, and 2007 SP1 and SP2; Microsoft Office for Mac 2004 and 2008; Open XML File Format Conver… | Patch early | 9.3 high | 40.5% | 2009-06-10 |
| CVE-2013-1412 EXP | DataLife Engine (DLE) 9.7 allows remote attackers to execute arbitrary PHP code via the catlist[] parameter to engine/preview.php, which is used in a… | Patch early | 7.5 high | 40.5% | 2014-06-02 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt