CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
398,917 CVEs
1,728 on KEV
17,272 EPSS ≥ 10%
25,086 with exploits
synced 2026-09-29
25,086 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2018-9948 EXP | This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.0.0.29935. User interaction… | Patch early | 6.5 medium | 63.1% | 2018-05-17 |
| CVE-2005-1323 EXP | Buffer overflow in NetFtpd for NetTerm 5.1.1 and earlier allows remote attackers to execute arbitrary code via a long USER command. | Patch early | 7.5 high | 63.1% | 2005-05-02 |
| CVE-2018-16283 EXP | The Wechat Broadcast plugin 1.2.0 and earlier for WordPress allows Directory Traversal via the Image.php url parameter. | Patch early | 9.8 critical | 63.1% | 2018-09-24 |
| CVE-2012-0911 EXP | TikiWiki CMS/Groupware before 6.7 LTS and before 8.4 allows remote attackers to execute arbitrary PHP code via a crafted serialized object in the (1)… | Patch early | 9.8 critical | 63% | 2012-07-12 |
| CVE-2010-4142 EXP | Multiple stack-based buffer overflows in DATAC RealWin 2.0 Build 6.1.8.10 and earlier allow remote attackers to cause a denial of service (crash) and… | Patch early | 10.0 high | 63% | 2010-11-02 |
| CVE-2005-1812 EXP | Multiple stack-based buffer overflows in FutureSoft TFTP Server Evaluation Version 1.0.0.1 allow remote attackers to execute arbitrary code via a long… | Patch early | 10.0 high | 62.9% | 2005-06-01 |
| CVE-2026-0740 EXP | The Ninja Forms - File Uploads plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'NF_FU_AJAX_Con… | Patch early | 9.8 critical | 62.9% | 2026-04-07 |
| CVE-2024-8522 EXP | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to SQL Injection via the 'c_only_fields' parameter of the /wp-json/learnpress… | Patch early | 10.0 critical | 62.9% | 2024-09-12 |
| CVE-2006-0021 EXP | Microsoft Windows XP SP1 and SP2, and Server 2003 up to SP1, allows remote attackers to cause a denial of service (hang) via an IGMP packet with an in… | Patch early | 7.8 high | 62.9% | 2006-02-14 |
| CVE-2012-3811 EXP | Unrestricted file upload vulnerability in ImageUpload.ashx in the Wallboard application in Avaya IP Office Customer Call Reporter 7.0 before 7.0.5.8 Q… | Patch early | 10.0 high | 62.9% | 2012-07-03 |
| CVE-2007-2426 EXP | PHP remote file inclusion vulnerability in myfunctions/mygallerybrowser.php in the myGallery 1.4b4 and earlier plugin for WordPress allows remote atta… | Patch early | 7.5 high | 62.9% | 2007-05-02 |
| CVE-2004-0326 EXP | Buffer overflow in the web proxy for GateKeeper Pro 4.7 allows remote attackers to execute arbitrary code via a long GET request. | Patch early | 10.0 high | 62.8% | 2004-11-23 |
| CVE-2004-1638 EXP | Buffer overflow in MailCarrier 2.51 allows remote attackers to execute arbitrary code via a long (1) EHLO and possibly (2) HELO command. | Patch early | 7.5 high | 62.8% | 2004-10-16 |
| CVE-2012-5932 EXP | Eval injection vulnerability in the ldapagnt_eval function in ldapagnt.dll in unifid.exe in NetIQ Privileged User Manager 2.3.x before 2.3.1 HF2 allow… | Patch early | 10.0 high | 62.8% | 2012-12-24 |
| CVE-2007-3220 EXP | PHP remote file inclusion vulnerability in admin/editor2/spaw_control.class.php in the Cjay Content 3 module for XOOPS allows remote attackers to exec… | Patch early | 6.8 medium | 62.7% | 2007-06-14 |
| CVE-2009-4660 EXP | Stack-based buffer overflow in the AntServer Module (AntServer.exe) in BigAnt IM Server 2.50 allows remote attackers to execute arbitrary code via a l… | Patch early | 10.0 high | 62.7% | 2010-03-03 |
| CVE-2023-34096 EXP | Thruk is a multibackend monitoring webinterface which currently supports Naemon, Icinga, Shinken and Nagios as backends. In versions 3.06 and prior, t… | Patch early | 6.5 medium | 62.7% | 2023-06-08 |
| CVE-2004-0964 EXP | Buffer overflow in Zinf 2.2.1 on Windows, and other older versions for Linux, allows remote attackers or local users to execute arbitrary code via cer… | Patch early | 10.0 high | 62.7% | 2005-02-09 |
| CVE-2015-1171 EXP | Stack-based buffer overflow in GSM SIM Utility (aka SIM Card Editor) 6.6 allows remote attackers to execute arbitrary code via a long entry in a .sms… | Patch early | 10.0 high | 62.7% | 2015-08-28 |
| CVE-2011-1220 EXP | Stack-based buffer overflow in lcfd.exe in Tivoli Endpoint in IBM Tivoli Management Framework 3.7.1, 4.1, 4.1.1, and 4.3.1 allows remote authenticated… | Patch early | 9.0 high | 62.7% | 2011-06-02 |
| CVE-2017-11914 EXP | ChakraCore and Microsoft Edge in Windows 10 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to gain the same user rights as the cur… | Patch early | 7.5 high | 62.6% | 2017-12-12 |
| CVE-2017-11918 EXP | ChakraCore and Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to gain the same user rights as t… | Patch early | 7.5 high | 62.6% | 2017-12-12 |
| CVE-2013-4822 EXP | Unspecified vulnerability in HP Intelligent Management Center (iMC) and HP IMC Branch Intelligent Management System Software Module (aka BIMS) allows… | Patch early | 10.0 high | 62.6% | 2013-10-13 |
| CVE-2013-4837 EXP | Unspecified vulnerability in Virtual User Generator in HP LoadRunner before 11.52 allows remote attackers to execute arbitrary code via unknown vector… | Patch early | 10.0 high | 62.6% | 2013-11-04 |
| CVE-2007-2708 EXP | PHP remote file inclusion vulnerability in newsadmin.php in Feindt Computerservice News (News-Script) 2.0 allows remote attackers to execute arbitrary… | Patch early | 7.5 high | 62.6% | 2007-05-16 |
| CVE-2004-0798 EXP | Buffer overflow in the _maincfgret.cgi script for Ipswitch WhatsUp Gold before 8.03 Hotfix 1 allows remote attackers to execute arbitrary code via a l… | Patch early | 7.5 high | 62.6% | 2004-10-20 |
| CVE-2007-5333 EXP | Apache Tomcat 6.0.0 through 6.0.14, 5.5.0 through 5.5.25, and 4.1.0 through 4.1.36 does not properly handle (1) double quote (") characters or (2) %5C… | Patch early | 5.0 medium | 62.6% | 2008-02-12 |
| CVE-2019-13396 EXP | FlightPath 4.x and 5.0-x allows directory traversal and Local File Inclusion through the form_include parameter in an index.php?q=system-handle-form-s… | Patch early | 5.3 medium | 62.6% | 2019-07-10 |
| CVE-2000-0760 EXP | The Snoop servlet in Jakarta Tomcat 3.1 and 3.0 under Apache reveals sensitive system information when a remote attacker requests a nonexistent URL wi… | Patch early | 6.4 medium | 62.5% | 2000-10-20 |
| CVE-2009-0323 EXP | Multiple stack-based buffer overflows in W3C Amaya Web Browser 10.0 and 11.0 allow remote attackers to execute arbitrary code via (1) a long type para… | Patch early | 10.0 high | 62.5% | 2009-01-28 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt