CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
425,729 CVEs
1,781 on KEV
17,555 EPSS ≥ 10%
25,095 with exploits
synced 2026-11-14
10,150 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2004-2565 EXP | Multiple directory traversal vulnerabilities in Sambar Server 6.1 Beta 2 on Windows, and possibly other versions on Linux, when the administrative IP… | Patch early | 5.0 medium | 9.4% | 2004-12-31 |
| CVE-2024-12342 EXP | A vulnerability was found in TP-Link VN020 F3v(T) TT_V6.2.1021. It has been rated as critical. This issue affects some unknown processing of the file… | Patch early | 6.5 medium | 9.4% | 2024-12-08 |
| CVE-2007-1701 EXP | PHP 4 before 4.4.5, and PHP 5 before 5.2.1, when register_globals is enabled, allows context-dependent attackers to execute arbitrary code via deseria… | Patch early | 6.8 medium | 9.4% | 2007-03-27 |
| CVE-2006-2896 EXP | profile.php in FunkBoard CF0.71 allows remote attackers to change arbitrary passwords via a modified uid hidden form field in an Edit Profile action. | Patch early | 5.0 medium | 9.4% | 2006-06-07 |
| CVE-2006-3735 EXP | Multiple PHP remote file inclusion vulnerabilities in Mail2Forum (module for phpBB) 1.2 and earlier allow remote attackers to execute arbitrary PHP co… | Patch early | 5.1 medium | 9.4% | 2006-07-21 |
| CVE-2009-2535 EXP | Mozilla Firefox before 2.0.0.19 and 3.x before 3.0.5, SeaMonkey, and Thunderbird allow remote attackers to cause a denial of service (memory consumpti… | Patch early | 5.0 medium | 9.4% | 2009-07-20 |
| CVE-2006-1999 EXP | The multiplayer menu in OpenTTD 0.4.7 allows remote attackers to cause a denial of service via a UDP packet with an incorrect size, which causes the c… | Patch early | 5.0 medium | 9.4% | 2006-04-25 |
| CVE-2019-14280 EXP | In some circumstances, Craft 2 before 2.7.10 and 3 before 3.2.6 wasn't stripping EXIF data from user-uploaded images when it was configured to do so,… | Patch early | 5.3 medium | 9.4% | 2019-07-26 |
| CVE-2001-0784 EXP | Directory traversal vulnerability in Icecast 1.3.10 and earlier allows remote attackers to read arbitrary files via a modified .. (dot dot) attack us… | Patch early | 5.0 medium | 9.4% | 2001-10-18 |
| CVE-2009-3840 EXP | The embedded database engine service (aka ovdbrun.exe) in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53 allows remote attackers to cause a d… | Patch early | 5.0 medium | 9.3% | 2009-11-19 |
| CVE-2010-0519 EXP | Integer overflow in QuickTime in Apple Mac OS X before 10.6.3 allows remote attackers to execute arbitrary code or cause a denial of service (applicat… | Patch early | 6.8 medium | 9.3% | 2010-03-30 |
| CVE-2007-0051 EXP | Format string vulnerability in Apple iPhoto 6.0.5 (316), and other versions before 6.0.6, allows remote user-assisted attackers to execute arbitrary c… | Patch early | 6.8 medium | 9.3% | 2007-01-04 |
| CVE-2001-0009 EXP | Directory traversal vulnerability in Lotus Domino 5.0.5 web server allows remote attackers to read arbitrary files via a .. attack. | Patch early | 5.0 medium | 9.3% | 2001-02-12 |
| CVE-2012-0298 EXP | The file-management scripts in the management GUI in Symantec Web Gateway 5.0.x before 5.0.3 allow remote attackers to (1) read or (2) delete arbitrar… | Patch early | 6.4 medium | 9.3% | 2012-05-21 |
| CVE-2004-0129 EXP | Directory traversal vulnerability in export.php in phpMyAdmin 2.5.5 and earlier allows remote attackers to read arbitrary files via .. (dot dot) seque… | Patch early | 5.0 medium | 9.3% | 2004-03-03 |
| CVE-2006-2576 EXP | Multiple PHP remote file inclusion vulnerabilities in Docebo 3.0.3 and earlier, when register_globals is enabled, allow remote attackers to execute ar… | Patch early | 5.1 medium | 9.3% | 2006-05-24 |
| CVE-2011-5233 EXP | Heap-based buffer overflow in IrfanView before 4.32 allows remote attackers to execute arbitrary code via crafted "Rows Per Strip" and "Samples Per Pi… | Patch early | 4.3 medium | 9.3% | 2012-10-25 |
| CVE-2005-2006 EXP | JBOSS 3.2.2 through 3.2.7 and 4.0.2 allows remote attackers to obtain sensitive information via a GET request (1) with a "%." (percent dot), which rev… | Patch early | 5.0 medium | 9.3% | 2005-06-17 |
| CVE-2018-9038 EXP | Monstra CMS 3.0.4 allows remote attackers to delete files via an admin/index.php?id=filesmanager&delete_dir=./&path=uploads/ request. | Patch early | 6.5 medium | 9.3% | 2018-04-10 |
| CVE-2015-4062 EXP | SQL injection vulnerability in includes/nsp_search.php in the NewStatPress plugin before 0.9.9 for WordPress allows remote authenticated users to exec… | Patch early | 6.5 medium | 9.3% | 2015-05-27 |
| CVE-2010-4301 EXP | epan/dissectors/packet-zbee-zcl.c in the ZigBee ZCL dissector in Wireshark 1.4.0 through 1.4.1 allows remote attackers to cause a denial of service (i… | Patch early | 5.0 medium | 9.3% | 2010-11-26 |
| CVE-2008-4682 EXP | wtap.c in Wireshark 0.99.7 through 1.0.3 allows remote attackers to cause a denial of service (application abort) via a malformed Tamos CommView captu… | Patch early | 5.0 medium | 9.3% | 2008-10-22 |
| CVE-2020-11457 EXP | pfSense before 2.4.5 has stored XSS in system_usermanager_addprivs.php in the WebGUI via the descr parameter (aka full name) of a user. | Patch early | 5.4 medium | 9.3% | 2020-04-01 |
| CVE-2012-4242 EXP | Cross-site scripting (XSS) vulnerability in the MF Gig Calendar plugin 0.9.2 for WordPress allows remote attackers to inject arbitrary web script or H… | Patch early | 4.3 medium | 9.3% | 2012-10-01 |
| CVE-2008-4610 EXP | MPlayer allows remote attackers to cause a denial of service (application crash) via (1) a malformed AAC file, as demonstrated by lol-vlc.aac; or (2)… | Patch early | 5.0 medium | 9.3% | 2008-10-20 |
| CVE-2000-1132 EXP | DCForum cgforum.cgi CGI script allows remote attackers to read arbitrary files, and delete the program itself, via a malformed "forum" variable. | Patch early | 6.4 medium | 9.3% | 2001-01-09 |
| CVE-2024-45440 EXP | core/authorize.php in Drupal 11.x-dev allows Full Path Disclosure (even when error logging is None) if the value of hash_salt is file_get_contents of… | Patch early | 5.3 medium | 9.3% | 2024-08-29 |
| CVE-2007-6528 EXP | Directory traversal vulnerability in tiki-listmovies.php in TikiWiki before 1.9.9 allows remote attackers to read arbitrary files via a .. (dot dot) a… | Patch early | 5.0 medium | 9.3% | 2007-12-27 |
| CVE-2019-12461 EXP | Web Port 1.19.1 allows XSS via the /log type parameter. | Patch early | 6.1 medium | 9.3% | 2019-05-30 |
| CVE-2008-0073 EXP | Array index error in the sdpplin_parse function in input/libreal/sdpplin.c in xine-lib 1.1.10.1 allows remote RTSP servers to execute arbitrary code v… | Patch early | 6.8 medium | 9.3% | 2008-03-24 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt