CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
398,929 CVEs
1,728 on KEV
17,272 EPSS ≥ 10%
25,086 with exploits
synced 2026-09-29
25,086 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2005-0277 EXP | Buffer overflow in the FTP service in 3Com 3CDaemon 2.0 revision 10 allows remote attackers to cause a denial of service (application crash) and execu… | Patch early | 5.0 medium | 61.9% | 2005-05-02 |
| CVE-2006-1245 EXP | Buffer overflow in mshtml.dll in Microsoft Internet Explorer 6.0.2900.2180, and probably other versions, allows remote attackers to execute arbitrary… | Patch early | 7.5 high | 61.8% | 2006-03-17 |
| CVE-2013-2343 EXP | Unspecified vulnerability on the HP LeftHand Virtual SAN Appliance hydra with software before 10.0 allows remote attackers to execute arbitrary code v… | Patch early | 10.0 high | 61.8% | 2013-07-02 |
| CVE-2007-1061 EXP | SQL injection vulnerability in index.php in Francisco Burzi PHP-Nuke 8.0 Final and earlier, when the "HTTP Referers" block is enabled, allows remote a… | Patch early | 6.8 medium | 61.8% | 2007-02-22 |
| CVE-2007-2969 EXP | PHP remote file inclusion vulnerability in newsletter.php in WAnewsletter 2.1.3 and earlier allows remote attackers to execute arbitrary PHP code via… | Patch early | 7.5 high | 61.7% | 2007-06-01 |
| CVE-2006-1189 EXP | Buffer overflow in URLMON.DLL in Microsoft Internet Explorer 5.01 through 6 allows remote attackers to execute arbitrary code via a crafted URL with a… | Patch early | 10.0 high | 61.7% | 2006-04-11 |
| CVE-2006-2961 EXP | Stack-based buffer overflow in CesarFTP 0.99g and earlier allows remote attackers to cause a denial of service (application crash) and possibly execut… | Patch early | 7.5 high | 61.7% | 2006-06-12 |
| CVE-2004-1037 EXP | The search function in TWiki 20030201 allows remote attackers to execute arbitrary commands via shell metacharacters in a search string. | Patch early | 10.0 high | 61.7% | 2005-03-01 |
| CVE-2012-1875 EXP | Microsoft Internet Explorer 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a delet… | Patch early | 9.3 high | 61.7% | 2012-06-12 |
| CVE-2016-1209 EXP | The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via crafted serialized values in… | Patch early | 9.8 critical | 61.6% | 2016-05-14 |
| CVE-2006-1190 EXP | Microsoft Internet Explorer 5.01 through 6 does not always return the correct IOleClientSite information when dynamically creating an embedded object,… | Patch early | 10.0 high | 61.6% | 2006-04-11 |
| CVE-2017-8835 EXP | SQL injection exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2_380hw6_580hw2_710hw3_1350hw2_2500-7… | Patch early | 9.8 critical | 61.6% | 2017-06-05 |
| CVE-2015-7602 EXP | Directory traversal vulnerability in BisonWare BisonFTP 3.5 allows remote attackers to read arbitrary files via a ../ (dot dot slash) in a RETR comman… | Patch early | 7.8 high | 61.5% | 2015-09-29 |
| CVE-2007-3632 EXP | Multiple PHP remote file inclusion vulnerabilities in LimeSurvey (aka PHPSurveyor) 1.49RC2 allow remote attackers to execute arbitrary PHP code via a… | Patch early | 6.8 medium | 61.5% | 2007-07-10 |
| CVE-2012-4711 EXP | Buffer overflow in kingMess.exe 65.20.2003.10300 in WellinTech KingView 6.52, kingMess.exe 65.20.2003.10400 in KingView 6.53, and kingMess.exe 65.50.2… | Patch early | 10.0 high | 61.5% | 2013-02-15 |
| CVE-2005-2123 EXP | Multiple integer overflows in the Graphics Rendering Engine (GDI32.DLL) in Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 allow remote attacker… | Patch early | 7.5 high | 61.5% | 2005-11-29 |
| CVE-2014-2206 EXP | Stack-based buffer overflow in GetGo Download Manager 4.9.0.1982, 4.8.2.1346, 4.4.5.502, and earlier allows remote attackers to cause a denial of serv… | Patch early | 10.0 high | 61.4% | 2014-03-05 |
| CVE-2006-4868 EXP | Stack-based buffer overflow in the Vector Graphics Rendering engine (vgx.dll), as used in Microsoft Outlook and Internet Explorer 6.0 on Windows XP SP… | Patch early | 9.3 high | 61.4% | 2006-09-19 |
| CVE-2018-16836 EXP | Rubedo through 3.4.0 contains a Directory Traversal vulnerability in the theme component, allowing unauthenticated attackers to read and execute arbit… | Patch early | 9.8 critical | 61.4% | 2018-09-11 |
| CVE-2014-2364 EXP | Multiple stack-based buffer overflows in Advantech WebAccess before 7.2 allow remote attackers to execute arbitrary code via a long string in the (1)… | Patch early | 7.5 high | 61.4% | 2014-07-19 |
| CVE-2015-4133 EXP | Unrestricted file upload vulnerability in admin/scripts/FileUploader/php.php in the ReFlex Gallery plugin before 3.1.4 for WordPress allows remote att… | Patch early | 7.5 high | 61.4% | 2015-05-28 |
| CVE-2005-2087 EXP | Internet Explorer 5.01 SP4 up to 6 on various Windows operating systems, including IE 6.0.2900.2180 on Windows XP, allows remote attackers to cause a… | Patch early | 5.0 medium | 61.4% | 2005-07-05 |
| CVE-2017-1000119 EXP | October CMS build 412 is vulnerable to PHP code execution in the file upload functionality resulting in site compromise and possibly other application… | Patch early | 7.2 high | 61.3% | 2017-10-05 |
| CVE-2010-1807 EXP | WebKit in Apple Safari 4.x before 4.1.2 and 5.x before 5.0.2; Android before 2.2; and webkitgtk before 1.2.6; does not properly validate floating-poin… | Patch early | 9.3 high | 61.3% | 2010-09-10 |
| CVE-2008-5457 EXP | Unspecified vulnerability in the Oracle BEA WebLogic Server Plugins for Apache, Sun and IIS web servers component in BEA Product Suite 10.3, 10.0 MP1,… | Patch early | 10.0 high | 61.3% | 2009-01-14 |
| CVE-2008-0065 EXP | Multiple stack-based buffer overflows in in_mp3.dll in Winamp 5.21, 5.5, and 5.51 allow remote attackers to execute arbitrary code via a long (1) arti… | Patch early | 10.0 high | 61.3% | 2008-01-22 |
| CVE-2010-0239 EXP | The TCP/IP implementation in Microsoft Windows Vista Gold, SP1, and SP2 and Server 2008 Gold and SP2, when IPv6 is enabled, does not properly perform… | Patch early | 10.0 high | 61.3% | 2010-02-10 |
| CVE-2018-6329 EXP | It was discovered that the Unitrends Backup (UB) before 10.1.0 libbpext.so authentication could be bypassed with a SQL injection, allowing a remote at… | Patch early | 9.8 critical | 61.2% | 2018-03-14 |
| CVE-2007-1675 EXP | Buffer overflow in the CRAM-MD5 authentication mechanism in the IMAP server (nimap.exe) in IBM Lotus Domino before 6.5.6 and 7.x before 7.0.2 FP1 allo… | Patch early | 10.0 high | 61.2% | 2007-03-28 |
| CVE-2006-1314 EXP | Heap-based buffer overflow in the Server Service (SRV.SYS driver) in Microsoft Windows 2000 SP4, XP SP1 and SP2, Server 2003 up to SP1, and other prod… | Patch early | 7.5 high | 61.2% | 2006-07-11 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt