CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
425,731 CVEs
1,781 on KEV
17,555 EPSS ≥ 10%
25,095 with exploits
synced 2026-11-14
25,095 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2006-5198 EXP | The WZFILEVIEW.FileViewCtrl.61 ActiveX control (aka Sky Software "FileView" ActiveX control) for WinZip 10.0 before build 7245 allows remote attackers… | Patch early | 4.0 medium | 62.1% | 2006-11-14 |
| CVE-2004-0735 EXP | Buffer overflow in Medal of Honor (1) Allied Assault 1.11v9 and earlier, (2) Breakthrough 2.40b and earlier, and (3) Spearhead 2.15 and earlier, when… | Patch early | 7.5 high | 62.1% | 2004-07-27 |
| CVE-2009-1136 EXP | The Microsoft Office Web Components Spreadsheet ActiveX control (aka OWC10 or OWC11), as distributed in Office XP SP3 and Office 2003 SP3, Office XP W… | Patch early | 9.3 high | 62% | 2009-07-15 |
| CVE-2015-4133 EXP | Unrestricted file upload vulnerability in admin/scripts/FileUploader/php.php in the ReFlex Gallery plugin before 3.1.4 for WordPress allows remote att… | Patch early | 7.5 high | 62% | 2015-05-28 |
| CVE-2015-3088 EXP | Heap-based buffer overflow in Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460… | Patch early | 10.0 high | 62% | 2015-05-13 |
| CVE-2005-2120 EXP | Stack-based buffer overflow in the Plug and Play (PnP) service (UMPNPMGR.DLL) in Microsoft Windows 2000 SP4, and XP SP1 and SP2, allows remote or loca… | Patch early | 6.5 medium | 62% | 2005-10-13 |
| CVE-2022-24223 EXP | AtomCMS v2.0 was discovered to contain a SQL injection vulnerability via /admin/login.php. | Patch early | 9.8 critical | 62% | 2022-02-01 |
| CVE-2006-3441 EXP | Buffer overflow in the DNS Client service in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 allows remote attackers to execute arbitr… | Patch early | 10.0 high | 62% | 2006-08-09 |
| CVE-2004-0326 EXP | Buffer overflow in the web proxy for GateKeeper Pro 4.7 allows remote attackers to execute arbitrary code via a long GET request. | Patch early | 10.0 high | 62% | 2004-11-23 |
| CVE-2012-2982 EXP | file/show.cgi in Webmin 1.590 and earlier allows remote authenticated users to execute arbitrary commands via an invalid character in a pathname, as d… | Patch early | 6.5 medium | 61.9% | 2012-09-11 |
| CVE-2012-2329 EXP | Buffer overflow in the apache_request_headers function in sapi/cgi/cgi_main.c in PHP 5.4.x before 5.4.3 allows remote attackers to cause a denial of s… | Patch early | 5.0 medium | 61.9% | 2012-05-11 |
| CVE-2013-2370 EXP | Unspecified vulnerability in HP LoadRunner before 11.52 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1671. | Patch early | 7.5 high | 61.9% | 2013-07-29 |
| CVE-2005-0277 EXP | Buffer overflow in the FTP service in 3Com 3CDaemon 2.0 revision 10 allows remote attackers to cause a denial of service (application crash) and execu… | Patch early | 5.0 medium | 61.9% | 2005-05-02 |
| CVE-2012-0124 EXP | Unspecified vulnerability in HP Data Protector Express (aka DPX) 5.0.00 before build 59287 and 6.0.00 before build 11974 allows remote attackers to ex… | Patch early | 10.0 high | 61.9% | 2012-03-14 |
| CVE-2006-1245 EXP | Buffer overflow in mshtml.dll in Microsoft Internet Explorer 6.0.2900.2180, and probably other versions, allows remote attackers to execute arbitrary… | Patch early | 7.5 high | 61.8% | 2006-03-17 |
| CVE-2013-2343 EXP | Unspecified vulnerability on the HP LeftHand Virtual SAN Appliance hydra with software before 10.0 allows remote attackers to execute arbitrary code v… | Patch early | 10.0 high | 61.8% | 2013-07-02 |
| CVE-2007-1061 EXP | SQL injection vulnerability in index.php in Francisco Burzi PHP-Nuke 8.0 Final and earlier, when the "HTTP Referers" block is enabled, allows remote a… | Patch early | 6.8 medium | 61.8% | 2007-02-22 |
| CVE-2007-2969 EXP | PHP remote file inclusion vulnerability in newsletter.php in WAnewsletter 2.1.3 and earlier allows remote attackers to execute arbitrary PHP code via… | Patch early | 7.5 high | 61.7% | 2007-06-01 |
| CVE-2011-5003 EXP | Stack-based buffer overflow in the Phonetic Indexer (AvidPhoneticIndexer.exe) in Avid Media Composer 5.5.3 and earlier allows remote attackers to exec… | Patch early | 10.0 high | 61.7% | 2011-12-25 |
| CVE-2018-9958 EXP | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is requi… | Patch early | 8.8 high | 61.7% | 2018-05-17 |
| CVE-2006-1189 EXP | Buffer overflow in URLMON.DLL in Microsoft Internet Explorer 5.01 through 6 allows remote attackers to execute arbitrary code via a crafted URL with a… | Patch early | 10.0 high | 61.7% | 2006-04-11 |
| CVE-2006-2961 EXP | Stack-based buffer overflow in CesarFTP 0.99g and earlier allows remote attackers to cause a denial of service (application crash) and possibly execut… | Patch early | 7.5 high | 61.7% | 2006-06-12 |
| CVE-2004-1037 EXP | The search function in TWiki 20030201 allows remote attackers to execute arbitrary commands via shell metacharacters in a search string. | Patch early | 10.0 high | 61.7% | 2005-03-01 |
| CVE-2012-1875 EXP | Microsoft Internet Explorer 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a delet… | Patch early | 9.3 high | 61.7% | 2012-06-12 |
| CVE-2013-7108 EXP | Multiple off-by-one errors in Nagios Core 3.5.1, 4.0.2, and earlier, and Icinga before 1.8.5, 1.9 before 1.9.4, and 1.10 before 1.10.2 allow remote au… | Patch early | 5.5 medium | 61.6% | 2014-01-15 |
| CVE-2016-1209 EXP | The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via crafted serialized values in… | Patch early | 9.8 critical | 61.6% | 2016-05-14 |
| CVE-2006-1190 EXP | Microsoft Internet Explorer 5.01 through 6 does not always return the correct IOleClientSite information when dynamically creating an embedded object,… | Patch early | 10.0 high | 61.6% | 2006-04-11 |
| CVE-2015-7602 EXP | Directory traversal vulnerability in BisonWare BisonFTP 3.5 allows remote attackers to read arbitrary files via a ../ (dot dot slash) in a RETR comman… | Patch early | 7.8 high | 61.5% | 2015-09-29 |
| CVE-2007-3632 EXP | Multiple PHP remote file inclusion vulnerabilities in LimeSurvey (aka PHPSurveyor) 1.49RC2 allow remote attackers to execute arbitrary PHP code via a… | Patch early | 6.8 medium | 61.5% | 2007-07-10 |
| CVE-2005-2123 EXP | Multiple integer overflows in the Graphics Rendering Engine (GDI32.DLL) in Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 allow remote attacker… | Patch early | 7.5 high | 61.5% | 2005-11-29 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt