CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
425,750 CVEs
1,781 on KEV
17,555 EPSS ≥ 10%
25,095 with exploits
synced 2026-11-14
25,095 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2013-1428 EXP | Stack-based buffer overflow in the receive_tcppacket function in net_packet.c in tinc before 1.0.21 and 1.1 before 1.1pre7 allows remote authenticated… | Patch early | 6.5 medium | 60.7% | 2013-04-26 |
| CVE-2015-7603 EXP | Directory traversal vulnerability in Konica Minolta FTP Utility 1.0 allows remote attackers to read arbitrary files via a ..\ (dot dot backslash) in a… | Patch early | 7.8 high | 60.7% | 2015-09-29 |
| CVE-2014-4725 EXP | The MailPoet Newsletters (wysija-newsletters) plugin before 2.6.7 for WordPress allows remote attackers to bypass authentication and execute arbitrary… | Patch early | 7.5 high | 60.7% | 2014-07-27 |
| CVE-2013-4074 EXP | The dissect_capwap_data function in epan/dissectors/packet-capwap.c in the CAPWAP dissector in Wireshark 1.6.x before 1.6.16 and 1.8.x before 1.8.8 in… | Patch early | 5.0 medium | 60.6% | 2013-06-09 |
| CVE-2012-4711 EXP | Buffer overflow in kingMess.exe 65.20.2003.10300 in WellinTech KingView 6.52, kingMess.exe 65.20.2003.10400 in KingView 6.53, and kingMess.exe 65.50.2… | Patch early | 10.0 high | 60.6% | 2013-02-15 |
| CVE-2008-5444 EXP | Unspecified vulnerability in the Oracle Secure Backup component in Oracle Secure Backup 10.2.0.2 allows remote attackers to affect confidentiality, in… | Patch early | 10.0 high | 60.6% | 2009-01-14 |
| CVE-2004-2416 EXP | Buffer overflow in the logging component of CCProxy allows remote attackers to execute arbitrary code via a long HTTP GET request. | Patch early | 7.5 high | 60.6% | 2004-12-31 |
| CVE-2018-3639 EXP | Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addresses of all prior memory writes… | Patch early | 5.5 medium | 60.4% | 2018-05-22 |
| CVE-2010-0478 EXP | Stack-based buffer overflow in nsum.exe in the Windows Media Unicast Service in Media Services for Microsoft Windows 2000 Server SP4 allows remote att… | Patch early | 9.3 high | 60.4% | 2010-04-14 |
| CVE-2005-2715 EXP | Format string vulnerability in the Java user interface service (bpjava-msvc) daemon for VERITAS NetBackup Data and Business Center 4.5FP and 4.5MP, an… | Patch early | 10.0 high | 60.4% | 2005-10-12 |
| CVE-2004-0184 EXP | Integer underflow in the isakmp_id_print for TCPDUMP 3.8.1 and earlier allows remote attackers to cause a denial of service (crash) via an ISAKMP pack… | Patch early | 5.0 medium | 60.3% | 2004-05-04 |
| CVE-2023-4547 EXP | A flaw has been found in SPA-Cart eCommerce CMS 1.9.0.3. The affected element is an unknown function of the file /search. This manipulation of the arg… | Patch early | 3.5 low | 60.3% | 2023-08-26 |
| CVE-2017-15222 EXP | Buffer Overflow vulnerability in Ayukov NFTPD 2.0 and earlier allows remote attackers to execute arbitrary code. | Patch early | 9.8 critical | 60.3% | 2017-10-24 |
| CVE-2002-1059 EXP | Buffer overflow in Van Dyke SecureCRT SSH client before 3.4.6, and 4.x before 4.0 beta 3, allows an SSH server to execute arbitrary code via a long SS… | Patch early | 7.5 high | 60.3% | 2002-10-04 |
| CVE-2004-0575 EXP | Integer overflow in DUNZIP32.DLL for Microsoft Windows XP, Windows XP 64-bit Edition, Windows Server 2003, and Windows Server 2003 64-bit Edition allo… | Patch early | 10.0 high | 60.3% | 2004-11-03 |
| CVE-2006-6424 EXP | Multiple buffer overflows in Novell NetMail before 3.52e FTF2 allow remote attackers to execute arbitrary code (1) by appending literals to certain IM… | Patch early | 9.0 high | 60.3% | 2006-12-27 |
| CVE-2007-2280 EXP | Stack-based buffer overflow in OmniInet.exe (aka the backup client service daemon) in the Application Recovery Manager component in HP OpenView Storag… | Patch early | 10.0 high | 60.3% | 2009-12-18 |
| CVE-2015-8399 EXP | Atlassian Confluence before 5.8.17 allows remote authenticated users to read configuration files via the decoratorName parameter to (1) spaces/viewdef… | Patch early | 4.3 medium | 60.2% | 2016-04-11 |
| CVE-2007-1373 EXP | Stack-based buffer overflow in Mercury/32 (aka Mercury Mail Transport System) 4.01b and earlier allows remote attackers to execute arbitrary code via… | Patch early | 10.0 high | 60.2% | 2007-03-10 |
| CVE-2010-2333 EXP | LiteSpeed Technologies LiteSpeed Web Server 4.0.x before 4.0.15 allows remote attackers to read the source code of scripts via an HTTP request with a… | Patch early | 5.0 medium | 60.2% | 2010-06-18 |
| CVE-2019-12276 EXP | A Path Traversal vulnerability in Controllers/LetsEncryptController.cs in LetsEncryptController in GrandNode 4.40 allows remote, unauthenticated attac… | Patch early | 7.5 high | 60.1% | 2019-06-05 |
| CVE-2021-24499 EXP | The Workreap WordPress theme before 2.2.2 AJAX actions workreap_award_temp_file_uploader and workreap_temp_file_uploader did not perform nonce checks,… | Patch early | 9.8 critical | 60.1% | 2021-08-09 |
| CVE-2011-0257 EXP | Integer signedness error in Apple QuickTime before 7.7 allows remote attackers to execute arbitrary code or cause a denial of service (application cra… | Patch early | 9.3 high | 60.1% | 2011-08-15 |
| CVE-2007-4744 EXP | PHP remote file inclusion vulnerability in environment.php in AnyInventory 1.9.1 and 2.0, when register_globals is enabled, allows remote attackers to… | Patch early | 6.8 medium | 60.1% | 2007-09-06 |
| CVE-2005-0595 EXP | Buffer overflow in ext.dll in BadBlue 2.55 allows remote attackers to execute arbitrary code via a long mfcisapicommand parameter. | Patch early | 7.5 high | 60.1% | 2005-05-02 |
| CVE-2012-2576 EXP | SQL injection vulnerability in the LoginServlet page in SolarWinds Storage Manager before 5.1.2, SolarWinds Storage Profiler before 5.1.2, and SolarWi… | Patch early | 9.8 critical | 60% | 2017-12-20 |
| CVE-2013-0810 EXP | Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, and Windows Server 2008 SP2 allow remote attackers to execute arbitrary… | Patch early | 8.1 high | 59.9% | 2013-09-11 |
| CVE-2024-31621 EXP | An issue in FlowiseAI Inc Flowise v.1.6.2 and before allows a remote attacker to execute arbitrary code via a crafted script to the api/v1 component. | Patch early | 7.6 high | 59.9% | 2024-04-29 |
| CVE-2014-100002 EXP | Directory traversal vulnerability in ManageEngine SupportCenter Plus 7.9 before 7917 allows remote attackers to read arbitrary files via a ..%2f (dot… | Patch early | 5.0 medium | 59.9% | 2015-01-13 |
| CVE-2013-3763 EXP | Unspecified vulnerability in the Oracle Endeca Server component in Oracle Fusion Middleware 7.4.0 and 7.5.1.1 allows remote authenticated users to aff… | Patch early | 5.5 medium | 59.8% | 2013-07-17 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt