CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
425,750 CVEs
1,781 on KEV
17,555 EPSS ≥ 10%
25,095 with exploits
synced 2026-11-14
25,095 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2007-3216 EXP | Multiple buffer overflows in the LGServer component of CA (Computer Associates) BrightStor ARCserve Backup for Laptops and Desktops r11.1 allow remote… | Patch early | 10.0 high | 59.2% | 2007-06-14 |
| CVE-2008-4037 EXP | Microsoft Windows 2000 Gold through SP4, XP Gold through SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 allows remote SMB servers t… | Patch early | 9.3 high | 59.1% | 2008-11-12 |
| CVE-2006-2237 EXP | The web interface for AWStats 6.4 and 6.5, when statistics updates are enabled, allows remote attackers to execute arbitrary code via shell metacharac… | Patch early | 5.1 medium | 59.1% | 2006-05-08 |
| CVE-2017-1000170 EXP | jqueryFileTree 2.1.5 and older Directory Traversal | Patch early | 7.5 high | 59.1% | 2017-11-17 |
| CVE-2020-36847 EXP | The Simple-File-List Plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 4.2.2 via the rename function which… | Patch early | 9.8 critical | 59% | 2025-07-12 |
| CVE-2012-0549 EXP | Unspecified vulnerability in the Oracle AutoVue Office component in Oracle Supply Chain Products Suite 20.1.1 allows remote attackers to affect confid… | Patch early | 7.5 high | 59% | 2012-05-03 |
| CVE-2008-2463 EXP | The Microsoft Office Snapshot Viewer ActiveX control in snapview.ocx 10.0.5529.0, as distributed in the standalone Snapshot Viewer and Microsoft Offic… | Patch early | 6.8 medium | 59% | 2008-07-07 |
| CVE-2014-10021 EXP | Unrestricted file upload vulnerability in UploadHandler.php in the WP Symposium plugin 14.11 for WordPress allows remote attackers to execute arbitrar… | Patch early | 7.5 high | 59% | 2015-01-13 |
| CVE-2007-3386 EXP | Cross-site scripting (XSS) vulnerability in the Host Manager Servlet for Apache Tomcat 6.0.0 to 6.0.13 and 5.5.0 to 5.5.24 allows remote attackers to… | Patch early | 4.3 medium | 59% | 2007-08-14 |
| CVE-2006-5229 EXP | OpenSSH portable 4.1 on SUSE Linux, and possibly other platforms and versions, and possibly under limited configurations, allows remote attackers to d… | Patch early | 2.6 low | 58.9% | 2006-10-10 |
| CVE-2008-0506 EXP | include/imageObjectIM.class.php in Coppermine Photo Gallery (CPG) before 1.4.15, when the ImageMagick picture processing method is configured, allows… | Patch early | 6.8 medium | 58.9% | 2008-01-31 |
| CVE-2021-46381 EXP | Local File Inclusion due to path traversal in D-Link DAP-1620 leads to unauthorized internal files reading [/etc/passwd] and [/etc/shadow]. | Patch early | 7.5 high | 58.9% | 2022-03-04 |
| CVE-2000-0574 EXP | FTP servers such as OpenBSD ftpd, NetBSD ftpd, ProFTPd and Opieftpd do not properly cleanse untrusted format strings that are used in the setproctitle… | Patch early | 5.0 medium | 58.9% | 2000-07-07 |
| CVE-2011-4404 EXP | The default configuration of the HTTP server in Jetty in vSphere Update Manager in VMware vCenter Update Manager 4.0 before Update 4 and 4.1 before Up… | Patch early | 5.0 medium | 58.9% | 2011-11-19 |
| CVE-2011-1996 EXP | Microsoft Internet Explorer 6 through 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessi… | Patch early | 9.3 high | 58.8% | 2011-10-12 |
| CVE-2012-4347 EXP | Multiple directory traversal vulnerabilities in the management console in Symantec Messaging Gateway (SMG) 9.5.x allow remote authenticated users to r… | Patch early | 5.0 medium | 58.8% | 2012-12-05 |
| CVE-2013-1559 EXP | Unspecified vulnerability in the Oracle WebCenter Content component in Oracle Fusion Middleware 10.1.3.5.1 and 11.1.1.6.0 allows remote authenticated… | Patch early | 4.0 medium | 58.8% | 2013-04-17 |
| CVE-2003-0605 EXP | The RPC DCOM interface in Windows 2000 SP3 and SP4 allows remote attackers to cause a denial of service (crash), and local attackers to use the DoS to… | Patch early | 7.5 high | 58.8% | 2003-08-27 |
| CVE-2019-5485 EXP | NPM package gitlabhook version 0.0.17 is vulnerable to a Command Injection vulnerability. Arbitrary commands can be injected through the repository na… | Patch early | 10.0 critical | 58.8% | 2019-09-13 |
| CVE-2018-0707 EXP | Command injection vulnerability in change password of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated users to… | Patch early | 7.2 high | 58.8% | 2018-07-17 |
| CVE-2006-1364 EXP | Microsoft w3wp (aka w3wp.exe) does not properly handle when the AspCompat directive is not used when referencing COM components in ASP.NET, which allo… | Patch early | 7.5 high | 58.7% | 2006-03-23 |
| CVE-2004-0942 EXP | Apache webserver 2.0.52 and earlier allows remote attackers to cause a denial of service (CPU consumption) via an HTTP GET request with a MIME header… | Patch early | 5.0 medium | 58.7% | 2005-02-09 |
| CVE-2012-0432 EXP | Stack-based buffer overflow in the Novell NCP implementation in NetIQ eDirectory 8.8.7.x before 8.8.7.2 allows remote attackers to have an unspecified… | Patch early | 10.0 high | 58.7% | 2012-12-25 |
| CVE-2002-0654 EXP | Apache 2.0 through 2.0.39 on Windows, OS2, and Netware allows remote attackers to determine the full pathname of the server via (1) a request for a .v… | Patch early | 5.0 medium | 58.7% | 2002-09-05 |
| CVE-2008-5619 EXP | html2text.php in Chuggnutt HTML to Text Converter, as used in PHPMailer before 5.2.10, RoundCube Webmail (roundcubemail) 0.2-1.alpha and 0.2-3.beta, M… | Patch early | 10.0 high | 58.6% | 2008-12-17 |
| CVE-2013-2068 EXP | Multiple directory traversal vulnerabilities in the AgentController in Red Hat CloudForms Management Engine 2.0 allow remote attackers to create and o… | Patch early | 9.4 high | 58.6% | 2013-09-28 |
| CVE-2015-7601 EXP | Directory traversal vulnerability in PCMan's FTP Server 2.0.7 allows remote attackers to read arbitrary files via a ..// (dot dot double slash) in a R… | Patch early | 7.8 high | 58.6% | 2015-09-29 |
| CVE-2021-42840 EXP | SuiteCRM before 7.11.19 allows remote code execution via the system settings Log File Name setting. In certain circumstances involving admin account t… | Patch early | 8.8 high | 58.6% | 2021-10-22 |
| CVE-2004-1305 EXP | The Windows Animated Cursor (ANI) capability in Windows NT, Windows 2000 through SP4, Windows XP through SP1, and Windows 2003 allow remote attackers… | Patch early | 5.0 medium | 58.6% | 2004-12-23 |
| CVE-2019-12347 EXP | In pfSense 2.4.4-p3, a stored XSS vulnerability occurs when attackers inject a payload into the Name or Description field via an acme_accountkeys_edit… | Patch early | 6.1 medium | 58.6% | 2019-05-29 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt