CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
425,750 CVEs
1,781 on KEV
17,555 EPSS ≥ 10%
25,095 with exploits
synced 2026-11-14
25,095 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2007-4712 EXP | PHP remote file inclusion vulnerability in index.php in eNetman 1 allows remote attackers to execute arbitrary PHP code via a URL in the page paramete… | Patch early | 7.5 high | 57.9% | 2007-09-05 |
| CVE-2005-0554 EXP | Buffer overflow in the URL processor of Microsoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to cause a denial of service (crash) and… | Patch early | 7.5 high | 57.9% | 2005-05-02 |
| CVE-2008-0081 EXP | Unspecified vulnerability in Microsoft Excel 2000 SP3 through 2003 SP2, Viewer 2003, and Office 2004 for Mac allows user-assisted remote attackers to… | Patch early | 9.8 critical | 57.9% | 2008-01-16 |
| CVE-2016-7194 EXP | The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via… | Patch early | 7.5 high | 57.9% | 2016-10-14 |
| CVE-2018-7314 EXP | SQL Injection exists in the PrayerCenter 3.0.2 component for Joomla! via the sessionid parameter, a different vulnerability than CVE-2008-6429. | Patch early | 9.8 critical | 57.8% | 2018-02-22 |
| CVE-2019-10475 EXP | A reflected cross-site scripting vulnerability in Jenkins build-metrics Plugin allows attackers to inject arbitrary HTML and JavaScript into web pages… | Patch early | 6.1 medium | 57.7% | 2019-10-23 |
| CVE-2018-6605 EXP | SQL Injection exists in the Zh BaiduMap 3.0.0.1 component for Joomla! via the id parameter in a getPlacemarkDetails, getPlacemarkHoverText, getPathHov… | Patch early | 9.8 critical | 57.7% | 2018-02-05 |
| CVE-2014-2850 EXP | The network interface configuration page (netinterface) in Sophos Web Appliance before 3.8.2 allows remote administrators to execute arbitrary command… | Patch early | 8.5 high | 57.6% | 2014-04-11 |
| CVE-2006-1188 EXP | Microsoft Internet Explorer 5.01 through 6 allows remote attackers to execute arbitrary code via HTML elements with a certain crafted tag, which leads… | Patch early | 7.5 high | 57.6% | 2006-04-11 |
| CVE-2008-4654 EXP | Stack-based buffer overflow in the parse_master function in the Ty demux plugin (modules/demux/ty.c) in VLC Media Player 0.9.0 through 0.9.4 allows re… | Patch early | 9.3 high | 57.5% | 2008-10-22 |
| CVE-2014-5377 EXP | ReadUsersFromMasterServlet in ManageEngine DeviceExpert before 5.9 build 5981 allows remote attackers to obtain user account credentials via a direct… | Patch early | 5.0 medium | 57.5% | 2014-09-04 |
| CVE-2016-8582 EXP | A vulnerability exists in gauge.php of AlienVault OSSIM and USM before 5.3.2 that allows an attacker to execute an arbitrary SQL query and retrieve da… | Patch early | 9.8 critical | 57.4% | 2016-10-28 |
| CVE-2017-6526 EXP | An issue was discovered in dnaTools dnaLIMS 4-2015s13. dnaLIMS is vulnerable to unauthenticated command execution through an improperly protected admi… | Patch early | 9.8 critical | 57.4% | 2017-03-09 |
| CVE-2004-0209 EXP | Unknown vulnerability in the Graphics Rendering Engine processes of Microsoft Windows 2000, Windows XP, and Windows Server 2003 allows remote attacker… | Patch early | 10.0 high | 57.4% | 2004-11-03 |
| CVE-2019-14931 EXP | An issue was discovered on Mitsubishi Electric Europe B.V. ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. An unauthenticated remote… | Patch early | 9.8 critical | 57.4% | 2019-10-28 |
| CVE-2014-100015 EXP | Directory traversal vulnerability in pdmwService.exe in SolidWorks Workgroup PDM 2014 allows remote attackers to write to arbitrary files via a .. (do… | Patch early | 6.4 medium | 57.4% | 2015-01-13 |
| CVE-2005-1218 EXP | The Microsoft Windows kernel in Microsoft Windows 2000 Server, Windows XP, and Windows Server 2003 allows remote attackers to cause a denial of servic… | Patch early | 5.0 medium | 57.3% | 2005-08-10 |
| CVE-2020-15922 EXP | There is an OS Command Injection in Mida eFramework 2.9.0 that allows an attacker to achieve Remote Code Execution (RCE) with administrative (root) pr… | Patch early | 9.8 critical | 57.3% | 2020-07-24 |
| CVE-2006-3440 EXP | Buffer overflow in the Winsock API in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 allows remote attackers to execute arbitrary cod… | Patch early | 10.0 high | 57.3% | 2006-08-09 |
| CVE-2006-4364 EXP | Multiple heap-based buffer overflows in the POP3 server in Alt-N Technologies MDaemon before 9.0.6 allow remote attackers to cause a denial of service… | Patch early | 5.0 medium | 57.3% | 2006-08-27 |
| CVE-2007-1579 EXP | Stack-based buffer overflow in Atrium MERCUR IMAPD allows remote attackers to have an unknown impact via a certain SUBSCRIBE command. | Patch early | 10.0 high | 57.3% | 2007-03-21 |
| CVE-2010-1899 EXP | Stack consumption vulnerability in the ASP implementation in Microsoft Internet Information Services (IIS) 5.1, 6.0, 7.0, and 7.5 allows remote attack… | Patch early | 4.3 medium | 57.2% | 2010-09-15 |
| CVE-2016-0100 EXP | Microsoft Windows Vista SP2 and Server 2008 SP2 mishandle library loading, which allows local users to gain privileges via a crafted application, aka… | Patch early | 8.4 high | 57.2% | 2016-03-09 |
| CVE-2019-5029 EXP | An exploitable command injection vulnerability exists in the Config editor of the Exhibitor Web UI versions 1.0.9 to 1.7.1. Arbitrary shell commands s… | Patch early | 9.8 critical | 57.2% | 2019-11-13 |
| CVE-2008-0532 EXP | Multiple buffer overflows in securecgi-bin/CSuserCGI.exe in User-Changeable Password (UCP) before 4.2 in Cisco Secure Access Control Server (ACS) for… | Patch early | 10.0 high | 57.1% | 2008-03-14 |
| CVE-2013-3632 EXP | The Cron service in rpc.php in OpenMediaVault allows remote authenticated users to execute cron jobs as arbitrary users and execute arbitrary commands… | Patch early | 8.8 high | 57.1% | 2014-09-29 |
| CVE-2011-3497 EXP | service.exe in Measuresoft ScadaPro 4.0.0 and earlier allows remote attackers to execute arbitrary DLL functions via the XF function, possibly related… | Patch early | 10.0 high | 57.1% | 2011-09-16 |
| CVE-2008-1358 EXP | Stack-based buffer overflow in the IMAP server in Alt-N Technologies MDaemon 9.6.4 allows remote authenticated users to execute arbitrary code via a F… | Patch early | 6.5 medium | 57.1% | 2008-03-17 |
| CVE-2019-5434 EXP | An attacker could send a specifically crafted payload to the XML-RPC invocation script and trigger the unserialize() call on the "what" parameter in t… | Patch early | 9.8 critical | 57% | 2019-05-06 |
| CVE-2005-1009 EXP | Multiple buffer overflows in BakBone NetVault 6.x and 7.x allow (1) remote attackers to execute arbitrary code via a modified computer name and length… | Patch early | 10.0 high | 57% | 2005-05-02 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt