CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
425,729 CVEs
1,781 on KEV
17,555 EPSS ≥ 10%
25,095 with exploits
synced 2026-11-14
12,664 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2013-2088 EXP | contrib/hook-scripts/svn-keyword-check.pl in Subversion before 1.6.23 allows remote authenticated users with commit permissions to execute arbitrary c… | Patch early | 7.1 high | 31.5% | 2013-07-31 |
| CVE-2020-23972 EXP | In Joomla Component GMapFP Version J3.5 and J3.5free, an attacker can access the upload function without authenticating to the application and can als… | Patch early | 7.5 high | 31.4% | 2020-08-27 |
| CVE-2019-9041 EXP | An issue was discovered in ZZZCMS zzzphp V1.6.1. In the inc/zzz_template.php file, the parserIfLabel() function's filtering is not strict, resulting i… | Patch early | 7.2 high | 31.4% | 2019-02-23 |
| CVE-2009-4265 EXP | Stack-based buffer overflow in Ideal Administration 2009 9.7.1, and possibly other versions, allows remote attackers to execute arbitrary code via a l… | Patch early | 9.3 high | 31.4% | 2009-12-10 |
| CVE-2012-0708 EXP | Heap-based buffer overflow in the Ole API in the CQOle ActiveX control in cqole.dll in IBM Rational ClearQuest 7.1.1 before 7.1.1.9, 7.1.2 before 7.1.… | Patch early | 9.3 high | 31.4% | 2012-04-22 |
| CVE-2009-4962 EXP | Stack-based buffer overflow in Fat Player 0.6b allows remote attackers to execute arbitrary code via a long string in a .wav file. NOTE: some of thes… | Patch early | 9.3 high | 31.4% | 2010-07-28 |
| CVE-2007-0427 EXP | Stack-based buffer overflow in Microsoft Help Workshop 4.03.0002 allows user-assisted remote attackers to execute arbitrary code via a help project (.… | Patch early | 9.3 high | 31.4% | 2007-01-23 |
| CVE-2002-0693 EXP | Buffer overflow in the HTML Help ActiveX Control (hhctrl.ocx) in Microsoft Windows 98, 98 Second Edition, Millennium Edition, NT 4.0, NT 4.0 Terminal… | Patch early | 7.5 high | 31.3% | 2002-10-10 |
| CVE-2015-2460 EXP | ATMFD.DLL in the Windows Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Wind… | Patch early | 9.3 high | 31.3% | 2015-08-15 |
| CVE-2007-3493 EXP | A certain ActiveX control in NCTWavChunksEditor2.dll 2.6.1.148 in NCTAudioStudio (NCTAudioStudio2) 2.7, as used by Sienzo DMM and probably other produ… | Patch early | 7.5 high | 31.3% | 2007-06-29 |
| CVE-2020-14425 EXP | Foxit Reader before 10.0 allows Remote Command Execution via the app.opencPDFWebPage JavsScript API. An attacker can execute local files and bypass th… | Patch early | 7.8 high | 31.3% | 2020-11-02 |
| CVE-2010-1465 EXP | Stack-based buffer overflow in Trellian FTP client 3.01, including 3.1.3.1789, allows remote attackers to execute arbitrary code via a long PASV respo… | Patch early | 9.3 high | 31.3% | 2010-04-16 |
| CVE-2006-0143 EXP | Microsoft Windows Graphics Rendering Engine (GRE) allows remote attackers to corrupt memory and cause a denial of service (crash) via a WMF file conta… | Patch early | 7.5 high | 31.3% | 2006-01-09 |
| CVE-2019-0667 EXP | A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'Windows VBScript Engine Remote Code E… | Patch early | 7.5 high | 31.3% | 2019-04-08 |
| CVE-2007-1347 EXP | Microsoft Windows Explorer on Windows 2000 SP4 FR and XP SP2 FR, and possibly other versions and platforms, allows remote attackers to cause a denial… | Patch early | 7.1 high | 31.2% | 2007-03-08 |
| CVE-2002-0702 EXP | Format string vulnerabilities in the logging routines for dynamic DNS code (print.c) of ISC DHCP daemon (DHCPD) 3 to 3.0.1rc8, with the NSUPDATE optio… | Patch early | 10.0 high | 31.1% | 2002-07-26 |
| CVE-2008-6347 EXP | PHP remote file inclusion vulnerability in lib/onguma.class.php in the Onguma Time Sheet (com_ongumatimesheet20) 2.0 4b component for Joomla! allows r… | Patch early | 7.5 high | 31.1% | 2009-03-02 |
| CVE-2009-2566 EXP | Stack-based buffer overflow in TFM MMPlayer 2.0, and possibly 2.0.0.30, allows remote attackers to execute arbitrary code via a long string in a playl… | Patch early | 9.3 high | 31.1% | 2009-07-21 |
| CVE-2011-0499 EXP | Buffer overflow in VideoSpirit Pro 1.6.8.1 and possibly earlier versions, and VideoSpirit Lite 1.4.0.1 and possibly other versions, allows user-assist… | Patch early | 9.3 high | 31% | 2011-01-20 |
| CVE-2021-24146 EXP | Lack of authorisation checks in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly restrict access to the expo… | Patch early | 7.5 high | 31% | 2021-03-18 |
| CVE-2008-0311 EXP | Stack-based buffer overflow in the PGMWebHandler::parse_request function in the StarTeam Multicast Service component (STMulticastService) 6.4 in Borla… | Patch early | 9.3 high | 31% | 2008-04-06 |
| CVE-2013-2569 EXP | A Security Bypass vulnerability exists in Zavio IP Cameras through 1.6.3 because the RTSP protocol authentication is disabled by default, which could… | Patch early | 7.5 high | 31% | 2020-01-29 |
| CVE-2014-8387 EXP | cgi/utility.cgi in Advantech EKI-6340 2.05 Wi-Fi Mesh Access Point allows remote authenticated users to execute arbitrary commands via shell metachara… | Patch early | 9.0 high | 30.9% | 2014-11-20 |
| CVE-2016-1960 EXP | Integer underflow in the nsHtml5TreeBuilder class in the HTML5 string parser in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows re… | Patch early | 8.8 high | 30.9% | 2016-03-13 |
| CVE-2009-1641 EXP | Multiple stack-based buffer overflows in Mini-stream Ripper 3.0.1.1 allow remote attackers to execute arbitrary code via (1) a long rtsp URL in a .ram… | Patch early | 9.3 high | 30.9% | 2009-05-15 |
| CVE-2010-2553 EXP | The Cinepak codec in Microsoft Windows XP SP2 and SP3, Windows Vista SP1 and SP2, and Windows 7 does not properly decompress media files, which allows… | Patch early | 9.3 high | 30.9% | 2010-08-11 |
| CVE-2017-2986 EXP | Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable heap overflow vulnerability in the Flash Video (FLV) codec. Successful exploita… | Patch early | 8.8 high | 30.9% | 2017-02-15 |
| CVE-2008-0470 EXP | A certain ActiveX control in Comodo AntiVirus 2.0 allows remote attackers to execute arbitrary commands via the ExecuteStr method. | Patch early | 9.3 high | 30.9% | 2008-01-29 |
| CVE-2010-5081 EXP | Stack-based buffer overflow in Mini-Stream RM-MP3 Converter 3.1.2.1 allows remote attackers to execute arbitrary code via a long URL in a .pls file. | Patch early | 9.3 high | 30.9% | 2011-12-25 |
| CVE-2018-1133 EXP | An issue was discovered in Moodle 3.x. A Teacher creating a Calculated question can intentionally cause remote code execution on the server, aka eval… | Patch early | 8.8 high | 30.8% | 2018-05-25 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt