CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
425,729 CVEs
1,781 on KEV
17,555 EPSS ≥ 10%
25,095 with exploits
synced 2026-11-14
10,150 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2006-3532 EXP | PHP file inclusion vulnerability in includes/edit_new.php in Pivot 1.30 RC2 and earlier, when register_globals is enabled, allows remote attackers to… | Patch early | 5.1 medium | 8% | 2006-07-12 |
| CVE-2004-2519 EXP | Gattaca Server 2003 1.1.10.0 allows remote attackers to cause a denial of service (CPU consumption) via directory specifiers in the LANGUAGE parameter… | Patch early | 5.0 medium | 8% | 2004-12-31 |
| CVE-2006-0755 EXP | Multiple PHP remote file include vulnerabilities in dotProject 2.0.1 and earlier, when register_globals is enabled, allow remote attackers to execute… | Patch early | 5.6 medium | 8% | 2006-02-18 |
| CVE-2004-2132 EXP | Directory traversal vulnerability in PJreview_Neo.cgi in PJ CGI Neo review allows remote attackers to read arbitrary files via a .. (dot dot) in the… | Patch early | 5.0 medium | 8% | 2004-01-29 |
| CVE-2005-1073 EXP | Directory traversal vulnerability in index.php for RadScripts RadBids Gold 2 allows remote attackers to read arbitrary files via the read parameter. | Patch early | 5.0 medium | 8% | 2005-05-02 |
| CVE-2017-13262 EXP | In bnep_data_ind of bnep_main.cc, there is a possible out of bounds read due to a missing length decrement operation. This could lead to remote inform… | Patch early | 6.5 medium | 8% | 2018-04-04 |
| CVE-2006-2330 EXP | PHP-Fusion 6.00.306 and earlier, running under Apache HTTP Server 1.3.27 and PHP 4.3.3, allows remote authenticated users to upload files of arbitrary… | Patch early | 6.4 medium | 8% | 2006-05-12 |
| CVE-2007-5198 EXP | Buffer overflow in the redir function in check_http.c in Nagios Plugins before 1.4.10, when running with the -f (follow) option, allows remote web ser… | Patch early | 6.8 medium | 8% | 2007-10-04 |
| CVE-2000-0142 EXP | The authentication protocol in Timbuktu Pro 2.0b650 allows remote attackers to cause a denial of service via connections to port 407 and 1417. | Patch early | 5.0 medium | 8% | 2000-02-11 |
| CVE-2008-1888 EXP | Cross-site scripting (XSS) vulnerability in Microsoft Windows SharePoint Services 2.0 allows remote attackers to inject arbitrary web script or HTML v… | Patch early | 4.3 medium | 8% | 2008-04-18 |
| CVE-2000-0671 EXP | Roxen web server earlier than 2.0.69 allows allows remote attackers to bypass access restrictions, list directory contents, and read source code by in… | Patch early | 5.0 medium | 8% | 2000-07-21 |
| CVE-2012-0277 EXP | Heap-based buffer overflow in XnView before 1.99 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitra… | Patch early | 6.8 medium | 8% | 2012-07-17 |
| CVE-2008-5856 EXP | Directory traversal vulnerability in scripts/export.php in ClaSS before 0.8.61 allows remote attackers to read arbitrary files via directory traversal… | Patch early | 5.0 medium | 8% | 2009-01-06 |
| CVE-2015-6972 EXP | Multiple cross-site scripting (XSS) vulnerabilities in Ignite Realtime Openfire 3.10.2 allow remote attackers to inject arbitrary web script or HTML v… | Patch early | 4.3 medium | 8% | 2015-09-16 |
| CVE-2017-5798 EXP | A Remote Code Execution vulnerability in HPE OpenCall Media Platform (OCMP) was found. The vulnerability impacts OCMP versions prior to 3.4.2 RP201 (f… | Patch early | 6.1 medium | 8% | 2018-02-15 |
| CVE-2006-1784 EXP | PHP remote file inclusion vulnerability in admin/configset.php in Sphider 1.3 and earlier, when register_globals is disabled, allows remote attackers… | Patch early | 5.1 medium | 8% | 2006-04-13 |
| CVE-2018-11415 EXP | SAP Internet Transaction Server (ITS) 6200.X.X has Reflected Cross Site Scripting (XSS) via certain wgate URIs. NOTE: the vendor has reportedly indica… | Patch early | 6.1 medium | 8% | 2018-05-24 |
| CVE-2002-0741 EXP | psyBNC 2.3 allows remote attackers to cause a denial of service (CPU consumption and resource exhaustion) by sending a PASS command with a long passwo… | Patch early | 5.0 medium | 8% | 2002-08-12 |
| CVE-2013-5123 EXP | The mirroring support (-M, --use-mirrors) in Python Pip before 1.5 uses insecure DNS querying and authenticity checks which allows attackers to perfor… | Patch early | 5.9 medium | 8% | 2019-11-05 |
| CVE-2004-0580 EXP | DHCP on Linksys BEFSR11, BEFSR41, BEFSR81, and BEFSRU31 Cable/DSL Routers, firmware version 1.45.7, does not properly clear previously used buffer con… | Patch early | 5.0 medium | 8% | 2004-08-06 |
| CVE-2008-0399 EXP | Multiple buffer overflows in Toshiba Surveillance (Surveillix) RecordSend ActiveX control (MeIpCamX.DLL 1.0.0.4) allow remote attackers to execute arb… | Patch early | 6.8 medium | 8% | 2008-01-23 |
| CVE-2000-0652 EXP | IBM WebSphere allows remote attackers to read source code for executable web files by directly calling the default InvokerServlet using a URL which co… | Patch early | 5.0 medium | 8% | 2000-07-24 |
| CVE-2004-2117 EXP | Tiny Server 1.1 allows remote attackers to cause a denial of service (crash) via malformed HTTP requests such as (1) a GET request without the HTTP ve… | Patch early | 5.0 medium | 8% | 2004-01-24 |
| CVE-2012-0789 EXP | Memory leak in the timezone functionality in PHP before 5.3.9 allows remote attackers to cause a denial of service (memory consumption) by triggering… | Patch early | 5.0 medium | 8% | 2012-02-14 |
| CVE-2007-1060 EXP | Multiple PHP remote file inclusion vulnerabilities in Interspire SendStudio 2004.14 and earlier, when register_globals and allow_fopenurl are enabled,… | Patch early | 6.8 medium | 8% | 2007-02-22 |
| CVE-2000-0705 EXP | ntop running in web mode allows remote attackers to read arbitrary files via a .. (dot dot) attack. | Patch early | 5.0 medium | 8% | 2000-10-20 |
| CVE-2000-1177 EXP | bb-hist.sh, bb-histlog.sh, bb-hostsvc.sh, bb-rep.sh, bb-replog.sh, and bb-ack.sh in Big Brother (BB) before 1.5d3 allows remote attackers to determine… | Patch early | 5.0 medium | 8% | 2001-01-09 |
| CVE-2004-0293 EXP | Directory traversal vulnerability in ShopCartCGI 2.3 allows remote attackers to retrieve arbitrary files via a .. (dot dot) in a HTTP request to (1) g… | Patch early | 5.0 medium | 8% | 2004-11-23 |
| CVE-2004-0327 EXP | Directory traversal vulnerability in functions.php in PhpNewsManager 1.46 allows remote attackers to retrieve arbitrary files via .. (dot dot) sequen… | Patch early | 5.0 medium | 8% | 2004-11-23 |
| CVE-2015-2125 EXP | Unspecified vulnerability in HP WebInspect 7.x through 10.4 before 10.4 update 1 allows remote authenticated users to bypass intended access restricti… | Patch early | 4.0 medium | 7.9% | 2015-06-07 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt