CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
399,516 CVEs
1,729 on KEV
17,272 EPSS ≥ 10%
25,086 with exploits
synced 2026-09-30
12,661 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2011-3315 EXP | Directory traversal vulnerability in Cisco Unified Communications Manager (CUCM) 5.x and 6.x before 6.1(5)SU2, 7.x before 7.1(5b)SU2, and 8.x before 8… | Patch early | 7.8 high | 25.7% | 2011-10-27 |
| CVE-2018-4935 EXP | Adobe Flash Player versions 29.0.0.113 and earlier have an exploitable out-of-bounds write vulnerability. Successful exploitation could lead to arbitr… | Patch early | 8.8 high | 25.7% | 2018-05-19 |
| CVE-2018-4937 EXP | Adobe Flash Player versions 29.0.0.113 and earlier have an exploitable out-of-bounds write vulnerability. Successful exploitation could lead to arbitr… | Patch early | 8.8 high | 25.7% | 2018-05-19 |
| CVE-2002-0724 EXP | Buffer overflow in SMB (Server Message Block) protocol in Microsoft Windows NT, Windows 2000, and Windows XP allows attackers to cause a denial of ser… | Patch early | 7.5 high | 25.7% | 2002-09-24 |
| CVE-2008-6483 EXP | PHP remote file inclusion vulnerability in admin.googlebase.php in the Ecom Solutions VirtueMart Google Base (aka com_googlebase or Froogle) component… | Patch early | 7.5 high | 25.7% | 2009-03-18 |
| CVE-2010-3749 EXP | The browser-plugin implementation in RealNetworks RealPlayer 11.0 through 11.1 and RealPlayer SP 1.0 through 1.1 allows remote attackers to arguments… | Patch early | 9.3 high | 25.6% | 2010-10-19 |
| CVE-2009-1492 EXP | The getAnnots Doc method in the JavaScript API in Adobe Reader and Acrobat 9.1, 8.1.4, 7.1.1, and earlier allows remote attackers to cause a denial of… | Patch early | 9.3 high | 25.5% | 2009-04-30 |
| CVE-2005-2340 EXP | Heap-based buffer overflow in Apple Quicktime before 7.0.4 allows remote attackers to execute arbitrary code via a crafted (1) QuickTime Image File (Q… | Patch early | 7.5 high | 25.5% | 2005-12-31 |
| CVE-2015-3073 EXP | Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to bypass intended restrictions on JavaScript… | Patch early | 10.0 high | 25.5% | 2015-05-13 |
| CVE-2015-8634 EXP | Use-after-free vulnerability in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 o… | Patch early | 8.8 high | 25.5% | 2015-12-28 |
| CVE-2015-8635 EXP | Use-after-free vulnerability in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 o… | Patch early | 8.8 high | 25.5% | 2015-12-28 |
| CVE-2015-1489 EXP | The management console in Symantec Endpoint Protection Manager (SEPM) 12.1 before 12.1-RU6-MP1 allows remote authenticated users to gain privileges vi… | Patch early | 8.5 high | 25.4% | 2015-08-01 |
| CVE-2022-23046 EXP | PhpIPAM v1.4.4 allows an authenticated admin user to inject SQL sentences in the "subnet" parameter while searching a subnet via app/admin/routing/edi… | Patch early | 7.2 high | 25.2% | 2022-01-19 |
| CVE-2019-0572 EXP | An elevation of privilege vulnerability exists when the Windows Data Sharing Service improperly handles file operations, aka "Windows Data Sharing Ser… | Patch early | 7.8 high | 25.1% | 2019-01-08 |
| CVE-2013-3568 EXP | Cross-site request forgery (CSRF) vulnerability in Cisco Linksys WRT110 allows remote attackers to hijack the authentication of users for requests tha… | Patch early | 8.8 high | 25.1% | 2020-02-06 |
| CVE-2003-0411 EXP | Sun ONE Application Server 7.0 for Windows 2000/XP allows remote attackers to obtain JSP source code via a request that uses the uppercase ".JSP" exte… | Patch early | 7.5 high | 25.1% | 2003-06-30 |
| CVE-2012-1226 EXP | Multiple directory traversal vulnerabilities in Dolibarr CMS 3.2.0 Alpha allow remote attackers to read arbitrary files and possibly execute arbitrary… | Patch early | 7.5 high | 25.1% | 2012-02-21 |
| CVE-2004-0557 EXP | Multiple buffer overflows in the st_wavstartread function in wav.c for Sound eXchange (SoX) 12.17.2 through 12.17.4 allow remote attackers to execute… | Patch early | 10.0 high | 25.1% | 2004-08-06 |
| CVE-2016-1001 EXP | Heap-based buffer overflow in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577… | Patch early | 8.8 high | 25.1% | 2016-03-12 |
| CVE-2014-5006 EXP | Directory traversal vulnerability in ZOHO ManageEngine Desktop Central (DC) before 9 build 90055 allows remote attackers to execute arbitrary code via… | Patch early | 7.5 high | 25.1% | 2014-10-21 |
| CVE-2017-2930 EXP | Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable memory corruption vulnerability due to a concurrency error when manipulating a… | Patch early | 8.8 high | 25.1% | 2017-01-11 |
| CVE-2018-12617 EXP | qmp_guest_file_read in qga/commands-posix.c and qga/commands-win32.c in qemu-ga (aka QEMU Guest Agent) in QEMU 2.12.50 has an integer overflow causing… | Patch early | 7.5 high | 25.1% | 2018-06-21 |
| CVE-2013-3115 EXP | Microsoft Internet Explorer 7 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf… | Patch early | 9.3 high | 25% | 2013-07-10 |
| CVE-2013-3145 EXP | Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web sit… | Patch early | 9.3 high | 25% | 2013-07-10 |
| CVE-2013-3147 EXP | Microsoft Internet Explorer 6 through 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craft… | Patch early | 9.3 high | 25% | 2013-07-10 |
| CVE-2013-3148 EXP | Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf… | Patch early | 9.3 high | 25% | 2013-07-10 |
| CVE-2013-3149 EXP | Microsoft Internet Explorer 7 and 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted w… | Patch early | 9.3 high | 25% | 2013-07-10 |
| CVE-2013-3150 EXP | Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web sit… | Patch early | 9.3 high | 25% | 2013-07-10 |
| CVE-2013-3153 EXP | Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf… | Patch early | 9.3 high | 25% | 2013-07-10 |
| CVE-2013-3161 EXP | Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted… | Patch early | 9.3 high | 25% | 2013-07-10 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt