CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
425,731 CVEs
1,781 on KEV
17,555 EPSS ≥ 10%
25,095 with exploits
synced 2026-11-14
10,150 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2004-1696 EXP | EmuLive Server4 Commerce Edition Build 7560 allows remote attackers to cause a denial of service (application crash) via a sequence of carriage return… | Patch early | 5.0 medium | 7.6% | 2004-09-21 |
| CVE-2012-0937 EXP | wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier does not limit the number of MySQL queries sent to external MyS… | Patch early | 5.0 medium | 7.6% | 2012-01-30 |
| CVE-2009-5067 EXP | Directory traversal vulnerability in html2ps before 1.0b6 allows remote attackers to read arbitrary files via a .. (dot dot) in the "include file" SSI… | Patch early | 4.3 medium | 7.6% | 2012-10-10 |
| CVE-2006-4424 EXP | PHP remote file inclusion vulnerability in coin_includes/constants.php in phpCOIN 1.2.3 allows remote attackers to execute arbitrary PHP code via the… | Patch early | 5.1 medium | 7.6% | 2006-08-29 |
| CVE-2006-4845 EXP | PHP remote file inclusion vulnerability in includes/footer.html.inc.php in TeamCal Pro 2.8.001 and earlier allows remote attackers to execute arbitrar… | Patch early | 5.1 medium | 7.6% | 2006-09-19 |
| CVE-2007-0228 EXP | The DataCollector service in EIQ Networks Network Security Analyzer allows remote attackers to cause a denial of service (service crash) via a (1) &CO… | Patch early | 5.0 medium | 7.6% | 2007-01-13 |
| CVE-2001-1212 EXP | Cross-site scripting vulnerability in catgy.cgi for Aktivate 1.03 allows remote attackers to execute arbitrary Javascript via the desc parameter. | Patch early | 5.0 medium | 7.6% | 2001-12-18 |
| CVE-2014-4306 EXP | Directory traversal vulnerability in logs-x.php in WebTitan before 4.04 allows remote attackers to read arbitrary files via a .. (dot dot) in the logf… | Patch early | 5.0 medium | 7.6% | 2014-06-18 |
| CVE-2013-1807 EXP | PHP-Fusion before 7.02.06 stores backup files with predictable filenames in an unrestricted directory under the web document root, which might allow r… | Patch early | 5.0 medium | 7.6% | 2014-04-30 |
| CVE-2004-0437 EXP | Titan FTP Server version 3.01 build 163, and possibly other versions before build 169, allows remote authenticated users to cause a denial of service… | Patch early | 5.0 medium | 7.6% | 2004-07-07 |
| CVE-2005-0739 EXP | The IAPP dissector (packet-iapp.c) for Ethereal 0.9.1 to 0.10.9 does not properly use certain routines for formatting strings, which could leave it vu… | Patch early | 5.0 medium | 7.6% | 2005-05-02 |
| CVE-2010-3456 EXP | Directory traversal vulnerability in download.php in EnergyScripts (ES) Simple Download 1.0 allows remote attackers to read arbitrary files via a .. (… | Patch early | 5.0 medium | 7.6% | 2010-09-17 |
| CVE-2021-27519 EXP | A cross-site scripting (XSS) issue in FUDForum 3.1.0 allows remote attackers to inject JavaScript via index.php in the "srch" parameter. | Patch early | 6.1 medium | 7.6% | 2021-03-19 |
| CVE-2010-0314 EXP | Apple Safari allows remote attackers to discover a redirect's target URL, for the session of a specific user of a web site, by placing the site's URL… | Patch early | 5.0 medium | 7.6% | 2010-01-14 |
| CVE-2016-6512 EXP | epan/dissectors/packet-wap.c in Wireshark 2.x before 2.0.5 omits an overflow check in the tvb_get_guintvar function, which allows remote attackers to… | Patch early | 5.9 medium | 7.6% | 2016-08-06 |
| CVE-2008-0624 EXP | Buffer overflow in the YMP Datagrid ActiveX control (datagrid.dll) in Yahoo! JukeBox 2.2.2.56 allows remote attackers to execute arbitrary code via a… | Patch early | 4.3 medium | 7.6% | 2008-02-06 |
| CVE-2008-7080 EXP | Team PHP PHP Classifieds Script stores sensitive information under the web root with insufficient access control, which allows remote attackers to obt… | Patch early | 5.0 medium | 7.6% | 2009-08-25 |
| CVE-2007-2930 EXP | The (1) NSID_SHUFFLE_ONLY and (2) NSID_USE_POOL PRNG algorithms in ISC BIND 8 before 8.4.7-P1 generate predictable DNS query identifiers when sending… | Patch early | 4.3 medium | 7.6% | 2007-09-12 |
| CVE-2008-1303 EXP | The Perforce service (p4s.exe) in Perforce Server 2007.3/143793 and earlier allows remote attackers to cause a denial of service (daemon crash) via a… | Patch early | 5.0 medium | 7.6% | 2008-03-12 |
| CVE-2008-3314 EXP | ZDaemon 1.08.07 and earlier allows remote attackers to cause a denial of service (daemon crash) via a crafted type 6 command, which triggers a NULL po… | Patch early | 5.0 medium | 7.6% | 2008-07-25 |
| CVE-2014-5116 EXP | The cairo_image_surface_get_data function in Cairo 1.10.2, as used in GTK+ and Wireshark, allows context-dependent attackers to cause a denial of serv… | Patch early | 5.0 medium | 7.6% | 2014-07-29 |
| CVE-2000-0333 EXP | tcpdump, Ethereal, and other sniffer packages allow remote attackers to cause a denial of service via malformed DNS packets in which a jump offset ref… | Patch early | 5.0 medium | 7.6% | 1999-05-31 |
| CVE-2008-1411 EXP | The PXE Server (pxesrv.exe) in Acronis Snap Deploy 2.0.0.1076 and earlier allows remote attackers to cause a denial of service (crash) via an incomple… | Patch early | 5.0 medium | 7.6% | 2008-03-20 |
| CVE-2008-1855 EXP | FrameworkService.exe in McAfee Common Management Agent (CMA) 3.6.0.574 Patch 3 and earlier, as used by ePolicy Orchestrator (ePO) and ProtectionPilot… | Patch early | 5.0 medium | 7.6% | 2008-04-16 |
| CVE-2010-2785 EXP | The IRC Protocol component in KVIrc 3.x and 4.x before r4693 does not properly handle \ (backslash) characters, which allows remote authenticated user… | Patch early | 6.5 medium | 7.6% | 2010-08-02 |
| CVE-2006-0328 EXP | Format string vulnerability in Tftpd32 2.81 allows remote attackers to cause a denial of service via format string specifiers in a filename in a (1) G… | Patch early | 5.0 medium | 7.6% | 2006-01-21 |
| CVE-2000-0851 EXP | Buffer overflow in the Still Image Service in Windows 2000 allows local users to gain additional privileges via a long WM_USER message, aka the "Still… | Patch early | 4.6 medium | 7.6% | 2000-11-14 |
| CVE-2000-0853 EXP | YaBB Bulletin Board 9.1.2000 allows remote attackers to read arbitrary files via a .. (dot dot) attack. | Patch early | 5.0 medium | 7.6% | 2000-11-14 |
| CVE-2000-1016 EXP | The default configuration of Apache (httpd.conf) on SuSE 6.4 includes an alias for the /usr/doc directory, which allows remote attackers to read packa… | Patch early | 5.0 medium | 7.6% | 2000-12-11 |
| CVE-2001-1170 EXP | AmTote International homebet program stores the homebet.log file in the homebet/ virtual directory, which allows remote attackers to steal account and… | Patch early | 5.0 medium | 7.6% | 2001-09-29 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt