CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
399,516 CVEs
1,729 on KEV
17,272 EPSS ≥ 10%
25,086 with exploits
synced 2026-09-30
25,086 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2008-2551 EXP | The DownloaderActiveX Control (DownloaderActiveX.ocx) in Icona SpA C6 Messenger 1.0.0.1 allows remote attackers to force the download and execution of… | Patch early | 9.3 high | 46.9% | 2008-06-04 |
| CVE-2019-15984 EXP | Multiple vulnerabilities in the REST and SOAP API endpoints of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker… | Patch early | 7.2 high | 46.9% | 2020-01-06 |
| CVE-2007-2199 EXP | PHP remote file inclusion vulnerability in lib/pcltar.lib.php (aka pcltar.php) in the PclTar module 1.3 and 1.3.1 for Vincent Blavet PhpConcept Librar… | Patch early | 6.8 medium | 46.9% | 2007-04-24 |
| CVE-2018-7719 EXP | Acrolinx Server before 5.2.5 on Windows allows Directory Traversal. | Patch early | 7.5 high | 46.9% | 2018-03-25 |
| CVE-2012-6274 EXP | BigAntSoft BigAnt IM Message Server does not require authentication for file uploading, which allows remote attackers to create arbitrary files under… | Patch early | 5.0 medium | 46.9% | 2013-02-24 |
| CVE-2017-11903 EXP | Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 G… | Patch early | 7.5 high | 46.8% | 2017-12-12 |
| CVE-2007-5186 EXP | PHP remote file inclusion vulnerability in index.php in Segue CMS 1.8.4 and earlier, when register_globals is disabled, allows remote attackers to exe… | Patch early | 6.8 medium | 46.8% | 2007-10-03 |
| CVE-2011-0096 EXP | The MHTML protocol handler in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, R2,… | Patch early | 6.1 medium | 46.8% | 2011-01-31 |
| CVE-2022-29298 EXP | SolarView Compact ver.6.00 allows attackers to access sensitive files via directory traversal. | Patch early | 7.5 high | 46.8% | 2022-05-12 |
| CVE-2015-6834 EXP | Multiple use-after-free vulnerabilities in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 allow remote attackers to execute arbitrary… | Patch early | 9.8 critical | 46.8% | 2016-05-16 |
| CVE-2010-2590 EXP | Heap-based buffer overflow in the CrystalReports12.CrystalPrintControl.1 ActiveX control in PrintControl.dll 12.3.2.753 in SAP Crystal Reports 2008 SP… | Patch early | 9.3 high | 46.8% | 2010-12-22 |
| CVE-2000-0505 EXP | The Apache 1.3.x HTTP server for Windows platforms allows remote attackers to list directory contents by requesting a URL containing a large number of… | Patch early | 5.0 medium | 46.7% | 2000-05-31 |
| CVE-2019-9879 EXP | The WPGraphQL 0.2.3 plugin for WordPress allows remote attackers to register a new user with admin privileges, whenever new user registrations are all… | Patch early | 9.8 critical | 46.6% | 2019-06-10 |
| CVE-2025-29306 EXP | An issue in FoxCMS v.1.2.5 allows a remote attacker to execute arbitrary code via the case display page in the index.html component. | Patch early | 9.8 critical | 46.6% | 2025-03-27 |
| CVE-2006-5028 EXP | Directory traversal vulnerability in filemanager/filemanager.php in SWsoft Plesk 7.5 Reload and Plesk 7.6 for Microsoft Windows allows remote attacker… | Patch early | 5.0 medium | 46.6% | 2006-09-27 |
| CVE-2002-0597 EXP | LANMAN service on Microsoft Windows 2000 allows remote attackers to cause a denial of service (CPU/memory exhaustion) via a stream of malformed data t… | Patch early | 5.0 medium | 46.6% | 2002-06-18 |
| CVE-2012-6275 EXP | Multiple stack-based buffer overflows in AntDS.exe in BigAntSoft BigAnt IM Message Server allow remote attackers to have an unspecified impact via (1)… | Patch early | 10.0 high | 46.5% | 2013-02-24 |
| CVE-2007-5842 EXP | Multiple PHP remote file inclusion vulnerabilities in Vortex Portal 1.0.42 allow remote attackers to execute arbitrary PHP code via a URL in the cfgPr… | Patch early | 6.8 medium | 46.5% | 2007-11-06 |
| CVE-2011-4929 EXP | Unspecified vulnerability in the bazaar repository adapter in Redmine 0.9.x and 1.0.x before 1.0.5 allows remote attackers to execute arbitrary comman… | Patch early | 7.5 high | 46.4% | 2012-10-08 |
| CVE-2025-2011 EXP | The Slider & Popup Builder by Depicter plugin for WordPress is vulnerable to generic SQL Injection via the ‘s' parameter in all versions up to, and in… | Patch early | 7.5 high | 46.4% | 2025-05-06 |
| CVE-2005-0581 EXP | Multiple buffer overflows in Computer Associates (CA) License Client and Server 0.1.0.15 allow remote attackers to execute arbitrary code via (1) cert… | Patch early | 4.6 medium | 46.3% | 2005-05-02 |
| CVE-2003-0228 EXP | Directory traversal vulnerability in Microsoft Windows Media Player 7.1 and Windows Media Player for Windows XP allows remote attackers to execute arb… | Patch early | 7.5 high | 46.3% | 2003-05-27 |
| CVE-2008-2031 EXP | VicFTPS 5.0 allows remote attackers to cause a denial of service (crash) via a crafted LIST command, which triggers a NULL pointer dereference. NOTE:… | Patch early | 5.0 medium | 46.3% | 2008-04-30 |
| CVE-2002-0721 EXP | Microsoft SQL Server 7.0 and 2000 installs with weak permissions for extended stored procedures that are associated with helper functions, which could… | Patch early | 10.0 high | 46.3% | 2002-09-05 |
| CVE-2019-15276 EXP | A vulnerability in the web interface of Cisco Wireless LAN Controller Software could allow a low-privileged, authenticated, remote attacker to cause a… | Patch early | 6.5 medium | 46.3% | 2019-11-26 |
| CVE-2018-9118 EXP | exports/download.php in the 99 Robots WP Background Takeover Advertisements plugin before 4.1.5 for WordPress has Directory Traversal via a .. in the… | Patch early | 7.5 high | 46.3% | 2018-04-12 |
| CVE-2014-2671 EXP | Microsoft Windows Media Player (WMP) 11.0.5721.5230 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecif… | Patch early | 6.8 medium | 46.3% | 2014-03-31 |
| CVE-2018-8413 EXP | A remote code execution vulnerability exists when "Windows Theme API" does not properly decompress files, aka "Windows Theme API Remote Code Execution… | Patch early | 7.8 high | 46.3% | 2018-10-10 |
| CVE-2006-3835 EXP | Apache Tomcat 5 before 5.5.17 allows remote attackers to list directories via a semicolon (;) preceding a filename with a mapped extension, as demonst… | Patch early | 5.0 medium | 46.2% | 2006-07-25 |
| CVE-2008-2689 EXP | PHP remote file inclusion vulnerability in pub/clients.php in BrowserCRM 5.002.00 allows remote attackers to execute arbitrary PHP code via a URL in t… | Patch early | 10.0 high | 46.2% | 2008-06-13 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt