CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
399,554 CVEs
1,729 on KEV
17,272 EPSS ≥ 10%
25,086 with exploits
synced 2026-09-30
12,661 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2002-0624 EXP | Buffer overflow in the password encryption function of Microsoft SQL Server 2000, including Microsoft SQL Server Desktop Engine (MSDE) 2000, allows re… | Patch early | 7.5 high | 22.8% | 2002-07-23 |
| CVE-2016-0051 EXP | The WebDAV client in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Win… | Patch early | 7.8 high | 22.8% | 2016-02-10 |
| CVE-2016-1013 EXP | Use-after-free vulnerability in Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.6… | Patch early | 8.8 high | 22.8% | 2016-04-09 |
| CVE-2007-3958 EXP | Microsoft Windows Explorer (explorer.exe) allows user-assisted remote attackers to cause a denial of service via a certain GIF file, as demonstrated b… | Patch early | 7.1 high | 22.8% | 2007-07-24 |
| CVE-2013-3144 EXP | Microsoft Internet Explorer 8 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf… | Patch early | 9.3 high | 22.8% | 2013-07-10 |
| CVE-2013-3151 EXP | Microsoft Internet Explorer 8 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf… | Patch early | 9.3 high | 22.8% | 2013-07-10 |
| CVE-2008-2789 EXP | SQL injection vulnerability in pages/index.php in BASIC-CMS allows remote attackers to execute arbitrary SQL commands via the page_id parameter. | Patch early | 7.5 high | 22.8% | 2008-06-20 |
| CVE-2021-40380 EXP | An issue was discovered on Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, and TN540 devices. cameralist.cgi and setcamera.cgi disclose credential… | Patch early | 7.5 high | 22.7% | 2021-09-01 |
| CVE-2021-40381 EXP | An issue was discovered on Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, and TN540 devices. index_MJpeg.cgi allows video access. | Patch early | 7.5 high | 22.7% | 2021-09-01 |
| CVE-2021-40382 EXP | An issue was discovered on Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, and TN540 devices. mjpegStreamer.cgi allows video screenshot access. | Patch early | 7.5 high | 22.7% | 2021-09-01 |
| CVE-2013-1349 EXP | Eval injection vulnerability in ajax.php in openSIS 4.5 through 5.2 allows remote attackers to execute arbitrary PHP code via the modname parameter. | Patch early | 7.5 high | 22.7% | 2013-12-09 |
| CVE-2014-7864 EXP | Multiple SQL injection vulnerabilities in the FailOverHelperServlet (aka FailServlet) servlet in ZOHO ManageEngine OpManager 8 through 11.5 build 1140… | Patch early | 7.5 high | 22.7% | 2015-02-04 |
| CVE-2014-4076 EXP | Microsoft Windows Server 2003 SP2 allows local users to gain privileges via a crafted IOCTL call to (1) tcpip.sys or (2) tcpip6.sys, aka "TCP/IP Eleva… | Patch early | 7.2 high | 22.7% | 2014-11-11 |
| CVE-2001-0932 EXP | Buffer overflow in Cooolsoft PowerFTP Server 2.03 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long… | Patch early | 7.5 high | 22.6% | 2001-11-28 |
| CVE-2008-1721 EXP | Integer signedness error in the zlib extension module in Python 2.5.2 and earlier allows remote attackers to execute arbitrary code via a negative sig… | Patch early | 7.5 high | 22.6% | 2008-04-10 |
| CVE-2002-1496 EXP | Heap-based buffer overflow in Null HTTP Server 0.5.0 and earlier allows remote attackers to execute arbitrary code via a negative value in the Content… | Patch early | 7.5 high | 22.5% | 2003-04-02 |
| CVE-2020-8947 EXP | functions_netflow.php in Artica Pandora FMS 7.0 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the index.php?ope… | Patch early | 7.2 high | 22.5% | 2020-02-12 |
| CVE-2020-11107 EXP | An issue was discovered in XAMPP before 7.2.29, 7.3.x before 7.3.16 , and 7.4.x before 7.4.4 on Windows. An unprivileged user can change a .exe config… | Patch early | 8.8 high | 22.5% | 2020-04-02 |
| CVE-2015-8770 EXP | Directory traversal vulnerability in the set_skin function in program/include/rcmail_output_html.php in Roundcube before 1.0.8 and 1.1.x before 1.1.4… | Patch early | 7.5 high | 22.4% | 2016-01-29 |
| CVE-2020-12608 EXP | An issue was discovered in SolarWinds MSP PME (Patch Management Engine) Cache Service before 1.1.15 in the Advanced Monitoring Agent. There are insecu… | Patch early | 7.8 high | 22.4% | 2020-05-07 |
| CVE-2010-0824 EXP | Unspecified vulnerability in Microsoft Office Excel 2002 SP3 and Office 2004 for Mac allows remote attackers to execute arbitrary code via an Excel fi… | Patch early | 9.3 high | 22.4% | 2010-06-08 |
| CVE-2010-1247 EXP | Unspecified vulnerability in Microsoft Office Excel 2002 SP3 allows remote attackers to execute arbitrary code via an Excel file with a malformed RTD… | Patch early | 9.3 high | 22.4% | 2010-06-08 |
| CVE-2003-0681 EXP | A "potential buffer overflow in ruleset parsing" for Sendmail 8.12.9, when using the nonstandard rulesets (1) recipient (2), final, or (3) mailer-spec… | Patch early | 7.5 high | 22.4% | 2003-10-06 |
| CVE-2010-1245 EXP | Unspecified vulnerability in Microsoft Office Excel 2002 SP3, Office 2004 for Mac, Office 2008 for Mac, and Open XML File Format Converter for Mac all… | Patch early | 9.3 high | 22.4% | 2010-06-08 |
| CVE-2004-0835 EXP | MySQL 3.x before 3.23.59, 4.x before 4.0.19, 4.1.x before 4.1.2, and 5.x before 5.0.1, checks the CREATE/INSERT rights of the original table instead o… | Patch early | 7.5 high | 22.4% | 2004-11-03 |
| CVE-2017-3106 EXP | Adobe Flash Player versions 26.0.0.137 and earlier have an exploitable type confusion vulnerability when parsing SWF files. Successful exploitation co… | Patch early | 8.8 high | 22.3% | 2017-08-11 |
| CVE-2014-2782 EXP | Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf… | Patch early | 9.3 high | 22.3% | 2014-06-19 |
| CVE-2013-0662 EXP | Multiple stack-based buffer overflows in ModbusDrv.exe in Schneider Electric Modbus Serial Driver 1.10 through 3.2 allow remote attackers to execute a… | Patch early | 9.3 high | 22.3% | 2014-04-01 |
| CVE-2010-1717 EXP | Directory traversal vulnerability in the iF surfALERT (com_if_surfalert) component 1.2 for Joomla! allows remote attackers to read arbitrary files and… | Patch early | 7.5 high | 22.3% | 2010-05-04 |
| CVE-2008-2469 EXP | Heap-based buffer overflow in the SPF_dns_resolv_lookup function in Spf_dns_resolv.c in libspf2 before 1.2.8 allows remote attackers to execute arbitr… | Patch early | 10.0 high | 22.3% | 2008-10-23 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt