CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
399,534 CVEs
1,729 on KEV
17,272 EPSS ≥ 10%
25,086 with exploits
synced 2026-09-30
25,086 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2013-5036 EXP | The Square Squash allows remote attackers to execute arbitrary code via a YAML document in the (1) namespace parameter to the deobfuscation function o… | Patch early | 7.5 high | 46.2% | 2014-05-27 |
| CVE-2014-6446 EXP | The Infusionsoft Gravity Forms plugin 1.5.3 through 1.5.10 for WordPress does not properly restrict access, which allows remote attackers to upload ar… | Patch early | 7.5 high | 46.2% | 2014-09-26 |
| CVE-2008-2245 EXP | Heap-based buffer overflow in the InternalOpenColorProfile function in mscms.dll in Microsoft Windows Image Color Management System (MSCMS) in the Ima… | Patch early | 9.3 high | 46.1% | 2008-08-13 |
| CVE-2023-30145 EXP | Camaleon CMS v2.7.0 was discovered to contain a Server-Side Template Injection (SSTI) vulnerability via the formats parameter. | Patch early | 9.8 critical | 46.1% | 2023-05-26 |
| CVE-2015-9323 EXP | The 404-to-301 plugin before 2.0.3 for WordPress has SQL injection. | Patch early | 9.8 critical | 46.1% | 2019-08-16 |
| CVE-2008-1505 EXP | PHP remote file inclusion vulnerability in the SSTREAMTV custompages (com_custompages) 1.1 and earlier component for Joomla! allows remote attackers t… | Patch early | 7.5 high | 46.1% | 2008-03-25 |
| CVE-2012-6530 EXP | Stack-based buffer overflow in Sysax Multi Server before 5.52, when HTTP is enabled, allows remote authenticated users with the create folder permissi… | Patch early | 7.1 high | 46.1% | 2013-01-31 |
| CVE-2016-4971 EXP | GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a request from HTTP to a crafted FTP resource. | Patch early | 8.8 high | 46.1% | 2016-06-30 |
| CVE-2018-20470 EXP | An issue was discovered in Tyto Sahi Pro through 7.x.x and 8.0.0. A directory traversal (arbitrary file access) vulnerability exists in the web report… | Patch early | 7.5 high | 46.1% | 2019-06-17 |
| CVE-2003-0042 EXP | Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, allows remote attackers to list directories even with an index.html or other file p… | Patch early | 5.0 medium | 46% | 2003-02-07 |
| CVE-2005-0058 EXP | Buffer overflow in the Telephony Application Programming Interface (TAPI) for Microsoft Windows 98, Windows 98 SE, Windows ME, Windows 2000, Windows X… | Patch early | 7.5 high | 46% | 2005-08-10 |
| CVE-2015-6127 EXP | Windows Media Center in Microsoft Windows Vista SP2, Windows 7 SP1, Windows 8, and Windows 8.1 allows remote attackers to read arbitrary files via a c… | Patch early | 4.3 medium | 46% | 2015-12-09 |
| CVE-2023-4168 EXP | A vulnerability was found in Templatecookie Adlisting 2.14.0. It has been classified as problematic. Affected is an unknown function of the file /ad-l… | Patch early | 4.3 medium | 46% | 2023-08-05 |
| CVE-2022-23854 EXP | AVEVA InTouch Access Anywhere versions 2020 R2 and older are vulnerable to a path traversal exploit that could allow an unauthenticated user with netw… | Patch early | 7.5 high | 46% | 2022-12-23 |
| CVE-2007-5098 EXP | Multiple PHP remote file inclusion vulnerabilities in DFD Cart 1.1.4 and earlier, when register_globals is enabled, allow remote attackers to execute… | Patch early | 6.8 medium | 46% | 2007-09-26 |
| CVE-2008-1309 EXP | The RealAudioObjects.RealAudio ActiveX control in rmoc3260.dll in RealNetworks RealPlayer Enterprise, RealPlayer 10, RealPlayer 10.5 before build 6.0.… | Patch early | 9.3 high | 46% | 2008-03-12 |
| CVE-2021-39608 EXP | Remote Code Execution (RCE) vulnerabilty exists in FlatCore-CMS 2.0.7 via the upload addon plugin, which could let a remote malicious user exeuct arbi… | Patch early | 7.2 high | 45.9% | 2021-08-23 |
| CVE-2019-9692 EXP | class.showtime2_image.php in CMS Made Simple (CMSMS) before 2.2.10 does not ensure that a watermark file has a standard image file extension (GIF, JPG… | Patch early | 6.5 medium | 45.9% | 2019-03-11 |
| CVE-2007-3901 EXP | Stack-based buffer overflow in the DirectShow Synchronized Accessible Media Interchange (SAMI) parser in quartz.dll for Microsoft DirectX 7.0 through… | Patch early | 8.5 high | 45.9% | 2007-12-12 |
| CVE-2008-0387 EXP | Integer overflow in Firebird SQL 1.0.3 and earlier, 1.5.x before 1.5.6, 2.0.x before 2.0.4, and 2.1.x before 2.1.0 RC1 might allow remote attackers to… | Patch early | 7.8 high | 45.9% | 2008-01-29 |
| CVE-2006-4704 EXP | Cross-zone scripting vulnerability in the WMI Object Broker (WMIScriptUtils.WMIObjectBroker2) ActiveX control (WmiScriptUtils.dll) in Microsoft Visual… | Patch early | 6.8 medium | 45.9% | 2006-11-01 |
| CVE-2007-2141 EXP | Direct static code injection vulnerability in shoutbox.php in ShoutPro 1.5.2 allows remote attackers to inject arbitrary PHP code into shouts.php via… | Patch early | 7.5 high | 45.8% | 2007-04-19 |
| CVE-2015-5563 EXP | Use-after-free vulnerability in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199… | Patch early | 10.0 high | 45.8% | 2015-08-14 |
| CVE-2011-5171 EXP | Multiple stack-based buffer overflows in CyberLink Power2Go 7 (build 196) and 8 (build 1031) allow remote attackers to execute arbitrary code via the… | Patch early | 9.3 high | 45.8% | 2012-09-15 |
| CVE-2009-0932 EXP | Directory traversal vulnerability in framework/Image/Image.php in Horde before 3.2.4 and 3.3.3 and Horde Groupware before 1.1.5 allows remote attacker… | Patch early | 6.4 medium | 45.8% | 2009-03-17 |
| CVE-2005-2373 EXP | Buffer overflow in SlimFTPd 3.15 and 3.16 allows remote authenticated users to execute arbitrary code via a long directory name to (1) LIST, (2) DELE… | Patch early | 7.2 high | 45.7% | 2005-07-26 |
| CVE-2008-4696 EXP | Cross-site scripting (XSS) vulnerability in Opera.dll in Opera before 9.61 allows remote attackers to inject arbitrary web script or HTML via the anch… | Patch early | 4.3 medium | 45.7% | 2008-10-23 |
| CVE-2022-35411 EXP | rpc.py through 0.6.0 allows Remote Code Execution because an unpickle occurs when the "serializer: pickle" HTTP header is sent. In other words, althou… | Patch early | 9.8 critical | 45.7% | 2022-07-08 |
| CVE-2019-6444 EXP | An issue was discovered in NTPsec before 1.1.3. process_control() in ntp_control.c has a stack-based buffer over-read because attacker-controlled data… | Patch early | 9.1 critical | 45.7% | 2019-01-16 |
| CVE-2007-4814 EXP | Buffer overflow in the SQLServer ActiveX control in the Distributed Management Objects OLE DLL (sqldmo.dll) 2000.085.2004.00 in Microsoft SQL Server E… | Patch early | 7.5 high | 45.7% | 2007-09-11 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt