CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
425,731 CVEs
1,781 on KEV
17,555 EPSS ≥ 10%
25,095 with exploits
synced 2026-11-14
12,664 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2025-47166 EXP | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | Patch early | 8.8 high | 22.6% | 2025-06-10 |
| CVE-2002-1496 EXP | Heap-based buffer overflow in Null HTTP Server 0.5.0 and earlier allows remote attackers to execute arbitrary code via a negative value in the Content… | Patch early | 7.5 high | 22.5% | 2003-04-02 |
| CVE-2020-8947 EXP | functions_netflow.php in Artica Pandora FMS 7.0 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the index.php?ope… | Patch early | 7.2 high | 22.5% | 2020-02-12 |
| CVE-2020-11107 EXP | An issue was discovered in XAMPP before 7.2.29, 7.3.x before 7.3.16 , and 7.4.x before 7.4.4 on Windows. An unprivileged user can change a .exe config… | Patch early | 8.8 high | 22.5% | 2020-04-02 |
| CVE-2015-8770 EXP | Directory traversal vulnerability in the set_skin function in program/include/rcmail_output_html.php in Roundcube before 1.0.8 and 1.1.x before 1.1.4… | Patch early | 7.5 high | 22.4% | 2016-01-29 |
| CVE-2020-12608 EXP | An issue was discovered in SolarWinds MSP PME (Patch Management Engine) Cache Service before 1.1.15 in the Advanced Monitoring Agent. There are insecu… | Patch early | 7.8 high | 22.4% | 2020-05-07 |
| CVE-2010-0824 EXP | Unspecified vulnerability in Microsoft Office Excel 2002 SP3 and Office 2004 for Mac allows remote attackers to execute arbitrary code via an Excel fi… | Patch early | 9.3 high | 22.4% | 2010-06-08 |
| CVE-2010-1247 EXP | Unspecified vulnerability in Microsoft Office Excel 2002 SP3 allows remote attackers to execute arbitrary code via an Excel file with a malformed RTD… | Patch early | 9.3 high | 22.4% | 2010-06-08 |
| CVE-2024-58258 EXP | SugarCRM before 13.0.4 and 14.x before 14.0.1 allows SSRF in the API module because a limited type of code injection can occur. | Patch early | 7.2 high | 22.4% | 2025-07-13 |
| CVE-2003-0681 EXP | A "potential buffer overflow in ruleset parsing" for Sendmail 8.12.9, when using the nonstandard rulesets (1) recipient (2), final, or (3) mailer-spec… | Patch early | 7.5 high | 22.4% | 2003-10-06 |
| CVE-2010-1245 EXP | Unspecified vulnerability in Microsoft Office Excel 2002 SP3, Office 2004 for Mac, Office 2008 for Mac, and Open XML File Format Converter for Mac all… | Patch early | 9.3 high | 22.4% | 2010-06-08 |
| CVE-2004-0835 EXP | MySQL 3.x before 3.23.59, 4.x before 4.0.19, 4.1.x before 4.1.2, and 5.x before 5.0.1, checks the CREATE/INSERT rights of the original table instead o… | Patch early | 7.5 high | 22.4% | 2004-11-03 |
| CVE-2017-3106 EXP | Adobe Flash Player versions 26.0.0.137 and earlier have an exploitable type confusion vulnerability when parsing SWF files. Successful exploitation co… | Patch early | 8.8 high | 22.3% | 2017-08-11 |
| CVE-2014-2782 EXP | Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf… | Patch early | 9.3 high | 22.3% | 2014-06-19 |
| CVE-2010-1717 EXP | Directory traversal vulnerability in the iF surfALERT (com_if_surfalert) component 1.2 for Joomla! allows remote attackers to read arbitrary files and… | Patch early | 7.5 high | 22.3% | 2010-05-04 |
| CVE-2008-2469 EXP | Heap-based buffer overflow in the SPF_dns_resolv_lookup function in Spf_dns_resolv.c in libspf2 before 1.2.8 allows remote attackers to execute arbitr… | Patch early | 10.0 high | 22.3% | 2008-10-23 |
| CVE-2006-7066 EXP | Microsoft Internet Explorer 6 on Windows XP SP2 allows remote attackers to cause a denial of service (crash) by creating an object inside an iframe, d… | Patch early | 7.1 high | 22.2% | 2007-03-02 |
| CVE-2015-3302 EXP | The TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin) plugin for WordPress before 1.3.9.3 allows remote attackers… | Patch early | 7.5 high | 22.2% | 2017-12-29 |
| CVE-2013-0662 EXP | Multiple stack-based buffer overflows in ModbusDrv.exe in Schneider Electric Modbus Serial Driver 1.10 through 3.2 allow remote attackers to execute a… | Patch early | 9.3 high | 22.2% | 2014-04-01 |
| CVE-2011-2131 EXP | Adobe Photoshop 12.0 in Creative Suite 5 (CS5) and 12.1 in Creative Suite 5.1 (CS5.1) allows remote attackers to execute arbitrary code or cause a den… | Patch early | 9.3 high | 22.2% | 2011-08-11 |
| CVE-2022-34047 EXP | An access control issue in Wavlink WN530HG4 M30HG4.V5030.191116 allows attackers to obtain usernames and passwords via view-source:http://IP_ADDRESS/s… | Patch early | 7.5 high | 22.2% | 2022-07-20 |
| CVE-2008-0590 EXP | Buffer overflow in Ipswitch WS_FTP Server with SSH 6.1.0.0 allows remote authenticated users to cause a denial of service (crash) and possibly execute… | Patch early | 9.0 high | 22.2% | 2008-02-05 |
| CVE-2006-4494 EXP | Microsoft Visual Studio 6.0 allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code by instantiat… | Patch early | 7.5 high | 22.1% | 2006-08-31 |
| CVE-2006-7206 EXP | Microsoft Internet Explorer 6 on Windows XP SP2 allows remote attackers to cause a denial of service (crash) by creating a ADODB.Recordset object and… | Patch early | 7.8 high | 22.1% | 2007-06-22 |
| CVE-2002-1179 EXP | Buffer overflow in the S/MIME Parsing capability in Microsoft Outlook Express 5.5 and 6.0 allows remote attackers to execute arbitrary code via a digi… | Patch early | 7.5 high | 22.1% | 2002-10-28 |
| CVE-2010-1938 EXP | Off-by-one error in the __opiereadrec function in readrec.c in libopie in OPIE 2.4.1-test1 and earlier, as used on FreeBSD 6.4 through 8.1-PRERELEASE… | Patch early | 9.3 high | 22.1% | 2010-05-28 |
| CVE-2013-3846 EXP | Use-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code or cause a denial of service (m… | Patch early | 9.3 high | 22% | 2013-12-29 |
| CVE-2007-0236 EXP | Double free vulnerability in the _ATPsndrsp function in Apple Mac OS X 10.4.8, and possibly other versions, allows remote attackers to cause a denial… | Patch early | 10.0 high | 22% | 2007-01-16 |
| CVE-2018-19246 EXP | PHP-Proxy 5.1.0 allows remote attackers to read local files if the default "pre-installed version" (intended for users who lack shell access to their… | Patch early | 7.5 high | 22% | 2018-11-13 |
| CVE-2003-0666 EXP | Buffer overflow in Microsoft Wordperfect Converter allows remote attackers to execute arbitrary code via modified data offset and data size parameters… | Patch early | 7.5 high | 21.9% | 2003-10-20 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt