CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
399,646 CVEs
1,729 on KEV
17,272 EPSS ≥ 10%
25,086 with exploits
synced 2026-09-30
12,661 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2011-1866 EXP | Buffer overflow in omniinet.exe in the inet service in HP OpenView Storage Data Protector 6.00 through 6.20 allows remote attackers to execute arbitra… | Patch early | 10.0 high | 20.9% | 2011-07-01 |
| CVE-2016-6272 EXP | XPath injection vulnerability in Epic MyChart allows remote attackers to access contents of an XML document containing static display strings, such as… | Patch early | 7.5 high | 20.9% | 2018-02-20 |
| CVE-2013-0633 EXP | Buffer overflow in Adobe Flash Player before 10.3.183.51 and 11.x before 11.5.502.149 on Windows and Mac OS X, before 10.3.183.51 and 11.x before 11.2… | Patch early | 9.3 high | 20.9% | 2013-02-08 |
| CVE-2005-1250 EXP | SQL injection vulnerability in the logon screen of the web front end (NmConsole/Login.asp) for IpSwitch WhatsUp Professional 2005 SP1 allows remote at… | Patch early | 7.5 high | 20.9% | 2005-06-22 |
| CVE-2004-0933 EXP | Computer Associates (CA) InoculateIT 6.0, eTrust Antivirus r6.0 through r7.1, eTrust Antivirus for the Gateway r7.0 and r7.1, eTrust Secure Content Ma… | Patch early | 7.5 high | 20.9% | 2005-01-27 |
| CVE-2016-5639 EXP | Directory traversal vulnerability in cgi-bin/login.cgi on Crestron AirMedia AM-100 devices with firmware before 1.4.0.13 allows remote attackers to re… | Patch early | 7.5 high | 20.8% | 2016-08-03 |
| CVE-2020-35598 EXP | ACS Advanced Comment System 1.0 is affected by Directory Traversal via an advanced_component_system/index.php?ACS_path=..%2f URI. NOTE: this might be… | Patch early | 7.5 high | 20.8% | 2020-12-23 |
| CVE-2004-1137 EXP | Multiple vulnerabilities in the IGMP functionality for Linux kernel 2.4.22 to 2.4.28, and 2.6.x to 2.6.9, allow local and remote attackers to cause a… | Patch early | 10.0 high | 20.8% | 2005-01-10 |
| CVE-2017-1000112 EXP | Linux kernel: Exploitable memory corruption due to UFO to non-UFO path switch. When building a UFO packet with MSG_MORE __ip_append_data() calls ip_uf… | Patch early | 7.0 high | 20.8% | 2017-10-05 |
| CVE-2010-3143 EXP | Untrusted search path vulnerability in Microsoft Windows Contacts allows local users, and possibly remote attackers, to execute arbitrary code and con… | Patch early | 9.3 high | 20.8% | 2010-08-27 |
| CVE-2011-0285 EXP | The process_chpw_request function in schpw.c in the password-changing functionality in kadmind in MIT Kerberos 5 (aka krb5) 1.7 through 1.9 frees an i… | Patch early | 10.0 high | 20.8% | 2011-04-15 |
| CVE-2010-3227 EXP | Stack-based buffer overflow in the UpdateFrameTitleForDocument method in the CFrameWnd class in mfc42.dll in the Microsoft Foundation Class (MFC) Libr… | Patch early | 9.3 high | 20.8% | 2010-10-26 |
| CVE-2022-34046 EXP | An access control issue in Wavlink WN533A8 M33A8.V5030.190716 allows attackers to obtain usernames and passwords via view-source:http://IP_ADDRESS/sys… | Patch early | 7.5 high | 20.8% | 2022-07-20 |
| CVE-2006-4495 EXP | Microsoft Internet Explorer allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code by instantiat… | Patch early | 7.5 high | 20.7% | 2006-08-31 |
| CVE-2013-1311 EXP | Use-after-free vulnerability in Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code via a crafted web site that triggers a… | Patch early | 9.3 high | 20.7% | 2013-05-15 |
| CVE-2014-1780 EXP | Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted… | Patch early | 9.3 high | 20.7% | 2014-06-11 |
| CVE-2014-1781 EXP | Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web sit… | Patch early | 9.3 high | 20.7% | 2014-06-11 |
| CVE-2014-1782 EXP | Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web si… | Patch early | 9.3 high | 20.7% | 2014-06-11 |
| CVE-2014-1783 EXP | Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf… | Patch early | 9.3 high | 20.7% | 2014-06-11 |
| CVE-2014-1784 EXP | Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf… | Patch early | 9.3 high | 20.7% | 2014-06-11 |
| CVE-2014-1786 EXP | Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf… | Patch early | 9.3 high | 20.7% | 2014-06-11 |
| CVE-2014-1790 EXP | Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web si… | Patch early | 9.3 high | 20.7% | 2014-06-11 |
| CVE-2014-1792 EXP | Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web sit… | Patch early | 9.3 high | 20.7% | 2014-06-11 |
| CVE-2014-1794 EXP | Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted… | Patch early | 9.3 high | 20.7% | 2014-06-11 |
| CVE-2014-1796 EXP | Microsoft Internet Explorer 6 and 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via… | Patch early | 9.3 high | 20.7% | 2014-06-11 |
| CVE-2010-2321 EXP | Buffer overflow in Adobe InDesign CS3 10.0 allows user-assisted remote attackers to execute arbitrary code via a crafted .indd file. | Patch early | 9.3 high | 20.7% | 2010-06-18 |
| CVE-2019-1127 EXP | A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite Remote Code Execution Vulnerabili… | Patch early | 8.8 high | 20.6% | 2019-07-15 |
| CVE-2000-0967 EXP | PHP 3 and 4 do not properly cleanse user-injected format strings, which allows remote attackers to execute arbitrary commands by triggering error mess… | Patch early | 10.0 high | 20.6% | 2000-12-19 |
| CVE-2009-4873 EXP | Stack-based buffer overflow in the HTTP server in Rhino Software Serv-U Web Client 9.0.0.5 allows remote attackers to cause a denial of service (serve… | Patch early | 10.0 high | 20.6% | 2010-05-26 |
| CVE-2020-9283 EXP | golang.org/x/crypto before v0.0.0-20200220183623-bac4c82f6975 for Go allows a panic during signature verification in the golang.org/x/crypto/ssh packa… | Patch early | 7.5 high | 20.5% | 2020-02-20 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt