CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
399,554 CVEs
1,729 on KEV
17,272 EPSS ≥ 10%
25,086 with exploits
synced 2026-09-30
25,086 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2018-11510 EXP | The ASUSTOR ADM 3.1.0.RFQ3 NAS portal suffers from an unauthenticated remote code execution vulnerability in the portal/apis/aggrecate_js.cgi file by… | Patch early | 9.8 critical | 44.3% | 2018-06-28 |
| CVE-2005-3792 EXP | Multiple SQL injection vulnerabilities in the Search module in PHP-Nuke 7.8, and possibly other versions before 7.9 with patch 3.1, allows remote atta… | Patch early | 7.5 high | 44.3% | 2005-11-24 |
| CVE-2012-2611 EXP | The DiagTraceR3Info function in the Dialog processor in disp+work.exe 7010.29.15.58313 and 7200.70.18.23869 in the Dispatcher in SAP NetWeaver 7.0 EHP… | Patch early | 9.3 high | 44.3% | 2012-05-15 |
| CVE-2008-4726 EXP | Stack-based buffer overflow in the SFTP subsystem in GoodTech SSH 6.4 allows remote authenticated users to execute arbitrary code via a long string to… | Patch early | 9.0 high | 44.3% | 2008-10-24 |
| CVE-2008-1609 EXP | Multiple PHP remote file inclusion vulnerabilities in just another flat file (JAF) CMS 4.0 RC2 allow remote attackers to execute arbitrary PHP code vi… | Patch early | 6.8 medium | 44.3% | 2008-04-01 |
| CVE-2008-1060 EXP | Eval injection vulnerability in modules/execute.php in the Sniplets 1.1.2 and 1.2.2 plugin for WordPress allows remote attackers to execute arbitrary… | Patch early | 7.5 high | 44.2% | 2008-02-28 |
| CVE-2012-3815 EXP | Buffer overflow in RunTime.exe in Sielco Sistemi Winlog Pro SCADA before 2.07.18 and Winlog Lite SCADA before 2.07.18 allows remote attackers to execu… | Patch early | 9.3 high | 44.2% | 2012-06-27 |
| CVE-2015-1587 EXP | Unrestricted file upload vulnerability in file_to_index.php in Maarch LetterBox 2.8 and earlier and GEC/GED 1.4 and earlier allows remote attackers to… | Patch early | 7.5 high | 44.2% | 2015-02-19 |
| CVE-2020-36847 EXP | The Simple-File-List Plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 4.2.2 via the rename function which… | Patch early | 9.8 critical | 44.2% | 2025-07-12 |
| CVE-2007-4474 EXP | Multiple stack-based buffer overflows in the IBM Lotus Domino Web Access ActiveX control, as provided by inotes6.dll, inotes6w.dll, dwa7.dll, and dwa7… | Patch early | 9.3 high | 44.2% | 2007-12-27 |
| CVE-2023-24709 EXP | An issue found in Paradox Security Systems IPR512 allows attackers to cause a denial of service via the login.html and login.xml parameters. | Patch early | 7.5 high | 44.2% | 2023-03-21 |
| CVE-2000-0951 EXP | A misconfiguration in IIS 5.0 with Index Server enabled and the Index property set allows remote attackers to list directories in the web root via a W… | Patch early | 5.0 medium | 44.1% | 2000-12-19 |
| CVE-2012-1775 EXP | Stack-based buffer overflow in VideoLAN VLC media player before 2.0.1 allows remote attackers to execute arbitrary code via a crafted MMS:// stream. | Patch early | 9.3 high | 44.1% | 2012-03-19 |
| CVE-2018-15710 EXP | Nagios XI 5.5.6 allows local authenticated attackers to escalate privileges to root via Autodiscover_new.php. | Patch early | 7.8 high | 44.1% | 2018-11-14 |
| CVE-2006-2842 EXP | PHP remote file inclusion vulnerability in functions/plugin.php in SquirrelMail 1.4.6 and earlier, if register_globals is enabled and magic_quotes_gpc… | Patch early | 7.5 high | 44% | 2006-06-06 |
| CVE-2022-3552 EXP | Unrestricted Upload of File with Dangerous Type in GitHub repository boxbilling/boxbilling prior to 0.0.1. | Patch early | 7.2 high | 44% | 2022-10-17 |
| CVE-2007-0024 EXP | Integer overflow in the Vector Markup Language (VML) implementation (vgx.dll) in Microsoft Internet Explorer 5.01, 6, and 7 on Windows 2000 SP4, XP SP… | Patch early | 9.3 high | 44% | 2007-01-09 |
| CVE-2008-0016 EXP | Stack-based buffer overflow in the URL parsing implementation in Mozilla Firefox before 2.0.0.17 and SeaMonkey before 1.1.12 allows remote attackers t… | Patch early | 10.0 high | 43.9% | 2008-09-24 |
| CVE-2005-4145 EXP | The MSDE version of Lyris ListManager 5.0 through 8.9b configures the sa account in the database to use a password with a small search space ("lyris"… | Patch early | 6.5 medium | 43.9% | 2005-12-10 |
| CVE-2007-0612 EXP | Multiple ActiveX controls in Microsoft Windows 2000, XP, 2003, and Vista allows remote attackers to cause a denial of service (Internet Explorer crash… | Patch early | 7.8 high | 43.9% | 2007-01-31 |
| CVE-2000-0413 EXP | The shtml.exe program in the FrontPage extensions package of IIS 4.0 and 5.0 allows remote attackers to determine the physical path of HTML, HTM, ASP,… | Patch early | 5.0 medium | 43.9% | 2000-05-06 |
| CVE-2020-13693 EXP | An unauthenticated privilege-escalation issue exists in the bbPress plugin before 2.6.5 for WordPress when New User Registration is enabled. | Patch early | 9.8 critical | 43.9% | 2020-05-29 |
| CVE-2015-0273 EXP | Multiple use-after-free vulnerabilities in ext/date/php_date.c in PHP before 5.4.38, 5.5.x before 5.5.22, and 5.6.x before 5.6.6 allow remote attacker… | Patch early | 7.5 high | 43.8% | 2015-03-30 |
| CVE-2014-8687 EXP | Seagate Business NAS devices with firmware before 2015.00322 allow remote attackers to execute arbitrary code with root privileges by leveraging use o… | Patch early | 9.8 critical | 43.8% | 2017-06-08 |
| CVE-2019-9618 EXP | The GraceMedia Media Player plugin 1.0 for WordPress allows Local File Inclusion via the "cfg" parameter. | Patch early | 9.8 critical | 43.8% | 2019-05-13 |
| CVE-2018-10201 EXP | An issue was discovered in NcMonitorServer.exe in NC Monitor Server in NComputing vSpace Pro 10 and 11. It is possible to read arbitrary files outside… | Patch early | 7.5 high | 43.8% | 2018-04-20 |
| CVE-2018-8625 EXP | A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows VBScript Engine Remote Code E… | Patch early | 7.5 high | 43.8% | 2018-12-12 |
| CVE-2008-0105 EXP | Microsoft Works 6 File Converter, as used in Office 2003 SP2 and SP3, Works 8.0, and Works Suite 2005, allows remote attackers to execute arbitrary co… | Patch early | 9.3 high | 43.8% | 2008-02-12 |
| CVE-2006-3637 EXP | Microsoft Internet Explorer 5.01 SP4 and 6 does not properly handle various HTML layout component combinations, which allows user-assisted remote atta… | Patch early | 5.1 medium | 43.8% | 2006-08-08 |
| CVE-2022-0482 EXP | Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository alextselegidis/easyappointments prior to 1.4.3. | Patch early | 9.1 critical | 43.7% | 2022-03-09 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt