CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
425,763 CVEs
1,781 on KEV
17,555 EPSS ≥ 10%
25,095 with exploits
synced 2026-11-14
25,095 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2019-8341 EXP | An issue was discovered in Jinja2 2.10. The from_string function is prone to Server Side Template Injection (SSTI) where it takes the "source" paramet… | Patch early | 9.8 critical | 43.9% | 2019-02-15 |
| CVE-2014-8687 EXP | Seagate Business NAS devices with firmware before 2015.00322 allow remote attackers to execute arbitrary code with root privileges by leveraging use o… | Patch early | 9.8 critical | 43.8% | 2017-06-08 |
| CVE-2012-3815 EXP | Buffer overflow in RunTime.exe in Sielco Sistemi Winlog Pro SCADA before 2.07.18 and Winlog Lite SCADA before 2.07.18 allows remote attackers to execu… | Patch early | 9.3 high | 43.8% | 2012-06-27 |
| CVE-2019-9618 EXP | The GraceMedia Media Player plugin 1.0 for WordPress allows Local File Inclusion via the "cfg" parameter. | Patch early | 9.8 critical | 43.8% | 2019-05-13 |
| CVE-2016-10074 EXP | The mail transport (aka Swift_Transport_MailTransport) in Swift Mailer before 5.4.5 might allow remote attackers to pass extra parameters to the mail… | Patch early | 9.8 critical | 43.8% | 2016-12-30 |
| CVE-2018-10201 EXP | An issue was discovered in NcMonitorServer.exe in NC Monitor Server in NComputing vSpace Pro 10 and 11. It is possible to read arbitrary files outside… | Patch early | 7.5 high | 43.8% | 2018-04-20 |
| CVE-2018-8625 EXP | A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows VBScript Engine Remote Code E… | Patch early | 7.5 high | 43.8% | 2018-12-12 |
| CVE-2008-0105 EXP | Microsoft Works 6 File Converter, as used in Office 2003 SP2 and SP3, Works 8.0, and Works Suite 2005, allows remote attackers to execute arbitrary co… | Patch early | 9.3 high | 43.8% | 2008-02-12 |
| CVE-2006-3637 EXP | Microsoft Internet Explorer 5.01 SP4 and 6 does not properly handle various HTML layout component combinations, which allows user-assisted remote atta… | Patch early | 5.1 medium | 43.8% | 2006-08-08 |
| CVE-2022-0482 EXP | Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository alextselegidis/easyappointments prior to 1.4.3. | Patch early | 9.1 critical | 43.7% | 2022-03-09 |
| CVE-2012-1775 EXP | Stack-based buffer overflow in VideoLAN VLC media player before 2.0.1 allows remote attackers to execute arbitrary code via a crafted MMS:// stream. | Patch early | 9.3 high | 43.7% | 2012-03-19 |
| CVE-2018-6317 EXP | The remote management interface in Claymore Dual Miner 10.5 and earlier is vulnerable to an unauthenticated format string vulnerability, allowing remo… | Patch early | 9.1 critical | 43.7% | 2018-02-02 |
| CVE-2021-31642 EXP | A denial of service condition exists after an integer overflow in several IoT devices from CHIYU Technology, including BIOSENSE, Webpass, and BF-630,… | Patch early | 6.5 medium | 43.7% | 2021-06-01 |
| CVE-2018-11510 EXP | The ASUSTOR ADM 3.1.0.RFQ3 NAS portal suffers from an unauthenticated remote code execution vulnerability in the portal/apis/aggrecate_js.cgi file by… | Patch early | 9.8 critical | 43.7% | 2018-06-28 |
| CVE-2018-0866 EXP | Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 G… | Patch early | 7.5 high | 43.6% | 2018-02-15 |
| CVE-2006-5559 EXP | The Execute method in the ADODB.Connection 2.7 and 2.8 ActiveX control objects (ADODB.Connection.2.7 and ADODB.Connection.2.8) in the Microsoft Data A… | Patch early | 9.3 high | 43.6% | 2006-10-27 |
| CVE-2017-8558 EXP | The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on 32-bit versions of Microsoft Windows Server 2008 SP2… | Patch early | 7.8 high | 43.6% | 2017-06-29 |
| CVE-2017-0121 EXP | Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT… | Patch early | 4.3 medium | 43.6% | 2017-03-17 |
| CVE-2016-3225 EXP | The SMB server component in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and… | Patch early | 7.8 high | 43.5% | 2016-06-16 |
| CVE-2017-10366 EXP | Vulnerability in the PeopleSoft Enterprise PT PeopleTools component of Oracle PeopleSoft Products (subcomponent: Performance Monitor). Supported versi… | Patch early | 9.8 critical | 43.5% | 2017-10-19 |
| CVE-2017-0072 EXP | Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to execute arbitrary code via… | Patch early | 8.8 high | 43.5% | 2017-03-17 |
| CVE-2017-0083 EXP | Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to execute arbitrary code via… | Patch early | 8.8 high | 43.5% | 2017-03-17 |
| CVE-2017-0086 EXP | Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to execute arbitrary code via… | Patch early | 8.8 high | 43.5% | 2017-03-17 |
| CVE-2017-0087 EXP | Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to execute arbitrary code via… | Patch early | 8.8 high | 43.5% | 2017-03-17 |
| CVE-2017-0090 EXP | Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to execute arbitrary code via… | Patch early | 8.8 high | 43.5% | 2017-03-17 |
| CVE-2015-3106 EXP | Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.4… | Patch early | 10.0 high | 43.5% | 2015-06-10 |
| CVE-2015-8420 EXP | Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 o… | Patch early | 10.0 high | 43.4% | 2015-12-10 |
| CVE-2015-8421 EXP | Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 o… | Patch early | 10.0 high | 43.4% | 2015-12-10 |
| CVE-2015-8422 EXP | Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 o… | Patch early | 10.0 high | 43.4% | 2015-12-10 |
| CVE-2015-8423 EXP | Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 o… | Patch early | 10.0 high | 43.4% | 2015-12-10 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt