CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
425,763 CVEs
1,781 on KEV
17,555 EPSS ≥ 10%
25,095 with exploits
synced 2026-11-14
25,095 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2013-1595 EXP | A Buffer Overflow vulnerability exists in Vivotek PT7135 IP Camera 0300a and 0400a via a specially crafted packet in the Authorization header field se… | Patch early | 9.8 critical | 41.6% | 2020-01-24 |
| CVE-2019-6116 EXP | In Artifex Ghostscript through 9.26, ephemeral or transient procedures can allow access to system operators, leading to remote code execution. | Patch early | 7.8 high | 41.6% | 2019-03-21 |
| CVE-2009-3693 EXP | Directory traversal vulnerability in the Persits.XUpload.2 ActiveX control (XUpload.ocx) in HP LoadRunner 9.5 allows remote attackers to create arbitr… | Patch early | 9.3 high | 41.6% | 2009-10-13 |
| CVE-2007-4923 EXP | PHP remote file inclusion vulnerability in admin.joomlaradiov5.php in the Joomla Radio 5 (com_joomlaradiov5) component for Joomla! allows remote attac… | Patch early | 6.8 medium | 41.6% | 2007-09-17 |
| CVE-2007-1749 EXP | Integer underflow in the CDownloadSink class code in the Vector Markup Language (VML) component (VGX.DLL), as used in Internet Explorer 5.01, 6, and 7… | Patch early | 9.3 high | 41.5% | 2007-08-14 |
| CVE-2006-0537 EXP | Buffer overflow in the POP3 server in Kinesphere Corporation eXchange before 5.0.060125 allows remote attackers to execute arbitrary code via a long R… | Patch early | 7.5 high | 41.5% | 2006-02-04 |
| CVE-2026-4257 EXP | The Contact Form by Supsystic plugin for WordPress is vulnerable to Server-Side Template Injection (SSTI) leading to Remote Code Execution (RCE) in al… | Patch early | 9.8 critical | 41.5% | 2026-03-30 |
| CVE-2010-3407 EXP | Stack-based buffer overflow in the MailCheck821Address function in nnotes.dll in the nrouter.exe service in the server in IBM Lotus Domino 8.0.x befor… | Patch early | 9.3 high | 41.5% | 2010-09-16 |
| CVE-2007-6258 EXP | Multiple stack-based buffer overflows in the legacy mod_jk2 2.0.3-DEV and earlier Apache module allow remote attackers to execute arbitrary code via a… | Patch early | 7.5 high | 41.5% | 2008-02-19 |
| CVE-2016-2389 EXP | Directory traversal vulnerability in the GetFileList function in the SAP Manufacturing Integration and Intelligence (xMII) component 15.0 for SAP NetW… | Patch early | 7.5 high | 41.5% | 2016-02-16 |
| CVE-2008-5036 EXP | Stack-based buffer overflow in VideoLAN VLC media player 0.9.x before 0.9.6 might allow user-assisted attackers to execute arbitrary code via an an in… | Patch early | 9.3 high | 41.4% | 2008-11-10 |
| CVE-2009-2261 EXP | PeaZIP 2.6.1, 2.5.1, and earlier on Windows allows user-assisted remote attackers to execute arbitrary commands via a .zip archive with a .txt file wh… | Patch early | 9.3 high | 41.4% | 2009-06-30 |
| CVE-2007-2217 EXP | Kodak Image Viewer in Microsoft Windows 2000 SP4, and in some cases XP SP2 and Server 2003 SP1 and SP2, allows remote attackers to execute arbitrary c… | Patch early | 9.3 high | 41.4% | 2007-10-09 |
| CVE-2011-1892 EXP | Microsoft Office Groove 2007 SP2, SharePoint Workspace 2010 Gold and SP1, Office Forms Server 2007 SP2, Office SharePoint Server 2007 SP2, Office Shar… | Patch early | 4.0 medium | 41.4% | 2011-09-15 |
| CVE-2002-2007 EXP | The default installations of Apache Tomcat 3.2.3 and 3.2.4 allows remote attackers to obtain sensitive system information such as directory listings a… | Patch early | 5.0 medium | 41.4% | 2002-12-31 |
| CVE-2009-0553 EXP | Microsoft Internet Explorer 6 SP1, 6 and 7 on Windows XP SP2 and SP3, 6 and 7 on Windows Server 2003 SP1 and SP2, 7 on Windows Vista Gold and SP1, and… | Patch early | 9.3 high | 41.4% | 2009-04-15 |
| CVE-2021-3317 EXP | KLog Server through 2.4.1 allows authenticated command injection. async.php calls shell_exec() on the original value of the source parameter. | Patch early | 8.8 high | 41.4% | 2021-01-26 |
| CVE-2007-2216 EXP | The tblinf32.dll (aka vstlbinf.dll) ActiveX control for Internet Explorer 5.01, 6 SP1, and 7 uses an incorrect IObjectsafety implementation, which all… | Patch early | 9.3 high | 41.4% | 2007-08-14 |
| CVE-2020-10882 EXP | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1… | Patch early | 8.8 high | 41.4% | 2020-03-25 |
| CVE-2002-0866 EXP | Java Database Connectivity (JDBC) classes in Microsoft Virtual Machine (VM) up to and including 5.0.3805 allow remote attackers to load and execute DL… | Patch early | 7.5 high | 41.4% | 2002-10-11 |
| CVE-2011-0966 EXP | Directory traversal vulnerability in cwhp/auditLog.do in the Homepage Auditing component in Cisco CiscoWorks Common Services 3.3 and earlier allows re… | Patch early | 6.8 medium | 41.3% | 2011-05-20 |
| CVE-2016-3386 EXP | The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via… | Patch early | 7.5 high | 41.3% | 2016-10-14 |
| CVE-2004-0430 EXP | Stack-based buffer overflow in AppleFileServer for Mac OS X 10.3.3 and earlier allows remote attackers to execute arbitrary code via a LoginExt packet… | Patch early | 5.1 medium | 41.3% | 2004-07-07 |
| CVE-2010-0231 EXP | The SMB implementation in the Server service in Microsoft Windows 2000 SP4, Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista Gold, SP1,… | Patch early | 10.0 high | 41.3% | 2010-02-10 |
| CVE-2005-3757 EXP | The Saxon XSLT parser in Google Mini Search Appliance, and possibly Google Search Appliance, allows remote attackers to obtain sensitive information a… | Patch early | 7.5 high | 41.3% | 2005-11-22 |
| CVE-2008-0955 EXP | Stack-based buffer overflow in the Creative Software AutoUpdate Engine ActiveX control in CTSUEng.ocx allows remote attackers to execute arbitrary cod… | Patch early | 9.3 high | 41.2% | 2008-05-29 |
| CVE-2007-2365 EXP | Buffer overflow in Adobe Photoshop CS2 and CS3, Photoshop Elements 5.0, Illustrator CS3, and GoLive 9 allows user-assisted remote attackers to execute… | Patch early | 9.3 high | 41.2% | 2007-04-30 |
| CVE-2006-3059 EXP | Unspecified vulnerability in Microsoft Excel 2000 through 2004 allows remote user-assisted attackers to execute arbitrary code via unspecified vectors… | Patch early | 9.3 high | 41.1% | 2006-06-17 |
| CVE-2022-29548 EXP | A reflected XSS issue exists in the Management Console of several WSO2 products. This affects API Manager 2.2.0, 2.5.0, 2.6.0, 3.0.0, 3.1.0, 3.2.0, an… | Patch early | 4.6 medium | 41.1% | 2022-04-21 |
| CVE-2015-3083 EXP | Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on Linux, Adobe AIR before 17… | Patch early | 6.4 medium | 41.1% | 2015-05-13 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt