CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
399,646 CVEs
1,729 on KEV
17,272 EPSS ≥ 10%
25,086 with exploits
synced 2026-09-30
25,086 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2016-2389 EXP | Directory traversal vulnerability in the GetFileList function in the SAP Manufacturing Integration and Intelligence (xMII) component 15.0 for SAP NetW… | Patch early | 7.5 high | 41.5% | 2016-02-16 |
| CVE-2008-5036 EXP | Stack-based buffer overflow in VideoLAN VLC media player 0.9.x before 0.9.6 might allow user-assisted attackers to execute arbitrary code via an an in… | Patch early | 9.3 high | 41.4% | 2008-11-10 |
| CVE-2009-2261 EXP | PeaZIP 2.6.1, 2.5.1, and earlier on Windows allows user-assisted remote attackers to execute arbitrary commands via a .zip archive with a .txt file wh… | Patch early | 9.3 high | 41.4% | 2009-06-30 |
| CVE-2007-2217 EXP | Kodak Image Viewer in Microsoft Windows 2000 SP4, and in some cases XP SP2 and Server 2003 SP1 and SP2, allows remote attackers to execute arbitrary c… | Patch early | 9.3 high | 41.4% | 2007-10-09 |
| CVE-2002-2007 EXP | The default installations of Apache Tomcat 3.2.3 and 3.2.4 allows remote attackers to obtain sensitive system information such as directory listings a… | Patch early | 5.0 medium | 41.4% | 2002-12-31 |
| CVE-2009-0553 EXP | Microsoft Internet Explorer 6 SP1, 6 and 7 on Windows XP SP2 and SP3, 6 and 7 on Windows Server 2003 SP1 and SP2, 7 on Windows Vista Gold and SP1, and… | Patch early | 9.3 high | 41.4% | 2009-04-15 |
| CVE-2021-3317 EXP | KLog Server through 2.4.1 allows authenticated command injection. async.php calls shell_exec() on the original value of the source parameter. | Patch early | 8.8 high | 41.4% | 2021-01-26 |
| CVE-2007-2216 EXP | The tblinf32.dll (aka vstlbinf.dll) ActiveX control for Internet Explorer 5.01, 6 SP1, and 7 uses an incorrect IObjectsafety implementation, which all… | Patch early | 9.3 high | 41.4% | 2007-08-14 |
| CVE-2020-10882 EXP | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1… | Patch early | 8.8 high | 41.4% | 2020-03-25 |
| CVE-2002-0866 EXP | Java Database Connectivity (JDBC) classes in Microsoft Virtual Machine (VM) up to and including 5.0.3805 allow remote attackers to load and execute DL… | Patch early | 7.5 high | 41.4% | 2002-10-11 |
| CVE-2011-0966 EXP | Directory traversal vulnerability in cwhp/auditLog.do in the Homepage Auditing component in Cisco CiscoWorks Common Services 3.3 and earlier allows re… | Patch early | 6.8 medium | 41.3% | 2011-05-20 |
| CVE-2016-3386 EXP | The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via… | Patch early | 7.5 high | 41.3% | 2016-10-14 |
| CVE-2004-0430 EXP | Stack-based buffer overflow in AppleFileServer for Mac OS X 10.3.3 and earlier allows remote attackers to execute arbitrary code via a LoginExt packet… | Patch early | 5.1 medium | 41.3% | 2004-07-07 |
| CVE-2006-6561 EXP | Unspecified vulnerability in Microsoft Word 2000, 2002, and Word Viewer 2003 allows user-assisted remote attackers to execute arbitrary code via a cra… | Patch early | 9.3 high | 41.3% | 2006-12-14 |
| CVE-2010-0231 EXP | The SMB implementation in the Server service in Microsoft Windows 2000 SP4, Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista Gold, SP1,… | Patch early | 10.0 high | 41.3% | 2010-02-10 |
| CVE-2005-3757 EXP | The Saxon XSLT parser in Google Mini Search Appliance, and possibly Google Search Appliance, allows remote attackers to obtain sensitive information a… | Patch early | 7.5 high | 41.3% | 2005-11-22 |
| CVE-2008-0955 EXP | Stack-based buffer overflow in the Creative Software AutoUpdate Engine ActiveX control in CTSUEng.ocx allows remote attackers to execute arbitrary cod… | Patch early | 9.3 high | 41.2% | 2008-05-29 |
| CVE-2007-2365 EXP | Buffer overflow in Adobe Photoshop CS2 and CS3, Photoshop Elements 5.0, Illustrator CS3, and GoLive 9 allows user-assisted remote attackers to execute… | Patch early | 9.3 high | 41.2% | 2007-04-30 |
| CVE-2020-14425 EXP | Foxit Reader before 10.0 allows Remote Command Execution via the app.opencPDFWebPage JavsScript API. An attacker can execute local files and bypass th… | Patch early | 7.8 high | 41.1% | 2020-11-02 |
| CVE-2016-0122 EXP | Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Word 2016 for Mac, Office Compatibility Pack SP3, and Excel V… | Patch early | 7.8 high | 41.1% | 2016-04-12 |
| CVE-2006-3059 EXP | Unspecified vulnerability in Microsoft Excel 2000 through 2004 allows remote user-assisted attackers to execute arbitrary code via unspecified vectors… | Patch early | 9.3 high | 41.1% | 2006-06-17 |
| CVE-2022-29548 EXP | A reflected XSS issue exists in the Management Console of several WSO2 products. This affects API Manager 2.2.0, 2.5.0, 2.6.0, 3.0.0, 3.1.0, 3.2.0, an… | Patch early | 4.6 medium | 41.1% | 2022-04-21 |
| CVE-2015-2065 EXP | SQL injection vulnerability in videogalleryrss.php in the Apptha WordPress Video Gallery (contus-video-gallery) plugin before 2.8 for WordPress allows… | Patch early | 7.5 high | 41.1% | 2015-02-24 |
| CVE-2015-3083 EXP | Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on Linux, Adobe AIR before 17… | Patch early | 6.4 medium | 41.1% | 2015-05-13 |
| CVE-2007-5654 EXP | LiteSpeed Web Server before 3.2.4 allows remote attackers to trigger use of an arbitrary MIME type for a file via a "%00." sequence followed by a new… | Patch early | 5.0 medium | 41.1% | 2007-10-23 |
| CVE-2005-0416 EXP | The Windows Animated Cursor (ANI) capability in Windows NT, Windows 2000 through SP4, Windows XP through SP1, and Windows 2003 allows remote attackers… | Patch early | 7.5 high | 41% | 2005-04-27 |
| CVE-2019-12593 EXP | IceWarp Mail Server through 10.4.4 is prone to a local file inclusion vulnerability via webmail/calendar/minimizer/index.php?style=..%5c directory tra… | Patch early | 7.5 high | 41% | 2019-06-03 |
| CVE-2015-0097 EXP | Microsoft Excel 2007 SP3, PowerPoint 2007 SP3, Word 2007 SP3, Excel 2010 SP2, PowerPoint 2010 SP2, and Word 2010 SP2 allow remote attackers to execute… | Patch early | 9.3 high | 40.9% | 2015-03-11 |
| CVE-2003-0434 EXP | Various PDF viewers including (1) Adobe Acrobat 5.06 and (2) Xpdf 1.01 allow remote attackers to execute arbitrary commands via shell metacharacters i… | Patch early | 7.5 high | 40.9% | 2003-07-24 |
| CVE-2018-14493 EXP | Cross-site scripting (XSS) vulnerability in the Groups Page in Open-Audit Community 2.2.6 allows remote attackers to inject arbitrary web script or HT… | Patch early | 6.1 medium | 40.9% | 2018-07-25 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt