CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
425,763 CVEs
1,781 on KEV
17,555 EPSS ≥ 10%
25,095 with exploits
synced 2026-11-14
25,095 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2013-1599 EXP | A Command Injection vulnerability exists in the /var/www/cgi-bin/rtpd.cgi script in D-Link IP Cameras DCS-3411/3430 firmware 1.02, DCS-5605/5635 1.01,… | Patch early | 9.8 critical | 40.4% | 2020-01-28 |
| CVE-2013-0136 EXP | Multiple directory traversal vulnerabilities in the EditDocument servlet in the Frontend in Mutiny before 5.0-1.11 allow remote authenticated users to… | Patch early | 8.5 high | 40.3% | 2013-06-01 |
| CVE-2007-4475 EXP | Stack-based buffer overflow in EAI WebViewer3D ActiveX control (webviewer3d.dll) in SAP AG SAPgui before 7.10 Patch Level 9 allows remote attackers to… | Patch early | 9.3 high | 40.3% | 2009-04-01 |
| CVE-2020-24217 EXP | An issue was discovered in the box application on HiSilicon based IPTV/H.264/H.265 video encoders. The file-upload endpoint does not enforce authentic… | Patch early | 9.8 critical | 40.3% | 2020-10-06 |
| CVE-2006-2383 EXP | Unspecified vulnerability in Microsoft Internet Explorer 5.01 SP4 and 6 SP1 and earlier allows remote attackers to execute arbitrary code via "unexpec… | Patch early | 9.3 high | 40.3% | 2006-06-13 |
| CVE-2008-1472 EXP | Stack-based buffer overflow in the ListCtrl ActiveX Control (ListCtrl.ocx), as used in multiple CA products including BrightStor ARCserve Backup R11.5… | Patch early | 9.3 high | 40.3% | 2008-03-24 |
| CVE-2005-2852 EXP | Unknown vulnerability in CIFS.NLM in Novell Netware 6.5 SP2 and SP3, 5.1, and 6.0 allows remote attackers to cause a denial of service (ABEND) via an… | Patch early | 5.0 medium | 40.3% | 2005-09-08 |
| CVE-2007-5641 EXP | Multiple PHP remote file inclusion vulnerabilities in PHP Project Management 0.8.10 and earlier allow remote attackers to execute arbitrary PHP code v… | Patch early | 6.8 medium | 40.3% | 2007-10-23 |
| CVE-2015-6000 EXP | Unrestricted file upload vulnerability in the Settings_Vtiger_CompanyDetailsSave_Action class in modules/Settings/Vtiger/actions/CompanyDetailsSave.ph… | Patch early | 8.8 high | 40.2% | 2020-02-06 |
| CVE-2007-5407 EXP | Multiple PHP remote file inclusion vulnerabilities in the JContentSubscription (com_jcs) 1.5.8 component for Joomla! allow remote attackers to execute… | Patch early | 6.8 medium | 40.2% | 2007-10-12 |
| CVE-2007-3147 EXP | Buffer overflow in the Yahoo! Webcam Upload ActiveX control in ywcupl.dll 2.0.1.4 for Yahoo! Messenger 8.1.0.249 allows remote attackers to execute ar… | Patch early | 9.3 high | 40.2% | 2007-06-11 |
| CVE-2024-42640 EXP | angular-base64-upload prior to v0.1.21 is vulnerable to unauthenticated remote code execution via demo/server.php. Exploiting this vulnerability allow… | Patch early | 9.8 critical | 40.2% | 2024-10-11 |
| CVE-2012-3579 EXP | Symantec Messaging Gateway (SMG) before 10.0 has a default password for an unspecified account, which makes it easier for remote attackers to obtain p… | Patch early | 7.9 high | 40.2% | 2012-08-29 |
| CVE-2009-2011 EXP | Worldweaver DX Studio Player 3.0.29.0, 3.0.22.0, 3.0.12.0, and probably other versions before 3.0.29.1, when used as a plug-in for Firefox, does not r… | Patch early | 9.3 high | 40.2% | 2009-06-16 |
| CVE-2018-0833 EXP | The Microsoft Server Message Block 2.0 and 3.0 (SMBv2/SMBv3) client in Windows 8.1 and RT 8.1 and Windows Server 2012 R2 allows a denial of service vu… | Patch early | 5.3 medium | 40.2% | 2018-02-15 |
| CVE-2018-12054 EXP | Arbitrary File Read exists in PHP Scripts Mall Schools Alert Management Script via the f parameter in img.php, aka absolute path traversal. | Patch early | 7.5 high | 40.1% | 2018-06-08 |
| CVE-2010-2709 EXP | Stack-based buffer overflow in webappmon.exe in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53 allows remote attackers to execute arbitrary c… | Patch early | 9.3 high | 40.1% | 2010-08-05 |
| CVE-2007-2481 EXP | PHP remote file inclusion vulnerability in wordtube-button.php in the wordTube 1.43 and earlier plugin for WordPress, when register_globals is enabled… | Patch early | 6.8 medium | 40.1% | 2007-05-03 |
| CVE-2014-8586 EXP | SQL injection vulnerability in the CP Multi View Event Calendar plugin 1.01 for WordPress allows remote attackers to execute arbitrary SQL commands vi… | Patch early | 7.5 high | 40.1% | 2014-11-04 |
| CVE-2015-2065 EXP | SQL injection vulnerability in videogalleryrss.php in the Apptha WordPress Video Gallery (contus-video-gallery) plugin before 2.8 for WordPress allows… | Patch early | 7.5 high | 40.1% | 2015-02-24 |
| CVE-2009-1968 EXP | Unspecified vulnerability in the Secure Enterprise Search component in Oracle Database 10.1.8.3 allows remote attackers to affect integrity via unknow… | Patch early | 4.3 medium | 40.1% | 2009-07-14 |
| CVE-2016-3371 EXP | The kernel API in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Window… | Patch early | 5.5 medium | 40.1% | 2016-09-14 |
| CVE-2007-5243 EXP | Multiple stack-based buffer overflows in Borland InterBase LI 8.0.0.53 through 8.1.0.253, and WI 5.1.1.680 through 8.1.0.257, allow remote attackers t… | Patch early | 9.3 high | 40.1% | 2007-10-06 |
| CVE-2009-2754 EXP | Integer signedness error in the authentication functionality in librpc.dll in the Informix Storage Manager (ISM) Portmapper service (aka portmap.exe),… | Patch early | 10.0 high | 40.1% | 2010-03-05 |
| CVE-2014-2928 EXP | The iControl API in F5 BIG-IP LTM, APM, ASM, GTM, Link Controller, and PSM 10.0.0 through 10.2.4 and 11.0.0 through 11.5.1, BIG-IP AAM 11.4.0 through… | Patch early | 7.1 high | 40.1% | 2014-05-12 |
| CVE-2002-1973 EXP | Buffer overflow in CHttpServer::OnParseError in the ISAPI extension (Isapi.cpp) when built using Microsoft Foundation Class (MFC) static libraries in… | Patch early | 7.5 high | 40% | 2002-12-31 |
| CVE-1999-0154 EXP | IIS 2.0 and 3.0 allows remote attackers to read the source code for ASP pages by appending a . (dot) to the end of the URL. | Patch early | 5.0 medium | 40% | 1999-12-31 |
| CVE-2019-10945 EXP | An issue was discovered in Joomla! before 3.9.5. The Media Manager component does not properly sanitize the folder parameter, allowing attackers to ac… | Patch early | 9.8 critical | 40% | 2019-04-10 |
| CVE-2019-7442 EXP | An XML external entity (XXE) vulnerability in the Password Vault Web Access (PVWA) of CyberArk Enterprise Password Vault <=10.7 allows remote attacker… | Patch early | 9.8 critical | 40% | 2019-05-08 |
| CVE-2019-7269 EXP | Linear eMerge 50P/5000P devices allow Authenticated Command Injection with root Code Execution. | Patch early | 9.8 critical | 40% | 2019-07-02 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt