CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
400,165 CVEs
1,730 on KEV
17,275 EPSS ≥ 10%
25,087 with exploits
synced 2026-10-01
12,661 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2006-1900 EXP | Multiple buffer overflows in World Wide Web Consortium (W3C) Amaya 9.4, and possibly other versions including 8.x before 8.8.5, allow remote attackers… | Patch early | 7.6 high | 16.5% | 2006-04-20 |
| CVE-2016-4135 EXP | Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11… | Patch early | 8.8 high | 16.5% | 2016-06-16 |
| CVE-2019-6974 EXP | In the Linux kernel before 4.20.8, kvm_ioctl_create_device in virt/kvm/kvm_main.c mishandles reference counting because of a race condition, leading t… | Patch early | 8.1 high | 16.5% | 2019-02-15 |
| CVE-2015-3110 EXP | Integer overflow in Adobe Photoshop CC before 16.0 (aka 2015.0.0) and Adobe Bridge CC before 6.11 allows attackers to execute arbitrary code via unspe… | Patch early | 10.0 high | 16.5% | 2015-06-24 |
| CVE-2002-1580 EXP | Integer overflow in imapparse.c for Cyrus IMAP server 1.4 and 2.1.10 allows remote attackers to execute arbitrary code via a large length value that f… | Patch early | 7.5 high | 16.5% | 2004-06-14 |
| CVE-2009-1324 EXP | Stack-based buffer overflow in Mini-stream ASX to MP3 Converter 3.0.0.7 allows remote attackers to execute arbitrary code via a long URI in a playlist… | Patch early | 9.3 high | 16.5% | 2009-04-17 |
| CVE-2000-0389 EXP | Buffer overflow in krb_rd_req function in Kerberos 4 and 5 allows remote attackers to gain root privileges. | Patch early | 10.0 high | 16.5% | 2000-05-16 |
| CVE-2020-29238 EXP | An integer buffer overflow in the Nginx webserver of ExpressVPN Router version 1 allows remote attackers to obtain sensitive information when the serv… | Patch early | 7.5 high | 16.5% | 2021-03-10 |
| CVE-2015-1815 EXP | The get_rpm_nvr_by_file_path_temporary function in util.py in setroubleshoot before 3.2.22 allows remote attackers to execute arbitrary commands via s… | Patch early | 10.0 high | 16.5% | 2015-03-30 |
| CVE-2006-5392 EXP | Multiple PHP remote file inclusion vulnerabilities in OpenDock FullCore 4.4 and earlier allow remote attackers to execute arbitrary PHP code via a URL… | Patch early | 7.5 high | 16.5% | 2006-10-18 |
| CVE-2013-2572 EXP | A Security Bypass vulnerability exists in TP-LINK IP Cameras TL-SC 3130, TL-SC 3130G, 3171G, 4171G, and 3130 1.6.18P12 due to default hard-coded crede… | Patch early | 7.5 high | 16.4% | 2020-01-29 |
| CVE-2006-4052 EXP | Multiple PHP remote file inclusion vulnerabilities in Turnkey Web Tools PHP Simple Shop 2.0 and earlier allow remote attackers to execute arbitrary PH… | Patch early | 7.5 high | 16.4% | 2006-08-10 |
| CVE-2006-4287 EXP | Multiple PHP remote file inclusion vulnerabilities in NES Game and NES System c108122 and earlier allow remote attackers to execute arbitrary PHP code… | Patch early | 7.5 high | 16.4% | 2006-08-22 |
| CVE-2006-3444 EXP | Unspecified vulnerability in the kernel in Microsoft Windows 2000 SP4, probably a buffer overflow, allows local users to obtain privileges via unspeci… | Patch early | 7.5 high | 16.4% | 2006-08-09 |
| CVE-2019-14422 EXP | An issue was discovered in in TortoiseSVN 1.12.1. The Tsvncmd: URI handler allows a customised diff operation on Excel workbooks, which could be used… | Patch early | 8.8 high | 16.4% | 2019-08-15 |
| CVE-2012-1184 EXP | Stack-based buffer overflow in the ast_parse_digest function in main/utils.c in Asterisk 1.8.x before 1.8.10.1 and 10.x before 10.2.1 allows remote at… | Patch early | 7.5 high | 16.4% | 2012-09-18 |
| CVE-2016-4136 EXP | Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11… | Patch early | 8.8 high | 16.4% | 2016-06-16 |
| CVE-2016-4137 EXP | Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11… | Patch early | 8.8 high | 16.4% | 2016-06-16 |
| CVE-2007-0949 EXP | Stack-based buffer overflow in iTinySoft Studio Total Video Player 1.03, and possibly earlier, allows remote attackers to execute arbitrary code via a… | Patch early | 10.0 high | 16.4% | 2007-02-15 |
| CVE-2006-6293 EXP | Heap-based buffer overflow in FRISK Software F-Prot Antivirus before 4.6.7 allows user-assisted remote attackers to execute arbitrary code via a craft… | Patch early | 7.5 high | 16.4% | 2006-12-05 |
| CVE-2005-1193 EXP | The bbencode_second_pass and make_clickable functions in bbcode.php for phpBB before 2.0.15, as used in viewtopic.php, privmsg.php, and other scripts,… | Patch early | 7.5 high | 16.4% | 2005-05-16 |
| CVE-2003-0407 EXP | Buffer overflow in gbnserver for Gnome Batalla Naval 1.0.4 allows remote attackers to execute arbitrary code via a long connection string. | Patch early | 10.0 high | 16.4% | 2003-06-30 |
| CVE-2007-6506 EXP | The HPRulesEngine.ContentCollection.1 ActiveX Control in RulesEngine.dll for HP Software Update 4.000.005.007 and earlier, including 3.0.8.4, allows r… | Patch early | 9.3 high | 16.3% | 2007-12-20 |
| CVE-2001-0775 EXP | Buffer overflow in xloadimage 4.1 (aka xli 1.16 and 1.17) in Linux allows remote attackers to execute arbitrary code via a FACES format image containi… | Patch early | 7.5 high | 16.3% | 2001-10-18 |
| CVE-2006-3771 EXP | Multiple PHP remote file inclusion vulnerabilities in component.php in iManage CMS 4.0.12 and earlier allow remote attackers to execute arbitrary PHP… | Patch early | 7.5 high | 16.3% | 2006-07-24 |
| CVE-2006-3911 EXP | PHP remote file inclusion vulnerability in OSI Codes PHP Live! 3.2.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in th… | Patch early | 7.5 high | 16.3% | 2006-07-28 |
| CVE-1999-0095 EXP | The debug command in Sendmail is enabled, allowing attackers to execute commands as root. | Patch early | 10.0 high | 16.3% | 1988-10-01 |
| CVE-2010-3142 EXP | Untrusted search path vulnerability in Microsoft Office PowerPoint 2007 allows local users, and possibly remote attackers, to execute arbitrary code a… | Patch early | 9.3 high | 16.3% | 2010-08-27 |
| CVE-2007-1578 EXP | Multiple integer signedness errors in the NTLM implementation in Atrium MERCUR IMAPD (mcrimap4.exe) 5.00.14, with SP4, allow remote attackers to execu… | Patch early | 10.0 high | 16.3% | 2007-03-21 |
| CVE-2007-4642 EXP | Multiple buffer overflows in Doomsday (aka deng) 1.9.0-beta5.1 and earlier allow remote attackers to execute arbitrary code via a long chat (PKT_CHAT)… | Patch early | 10.0 high | 16.3% | 2007-08-31 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt