CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
400,218 CVEs
1,730 on KEV
17,275 EPSS ≥ 10%
25,087 with exploits
synced 2026-10-01
206,231 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2008-2719 EXP | Off-by-one error in the ppscan function (preproc.c) in Netwide Assembler (NASM) 2.02 allows context-dependent attackers to cause a denial of service (… | Patch early | 6.8 medium | 10.5% | 2008-06-16 |
| CVE-2019-7272 EXP | Optergy Proton/Enterprise devices allow Username Disclosure. | Patch early | 5.3 medium | 10.5% | 2019-07-01 |
| CVE-2004-2549 EXP | Nortel Wireless LAN (WLAN) Access Point (AP) 2220, 2221, and 2225 allow remote attackers to cause a denial of service (service crash) via a TCP reques… | Patch early | 5.0 medium | 10.5% | 2004-12-31 |
| CVE-2020-23839 EXP | A Reflected Cross-Site Scripting (XSS) vulnerability in GetSimple CMS v3.3.16, in the admin/index.php login portal webpage, allows remote attackers to… | Patch early | 6.1 medium | 10.5% | 2020-09-01 |
| CVE-2000-1061 EXP | Microsoft Virtual Machine (VM) in Internet Explorer 4.x and 5.x allows an unsigned applet to create and use ActiveX controls, which allows a remote at… | Patch early | 5.1 medium | 10.5% | 2000-12-11 |
| CVE-2012-4768 EXP | Cross-site scripting (XSS) vulnerability in the Download Monitor plugin before 3.3.5.9 for WordPress allows remote attackers to inject arbitrary web s… | Patch early | 4.3 medium | 10.5% | 2014-09-04 |
| CVE-2014-5081 EXP | sphider prior to 1.3.6, sphider-pro prior to 3.2, and sphider-plus prior to 3.2 allow authentication bypass | Patch early | 9.8 critical | 10.5% | 2020-01-10 |
| CVE-2010-1152 EXP | memcached.c in memcached before 1.4.3 allows remote attackers to cause a denial of service (daemon hang or crash) via a long line that triggers excess… | Patch early | 5.0 medium | 10.4% | 2010-04-12 |
| CVE-2013-1596 EXP | An Authentication Bypass Vulnerability exists in Vivotek PT7135 IP Camera 0300a and 0400a via specially crafted RTSP packets to TCP port 554. | Patch early | 5.3 medium | 10.4% | 2020-01-24 |
| CVE-2015-5149 EXP | Directory traversal vulnerability in Zoho ManageEngine SupportCenter Plus 7.90 allows remote authenticated users to write to arbitrary files via a ..… | Patch early | 5.5 medium | 10.4% | 2015-06-30 |
| CVE-2011-5181 EXP | Cross-site scripting (XSS) vulnerability in clickdesk.php in ClickDesk Live Support - Live Chat plugin 2.0 for WordPress allows remote attackers to in… | Patch early | 4.3 medium | 10.4% | 2012-09-20 |
| CVE-2006-4844 EXP | PHP remote file inclusion vulnerability in inc/claro_init_local.inc.php in Claroline 1.7.7 and earlier, as used in Dokeos and possibly other products,… | Patch early | 5.1 medium | 10.4% | 2006-09-19 |
| CVE-2004-0270 EXP | libclamav in Clam AntiVirus 0.65 allows remote attackers to cause a denial of service (crash) via a uuencoded e-mail message with an invalid line leng… | Patch early | 5.0 medium | 10.4% | 2004-11-23 |
| CVE-2009-0751 EXP | Yaws before 1.80 allows remote attackers to cause a denial of service (memory consumption and crash) via a request with a large number of headers. | Patch early | 5.0 medium | 10.4% | 2009-03-02 |
| CVE-2011-5009 EXP | The CmpWebServer.dll module in the Control service in 3S CoDeSys 3.4 SP4 Patch 2 allows remote attackers to cause a denial of service (NULL pointer de… | Patch early | 5.0 medium | 10.4% | 2011-12-25 |
| CVE-2012-0781 EXP | The tidy_diagnose function in PHP 5.3.8 might allow remote attackers to cause a denial of service (NULL pointer dereference and application crash) via… | Patch early | 5.0 medium | 10.4% | 2012-01-18 |
| CVE-2009-2958 EXP | The tftp_request function in tftp.c in dnsmasq before 2.50, when --enable-tftp is used, allows remote attackers to cause a denial of service (NULL poi… | Patch early | 4.3 medium | 10.4% | 2009-09-02 |
| CVE-2025-4524 EXP | The Madara – Responsive and modern WordPress theme for manga sites theme for WordPress is vulnerable to Local File Inclusion in all versions up to, an… | Patch early | 9.8 critical | 10.4% | 2025-05-21 |
| CVE-2008-1110 EXP | Buffer overflow in demuxers/demux_asf.c (aka the ASF demuxer) in the xineplug_dmx_asf.so plugin in xine-lib before 1.1.10 allows remote attackers to e… | Patch early | 6.8 medium | 10.4% | 2008-02-29 |
| CVE-2007-6483 EXP | Directory traversal vulnerability in SafeNet Sentinel Protection Server 7.0.0 through 7.4.0 and possibly earlier versions, and Sentinel Keys Server 1.… | Patch early | 5.0 medium | 10.4% | 2007-12-20 |
| CVE-2021-24287 EXP | The settings page of the Select All Categories and Taxonomies, Change Checkbox to Radio Buttons WordPress plugin before 1.3.2 did not properly sanitis… | Patch early | 6.1 medium | 10.4% | 2021-05-14 |
| CVE-2006-2224 EXP | RIPd in Quagga 0.98 and 0.99 before 20060503 does not properly enforce RIPv2 authentication requirements, which allows remote attackers to modify rout… | Patch early | 5.0 medium | 10.4% | 2006-05-05 |
| CVE-2006-2906 EXP | The LZW decoding in the gdImageCreateFromGifPtr function in the Thomas Boutell graphics draw (GD) library (aka libgd) 2.0.33 allows remote attackers t… | Patch early | 5.4 medium | 10.4% | 2006-06-08 |
| CVE-2021-24169 EXP | This Advanced Order Export For WooCommerce WordPress plugin before 3.1.8 helps you to easily export WooCommerce order data. The tab parameter in the A… | Patch early | 6.1 medium | 10.3% | 2021-04-05 |
| CVE-2010-1042 EXP | Microsoft Windows Media Player 11 does not properly perform colorspace conversion, which allows remote attackers to cause a denial of service (memory… | Patch early | 4.3 medium | 10.3% | 2010-03-23 |
| CVE-2003-0130 EXP | The handle_image function in mail-format.c for Ximian Evolution Mail User Agent 1.2.2 and earlier does not properly escape HTML characters, which allo… | Patch early | 5.0 medium | 10.3% | 2003-03-24 |
| CVE-2019-16692 EXP | phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/filter-result.php table parameter when action=add is used. | Patch early | 9.8 critical | 10.3% | 2019-09-22 |
| CVE-2015-2863 EXP | Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 before 9.0.0.14, and 9.1 before… | Patch early | 4.3 medium | 10.3% | 2015-07-20 |
| CVE-2012-4032 EXP | Open redirect vulnerability in the login page in WebsitePanel before 1.2.2.1 allows remote attackers to redirect users to arbitrary web sites and cond… | Patch early | 5.8 medium | 10.3% | 2012-07-17 |
| CVE-2001-0375 EXP | Cisco PIX Firewall 515 and 520 with 5.1.4 OS running aaa authentication to a TACACS+ server allows remote attackers to cause a denial of service via a… | Patch early | 5.0 medium | 10.3% | 2001-06-18 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt