CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
400,331 CVEs
1,730 on KEV
17,275 EPSS ≥ 10%
25,087 with exploits
synced 2026-10-01
206,283 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2004-2761 EXP | The MD5 Message-Digest Algorithm is not collision resistant, which makes it easier for context-dependent attackers to conduct spoofing attacks, as dem… | Patch early | 9.8 critical | 9.9% | 2009-01-05 |
| CVE-2016-0862 EXP | General Electric (GE) Industrial Solutions UPS SNMP/Web Adapter devices with firmware before 4.8 allow remote authenticated users to obtain sensitive… | Patch early | 6.5 medium | 9.9% | 2016-02-05 |
| CVE-2010-4717 EXP | Multiple stack-based buffer overflows in the IMAP server component in GroupWise Internet Agent (GWIA) in Novell GroupWise before 8.02HP allow remote a… | Patch early | 6.5 medium | 9.9% | 2011-01-31 |
| CVE-2009-5135 EXP | The Java XML parser in Echo before 2.1.1 and 3.x before 3.0.b6 allows remote attackers to read arbitrary files via a request containing an external en… | Patch early | 5.0 medium | 9.9% | 2013-05-02 |
| CVE-2003-1029 EXP | The L2TP protocol parser in tcpdump 3.8.1 and earlier allows remote attackers to cause a denial of service (infinite loop and memory consumption) via… | Patch early | 5.0 medium | 9.9% | 2004-02-17 |
| CVE-2019-12461 EXP | Web Port 1.19.1 allows XSS via the /log type parameter. | Patch early | 6.1 medium | 9.9% | 2019-05-30 |
| CVE-2021-41878 EXP | A reflected cross-site scripting (XSS) vulnerability exists in the i-Panel Administration System Version 2.0 that enables a remote attacker to execute… | Patch early | 6.1 medium | 9.9% | 2021-10-04 |
| CVE-2018-12706 EXP | DIGISOL DG-BR4000NG devices have a Buffer Overflow via a long Authorization HTTP header. | Patch early | 9.8 critical | 9.9% | 2018-06-24 |
| CVE-2019-11705 EXP | A flaw in Thunderbird's implementation of iCal causes a stack buffer overflow in icalrecur_add_bydayrules when processing certain email messages, resu… | Patch early | 9.8 critical | 9.9% | 2019-07-23 |
| CVE-2006-4191 EXP | Directory traversal vulnerability in memcp.php in XMB (Extreme Message Board) 1.9.6 and earlier allows remote attackers to include and execute arbitra… | Patch early | 5.1 medium | 9.9% | 2006-08-17 |
| CVE-2006-0647 EXP | LDAP service in Sun Java System Directory Server 5.2, running on Linux and possibly other platforms, allows remote attackers to cause a denial of serv… | Patch early | 5.0 medium | 9.9% | 2006-02-13 |
| CVE-2000-0594 EXP | BitchX IRC client does not properly cleanse an untrusted format string, which allows remote attackers to cause a denial of service via an invite to a… | Patch early | 5.0 medium | 9.9% | 2000-07-04 |
| CVE-2015-5161 EXP | The Zend_Xml_Security::scan in ZendXml before 1.0.1 and Zend Framework before 1.12.14, 2.x before 2.4.6, and 2.5.x before 2.5.2, when running under PH… | Patch early | 6.8 medium | 9.9% | 2015-08-25 |
| CVE-2004-1389 EXP | Unknown vulnerability in the Veritas NetBackup Administrative Assistant interface for NetBackup BusinesServer 3.4, 3.4.1, and 4.5, DataCenter 3.4, 3.4… | Patch early | 6.0 medium | 9.9% | 2004-12-31 |
| CVE-1999-1588 EXP | Buffer overflow in nlps_server in Sun Solaris x86 2.4, 2.5, and 2.5.1 allows remote attackers to execute arbitrary code as root via a long string begi… | Patch early | 9.8 critical | 9.9% | 1999-12-31 |
| CVE-2018-6220 EXP | An arbitrary file write vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow an attacker to inject arbitrary data, which may lead to… | Patch early | 9.8 critical | 9.9% | 2018-03-15 |
| CVE-2010-3879 EXP | FUSE, possibly 2.8.5 and earlier, allows local users to create mtab entries with arbitrary pathnames, and consequently unmount any filesystem, via a s… | Patch early | 5.8 medium | 9.8% | 2011-01-22 |
| CVE-2006-2323 EXP | Multiple PHP remote file inclusion vulnerabilities in SmartISoft phpListPro 2.01 and earlier allow remote attackers to execute arbitrary PHP code via… | Patch early | 5.1 medium | 9.8% | 2006-05-12 |
| CVE-2023-27100 EXP | Improper restriction of excessive authentication attempts in the SSHGuard component of Netgate pfSense Plus software v22.05.1 and pfSense CE software… | Patch early | 9.8 critical | 9.8% | 2023-03-22 |
| CVE-2019-8390 EXP | qdPM 9.1 suffers from Cross-site Scripting (XSS) in the search[keywords] parameter. | Patch early | 6.1 medium | 9.8% | 2019-05-14 |
| CVE-2011-0708 EXP | exif.c in the Exif extension in PHP before 5.3.6 on 64-bit platforms performs an incorrect cast, which allows remote attackers to cause a denial of se… | Patch early | 4.3 medium | 9.8% | 2011-03-20 |
| CVE-2006-2894 EXP | Mozilla Firefox 1.5.0.4, 2.0.x before 2.0.0.8, Mozilla Suite 1.7.13, Mozilla SeaMonkey 1.0.2 and other versions before 1.1.5, and Netscape 8.1 and ear… | Patch early | 4.0 medium | 9.8% | 2006-06-07 |
| CVE-2017-17417 EXP | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is… | Patch early | 9.8 critical | 9.8% | 2018-02-08 |
| CVE-1999-1110 EXP | Windows Media Player ActiveX object as used in Internet Explorer 5.0 returns a specific error code when a file does not exist, which allows remote mal… | Patch early | 5.0 medium | 9.8% | 1999-11-14 |
| CVE-2020-24609 EXP | TechKshetra Info Solutions Pvt. Ltd Savsoft Quiz 5.5 and earlier has XSS which can result in an attacker injecting the XSS payload in the User Registr… | Patch early | 6.1 medium | 9.8% | 2020-08-25 |
| CVE-2008-3680 EXP | The decryption function in Flagship Industries Ventrilo 3.0.2 and earlier allows remote attackers to cause a denial of service (NULL pointer dereferen… | Patch early | 5.0 medium | 9.8% | 2008-08-14 |
| CVE-2018-11523 EXP | upload.php on NUUO NVRmini 2 devices allows Arbitrary File Upload, such as upload of .php files. | Patch early | 9.8 critical | 9.8% | 2018-05-29 |
| CVE-2009-4489 EXP | header.c in Cherokee before 0.99.32 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modif… | Patch early | 5.0 medium | 9.8% | 2010-01-13 |
| CVE-2012-0996 EXP | Multiple directory traversal vulnerabilities in 11in1 1.2.1 stable 12-31-2011 allow remote attackers to read arbitrary files via a .. (dot dot) in the… | Patch early | 5.0 medium | 9.8% | 2012-02-24 |
| CVE-2002-0543 EXP | Directory traversal vulnerability in Aprelium Abyss Web Server (abyssws) before 1.0.0.2 allows remote attackers to read files outside the web root, in… | Patch early | 5.0 medium | 9.8% | 2002-07-03 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt