CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
401,047 CVEs
1,733 on KEV
17,286 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-03
186,432 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2016-9150 EXP | Buffer overflow in the management web interface in Palo Alto Networks PAN-OS before 5.0.20, 5.1.x before 5.1.13, 6.0.x before 6.0.15, 6.1.x before 6.1… | Patch early | 9.8 critical | 34.8% | 2016-11-19 |
| CVE-2004-2221 EXP | Buffer overflow in SoftCart.exe in Mercantec SoftCart 4.00b allows remote attackers to execute arbitrary code via a long parameter in an HTTP GET requ… | Patch early | 7.5 high | 34.8% | 2004-12-31 |
| CVE-2008-2683 EXP | The BIDIB.BIDIBCtrl.1 ActiveX control in BIDIB.ocx 10.9.3.0 in Black Ice Barcode SDK 5.01 allows remote attackers to force the download and storage of… | Patch early | 9.3 high | 34.8% | 2008-06-12 |
| CVE-2019-9880 EXP | An issue was discovered in the WPGraphQL 0.2.3 plugin for WordPress. By querying the 'users' RootQuery, it is possible, for an unauthenticated attacke… | Patch early | 9.1 critical | 34.8% | 2019-06-10 |
| CVE-2015-2177 EXP | Siemens SIMATIC S7-300 CPU devices allow remote attackers to cause a denial of service (defect-mode transition) via crafted packets on (1) TCP port 10… | Patch early | 7.5 high | 34.7% | 2015-03-07 |
| CVE-2019-16451 EXP | Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier, 2017.011.30155 and earlier version, 2017.011.30152 and ear… | Patch early | 9.8 critical | 34.7% | 2019-12-19 |
| CVE-2014-1770 EXP | Use-after-free vulnerability in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code via crafted JavaScript code… | Patch early | 9.3 high | 34.7% | 2014-05-22 |
| CVE-2017-5869 EXP | Directory traversal vulnerability in the file import feature in Nuxeo Platform 6.0, 7.1, 7.2, and 7.3 allows remote authenticated users to upload and… | Patch early | 8.8 high | 34.6% | 2017-03-24 |
| CVE-2019-8048 EXP | Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015… | Patch early | 9.8 critical | 34.6% | 2019-08-20 |
| CVE-2022-37661 EXP | SmartRG SR506n 2.5.15 and SR510n 2.6.13 routers are vulnerable to Remote Code Execution (RCE) via the ping host feature. | Patch early | 9.8 critical | 34.6% | 2022-09-14 |
| CVE-2015-2463 EXP | Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Go… | Patch early | 9.3 high | 34.5% | 2015-08-15 |
| CVE-2015-6152 EXP | Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web si… | Patch early | 9.3 high | 34.4% | 2015-12-09 |
| CVE-2017-16930 EXP | The remote management interface on the Claymore Dual GPU miner 10.1 allows an unauthenticated remote attacker to execute arbitrary code due to a stack… | Patch early | 9.8 critical | 34.3% | 2017-12-05 |
| CVE-2013-0928 EXP | The NetWorker command processor in rrobotd.exe in the Device Manager in EMC AlphaStor 4.0 before build 800 allows remote attackers to execute arbitrar… | Patch early | 9.3 high | 34.3% | 2013-01-21 |
| CVE-2010-0476 EXP | The SMB client in Microsoft Windows Server 2003 SP2, Vista Gold, SP1, and SP2, and Windows Server 2008 Gold and SP2 allows remote SMB servers and man-… | Patch early | 10.0 high | 34.3% | 2010-04-14 |
| CVE-2017-5792 EXP | A Remote Code Execution vulnerability in HPE Intelligent Management Center (iMC) PLAT version 7.3 E0504P2 was found. | Patch early | 9.8 critical | 34.3% | 2018-02-15 |
| CVE-2009-0592 EXP | Multiple directory traversal vulnerabilities in PNphpBB2 1.2i and earlier allow remote attackers to include and execute arbitrary local files via a ..… | Patch early | 7.5 high | 34.3% | 2009-02-16 |
| CVE-2008-0567 EXP | Multiple PHP remote file inclusion vulnerabilities in ChronoEngine ChronoForms (com_chronocontact) 2.3.5 component for Joomla! allow remote attackers… | Patch early | 7.5 high | 34.3% | 2008-02-05 |
| CVE-2008-0645 EXP | Multiple PHP remote file inclusion vulnerabilities in Portail Web Php 2.5.1.1 allow remote attackers to execute arbitrary PHP code via a URL in the si… | Patch early | 7.5 high | 34.3% | 2008-02-07 |
| CVE-2016-2563 EXP | Stack-based buffer overflow in the SCP command-line utility in PuTTY before 0.67 and KiTTY 0.66.6.3 and earlier allows remote servers to cause a denia… | Patch early | 9.8 critical | 34.2% | 2016-04-07 |
| CVE-2015-4432 EXP | Heap-based buffer overflow in Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481… | Patch early | 10.0 high | 34.2% | 2015-07-09 |
| CVE-2018-4416 EXP | Multiple memory corruption issues were addressed with improved memory handling. This issue affected versions prior to iOS 12.1, tvOS 12.1, watchOS 5.1… | Patch early | 8.8 high | 34.2% | 2019-04-03 |
| CVE-2024-24747 EXP | MinIO is a High Performance Object Storage. When someone creates an access key, it inherits the permissions of the parent key. Not only for `s3:*` act… | Patch early | 8.8 high | 34.1% | 2024-01-31 |
| CVE-2005-0944 EXP | Unknown vulnerability in Microsoft Jet DB engine (msjet40.dll) 4.00.8618.0, related to insufficient data validation, allows remote attackers to execut… | Patch early | 7.5 high | 34% | 2005-05-02 |
| CVE-2002-0048 EXP | Multiple signedness errors (mixed signed and unsigned numbers) in the I/O functions of rsync 2.4.6, 2.3.2, and other versions allow remote attackers t… | Patch early | 10.0 high | 34% | 2002-02-27 |
| CVE-2010-0027 EXP | The URL validation functionality in Microsoft Internet Explorer 5.01, 6, 6 SP1, 7 and 8, and the ShellExecute API function in Windows 2000 SP4, XP SP2… | Patch early | 9.3 high | 34% | 2010-01-22 |
| CVE-2007-2366 EXP | Buffer overflow in Corel Paint Shop Pro 11.20 allows user-assisted remote attackers to execute arbitrary code via a crafted .PNG file. | Patch early | 7.4 high | 33.9% | 2007-04-30 |
| CVE-2019-12480 EXP | BACnet Protocol Stack through 0.8.6 has a segmentation fault leading to denial of service in BACnet APDU Layer because a malformed DCC in AtomicWriteF… | Patch early | 7.5 high | 33.9% | 2019-05-30 |
| CVE-2023-37569 EXP | This vulnerability exists in ESDS Emagic Data Center Management Suit due to lack of input sanitization in its Ping component. A remote authenticated a… | Patch early | 8.8 high | 33.9% | 2023-08-08 |
| CVE-2017-11281 EXP | Adobe Flash Player has an exploitable memory corruption vulnerability in the text handling function. Successful exploitation could lead to arbitrary c… | Patch early | 9.8 critical | 33.9% | 2017-12-01 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt