CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
401,058 CVEs
1,733 on KEV
17,286 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-03
319,656 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2024-24494 EXP | Cross Site Scripting vulnerability in Daily Habit Tracker v.1.0 allows a remote attacker to execute arbitrary code via the day, exercise, pray, read_b… | Patch early | 6.1 medium | 25.9% | 2024-02-08 |
| CVE-2009-1523 EXP | Directory traversal vulnerability in the HTTP server in Mort Bay Jetty 5.1.14, 6.x before 6.1.17, and 7.x through 7.0.0.M2 allows remote attackers to… | Patch early | 5.0 medium | 25.8% | 2009-05-05 |
| CVE-2006-3081 EXP | mysqld in MySQL 4.1.x before 4.1.18, 5.0.x before 5.0.19, and 5.1.x before 5.1.6 allows remote authorized users to cause a denial of service (crash) v… | Patch early | 4.0 medium | 25.8% | 2006-06-19 |
| CVE-1999-0236 EXP | ScriptAlias directory in NCSA and Apache httpd allowed attackers to read CGI programs. | Patch early | 7.5 high | 25.8% | 1997-01-01 |
| CVE-2008-4800 EXP | The DebugDiag ActiveX control in CrashHangExt.dll, possibly 1.0, in Microsoft Debug Diagnostic Tool allows remote attackers to cause a denial of servi… | Patch early | 5.0 medium | 25.8% | 2008-10-31 |
| CVE-2009-0692 EXP | Stack-based buffer overflow in the script_write_params method in client/dhclient.c in ISC DHCP dhclient 4.1 before 4.1.0p1, 4.0 before 4.0.1p1, 3.1 be… | Patch early | 10.0 high | 25.8% | 2009-07-14 |
| CVE-2019-13359 EXP | In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.836, a cwpsrv-xxx cookie allows a normal user to craft and upload a session file to the /tmp d… | Patch early | 7.5 high | 25.8% | 2019-07-16 |
| CVE-2021-25162 EXP | A remote execution of arbitrary commands vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6… | Patch early | 8.1 high | 25.8% | 2021-03-30 |
| CVE-2002-1712 EXP | Microsoft Windows 2000 allows remote attackers to cause a denial of service (memory consumption) by sending a flood of empty TCP/IP packets with the A… | Patch early | 5.0 medium | 25.8% | 2002-12-31 |
| CVE-2002-1131 EXP | Cross-site scripting vulnerabilities in SquirrelMail 1.2.7 and earlier allows remote attackers to execute script as other web users via (1) addressboo… | Patch early | 7.5 high | 25.8% | 2002-10-04 |
| CVE-2004-0479 EXP | Internet Explorer 6 allows remote attackers to cause a denial of service (crash) via Javascript that creates a new popup window and disables the image… | Patch early | 5.0 medium | 25.8% | 2004-07-07 |
| CVE-2011-3315 EXP | Directory traversal vulnerability in Cisco Unified Communications Manager (CUCM) 5.x and 6.x before 6.1(5)SU2, 7.x before 7.1(5b)SU2, and 8.x before 8… | Patch early | 7.8 high | 25.7% | 2011-10-27 |
| CVE-2005-3745 EXP | Cross-site scripting (XSS) vulnerability in Apache Struts 1.2.7, and possibly other versions allows remote attackers to inject arbitrary web script or… | Patch early | 4.3 medium | 25.7% | 2005-11-22 |
| CVE-2018-4935 EXP | Adobe Flash Player versions 29.0.0.113 and earlier have an exploitable out-of-bounds write vulnerability. Successful exploitation could lead to arbitr… | Patch early | 8.8 high | 25.7% | 2018-05-19 |
| CVE-2018-4937 EXP | Adobe Flash Player versions 29.0.0.113 and earlier have an exploitable out-of-bounds write vulnerability. Successful exploitation could lead to arbitr… | Patch early | 8.8 high | 25.7% | 2018-05-19 |
| CVE-2002-0724 EXP | Buffer overflow in SMB (Server Message Block) protocol in Microsoft Windows NT, Windows 2000, and Windows XP allows attackers to cause a denial of ser… | Patch early | 7.5 high | 25.7% | 2002-09-24 |
| CVE-2008-6483 EXP | PHP remote file inclusion vulnerability in admin.googlebase.php in the Ecom Solutions VirtueMart Google Base (aka com_googlebase or Froogle) component… | Patch early | 7.5 high | 25.7% | 2009-03-18 |
| CVE-2005-4703 EXP | Apache Tomcat 4.0.3, when running on Windows, allows remote attackers to obtain sensitive information via a request for a file that contains an MS-DOS… | Patch early | 5.0 medium | 25.7% | 2005-12-31 |
| CVE-2000-0759 EXP | Jakarta Tomcat 3.1 under Apache reveals physical path information when a remote attacker requests a URL that does not exist, which generates an error… | Patch early | 6.4 medium | 25.7% | 2000-10-20 |
| CVE-2004-1560 EXP | Microsoft SQL Server 7.0 allows remote attackers to cause a denial of service (mssqlserver service halt) via a long request to TCP port 1433, possibly… | Patch early | 5.0 medium | 25.6% | 2004-12-31 |
| CVE-2010-3749 EXP | The browser-plugin implementation in RealNetworks RealPlayer 11.0 through 11.1 and RealPlayer SP 1.0 through 1.1 allows remote attackers to arguments… | Patch early | 9.3 high | 25.6% | 2010-10-19 |
| CVE-2005-2307 EXP | netman.dll in Microsoft Windows Connections Manager Library allows local users to cause a denial of service (Network Connections Service crash) via a… | Patch early | 5.0 medium | 25.6% | 2005-07-19 |
| CVE-2015-6086 EXP | Microsoft Internet Explorer 9 through 11 allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Inte… | Patch early | 4.3 medium | 25.6% | 2015-11-11 |
| CVE-2005-0420 EXP | Microsoft Outlook Web Access (OWA), when used with Exchange, allows remote attackers to redirect users to arbitrary URLs for login via a link to the o… | Patch early | 5.8 medium | 25.6% | 2005-04-27 |
| CVE-2009-1492 EXP | The getAnnots Doc method in the JavaScript API in Adobe Reader and Acrobat 9.1, 8.1.4, 7.1.1, and earlier allows remote attackers to cause a denial of… | Patch early | 9.3 high | 25.5% | 2009-04-30 |
| CVE-2006-1626 EXP | Internet Explorer 6 for Windows XP SP2 and earlier allows remote attackers to spoof the address bar and possibly conduct phishing attacks by re-openin… | Patch early | 4.3 medium | 25.5% | 2006-04-05 |
| CVE-2005-2340 EXP | Heap-based buffer overflow in Apple Quicktime before 7.0.4 allows remote attackers to execute arbitrary code via a crafted (1) QuickTime Image File (Q… | Patch early | 7.5 high | 25.5% | 2005-12-31 |
| CVE-2015-3073 EXP | Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to bypass intended restrictions on JavaScript… | Patch early | 10.0 high | 25.5% | 2015-05-13 |
| CVE-2015-8634 EXP | Use-after-free vulnerability in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 o… | Patch early | 8.8 high | 25.5% | 2015-12-28 |
| CVE-2015-8635 EXP | Use-after-free vulnerability in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 o… | Patch early | 8.8 high | 25.5% | 2015-12-28 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt