CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
401,058 CVEs
1,733 on KEV
17,286 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-03
186,433 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2015-0040 EXP | Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web si… | Patch early | 9.3 high | 30% | 2015-02-11 |
| CVE-2024-22836 EXP | An OS command injection vulnerability exists in Akaunting v3.1.3 and earlier. An attacker can manipulate the company locale when installing an app to… | Patch early | 9.8 critical | 30% | 2024-02-08 |
| CVE-2019-15715 EXP | MantisBT before 1.3.20 and 2.22.1 allows Post Authentication Command Injection, leading to Remote Code Execution. | Patch early | 7.2 high | 30% | 2019-10-09 |
| CVE-2015-8046 EXP | Use-after-free vulnerability in Adobe Flash Player before 18.0.0.261 and 19.x before 19.0.0.245 on Windows and OS X and before 11.2.202.548 on Linux,… | Patch early | 10.0 high | 30% | 2015-11-11 |
| CVE-2015-0064 EXP | Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word Automation Services in SharePoint Server 2010, Web Applications 2010 SP2, Word Viewer, a… | Patch early | 9.3 high | 30% | 2015-02-11 |
| CVE-2015-1158 EXP | The add_job function in scheduler/ipp.c in cupsd in CUPS before 2.0.3 performs incorrect free operations for multiple-value job-originating-host-name… | Patch early | 10.0 high | 29.9% | 2015-06-26 |
| CVE-2017-2933 EXP | Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable heap overflow vulnerability related to texture compression. Successful exploita… | Patch early | 8.8 high | 29.9% | 2017-01-11 |
| CVE-2017-2934 EXP | Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable heap overflow vulnerability when parsing Adobe Texture Format files. Successful… | Patch early | 8.8 high | 29.9% | 2017-01-11 |
| CVE-2017-2935 EXP | Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable heap overflow vulnerability when processing the Flash Video container file form… | Patch early | 8.8 high | 29.9% | 2017-01-11 |
| CVE-2015-2431 EXP | Microsoft Office 2007 SP3 and 2010 SP2, Live Meeting 2007 Console, Lync 2010, Lync 2010 Attendee, Lync 2013 SP1, and Lync Basic 2013 SP1 allow remote… | Patch early | 9.3 high | 29.8% | 2015-08-15 |
| CVE-2009-1558 EXP | Directory traversal vulnerability in adm/file.cgi on the Cisco Linksys WVC54GCA wireless video camera with firmware 1.00R22 and 1.00R24 allows remote… | Patch early | 7.8 high | 29.8% | 2009-05-06 |
| CVE-2017-0561 EXP | A remote code execution vulnerability in the Broadcom Wi-Fi firmware could enable a remote attacker to execute arbitrary code within the context of th… | Patch early | 9.8 critical | 29.8% | 2017-04-07 |
| CVE-2018-12980 EXP | An issue was discovered on WAGO e!DISPLAY 762-3000 through 762-3003 devices with firmware before FW 02. The vulnerability allows an authenticated user… | Patch early | 8.8 high | 29.8% | 2018-07-12 |
| CVE-2012-0830 EXP | The php_register_variable_ex function in php_variables.c in PHP 5.3.9 allows remote attackers to execute arbitrary code via a request containing a lar… | Patch early | 7.5 high | 29.8% | 2012-02-06 |
| CVE-2018-12636 EXP | The iThemes Security (better-wp-security) plugin before 7.0.3 for WordPress allows SQL Injection (by attackers with Admin privileges) via the logs pag… | Patch early | 7.2 high | 29.8% | 2018-06-22 |
| CVE-2008-0551 EXP | The NamoInstaller.NamoInstall.1 ActiveX control in NamoInstaller.dll 3.0.0.1 and earlier in Namo Web Editor in Sejoong Namo ActiveSquare 6 allows remo… | Patch early | 9.3 high | 29.7% | 2008-02-01 |
| CVE-2026-3891 EXP | The Pix for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing capability check and missing file type validation… | Patch early | 9.8 critical | 29.7% | 2026-03-13 |
| CVE-2007-6401 EXP | Stack-based buffer overflow in mplayer2.exe in Microsoft Windows Media Player (WMP) 6.4, when used with the 3ivx 4.5.1 or 5.0.1 codec, allows remote a… | Patch early | 9.3 high | 29.7% | 2007-12-17 |
| CVE-2019-9810 EXP | Incorrect alias information in IonMonkey JIT compiler for Array.prototype.slice method may lead to missing bounds check and a buffer overflow. This vu… | Patch early | 8.8 high | 29.7% | 2019-04-26 |
| CVE-2016-0016 EXP | Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Go… | Patch early | 7.8 high | 29.7% | 2016-01-13 |
| CVE-2002-0082 EXP | The dbm and shm session cache code in mod_ssl before 2.8.7-1.3.23, and Apache-SSL before 1.3.22+1.46, does not properly initialize memory using the i2… | Patch early | 7.5 high | 29.7% | 2002-03-15 |
| CVE-2007-1682 EXP | Multiple stack-based buffer overflows in the FileManager ActiveX control in SAFmgPws.dll in SoftArtisans XFile before 2.4.0 allow remote attackers to… | Patch early | 9.3 high | 29.6% | 2008-08-27 |
| CVE-2013-2574 EXP | An Access vulnerability exists in FOSCAM IP Camera FI8620 due to insufficient access restrictions in the /tmpfs/ and /log/ directories, which could le… | Patch early | 7.5 high | 29.6% | 2020-01-29 |
| CVE-2017-5173 EXP | An Improper Neutralization of Special Elements (in an OS command) issue was discovered in Geutebruck IP Camera G-Cam/EFD-2250 Version 1.11.0.12. An im… | Patch early | 9.8 critical | 29.6% | 2017-05-19 |
| CVE-2010-2620 EXP | Open&Compact FTP Server (Open-FTPD) 1.2 and earlier allows remote attackers to bypass authentication by sending (1) LIST, (2) RETR, (3) STOR, or other… | Patch early | 9.3 high | 29.6% | 2010-07-02 |
| CVE-2006-6917 EXP | Multiple buffer overflows in Computer Associates (CA) BrightStor ARCserve Backup R11.5 Server before SP2 allows remote attackers to execute arbitrary… | Patch early | 10.0 high | 29.5% | 2006-12-31 |
| CVE-2012-6664 EXP | Multiple directory traversal vulnerabilities in the TFTP Server in Distinct Intranet Servers 3.10 and earlier allow remote attackers to read or write… | Patch early | 9.1 critical | 29.5% | 2024-06-21 |
| CVE-2024-55661 EXP | Laravel Pulse is a real-time application performance monitoring tool and dashboard for Laravel applications. A vulnerability has been discovered in La… | Patch early | 8.8 high | 29.5% | 2024-12-13 |
| CVE-2015-7647 EXP | Adobe Flash Player before 18.0.0.255 and 19.x before 19.0.0.226 on Windows and OS X and before 11.2.202.540 on Linux allows attackers to execute arbit… | Patch early | 10.0 high | 29.5% | 2015-10-18 |
| CVE-2015-7648 EXP | Adobe Flash Player before 18.0.0.255 and 19.x before 19.0.0.226 on Windows and OS X and before 11.2.202.540 on Linux allows attackers to execute arbit… | Patch early | 10.0 high | 29.5% | 2015-10-18 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt