CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
398,503 CVEs
1,726 on KEV
17,265 EPSS ≥ 10%
25,086 with exploits
synced 2026-09-27
169,001 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2001-1013 EXP | Apache on Red Hat Linux with with the UserDir directive enabled generates different error codes when a username exists and there is no public_html dir… | Patch early | 5.0 medium | 65.6% | 2001-09-12 |
| CVE-2018-0767 EXP | Microsoft Edge in Microsoft Windows 10 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to obtain information to further compromise… | Patch early | 5.3 medium | 65.5% | 2018-01-04 |
| CVE-2002-1744 EXP | Directory traversal vulnerability in CodeBrws.asp in Microsoft IIS 5.0 allows remote attackers to view source code and determine the existence of arbi… | Patch early | 5.0 medium | 65.2% | 2002-12-31 |
| CVE-2025-27218 EXP | Sitecore Experience Manager (XM) and Experience Platform (XP) 10.4 before KB1002844 allow remote code execution through insecure deserialization. | Patch early | 5.3 medium | 65% | 2025-02-20 |
| CVE-2015-6973 EXP | Multiple cross-site request forgery (CSRF) vulnerabilities in Ignite Realtime Openfire 3.10.2 allow remote attackers to hijack the authentication of a… | Patch early | 6.8 medium | 64.8% | 2015-09-16 |
| CVE-1999-0278 EXP | In IIS, remote attackers can obtain source code for ASP files by appending "::$DATA" to the URL. | Patch early | 5.0 medium | 64.8% | 1998-06-01 |
| CVE-2008-0455 EXP | Cross-site scripting (XSS) vulnerability in the mod_negotiation module in the Apache HTTP Server 2.2.6 and earlier in the 2.2.x series, 2.0.61 and ear… | Patch early | 4.3 medium | 64.8% | 2008-01-25 |
| CVE-2010-4094 EXP | The Tomcat server in IBM Rational Quality Manager and Rational Test Lab Manager has a default password for the ADMIN account, which makes it easier fo… | Patch early | 5.0 medium | 64.5% | 2010-10-26 |
| CVE-2007-3524 EXP | Multiple PHP remote file inclusion vulnerabilities in Ripe Website Manager 0.8.9 and earlier allow remote attackers to execute arbitrary PHP code via… | Patch early | 6.8 medium | 64.2% | 2007-07-03 |
| CVE-2007-2939 EXP | Multiple PHP remote file inclusion vulnerabilities in Mazen's PHP Chat 3.0.0 allow remote attackers to execute arbitrary PHP code via a URL in the bas… | Patch early | 6.8 medium | 64% | 2007-05-31 |
| CVE-2012-5067 EXP | Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allows remote attackers to affect c… | Patch early | 5.0 medium | 64% | 2012-10-16 |
| CVE-2014-5350 EXP | Multiple directory traversal vulnerabilities in Bitdefender GravityZone before 5.1.11.432 allow remote attackers to read arbitrary files via a (1) ..… | Patch early | 5.0 medium | 63.9% | 2014-08-19 |
| CVE-2006-3726 EXP | Buffer overflow in FileCOPA FTP Server before 1.01 released on 18th July 2006, allows remote authenticated attackers to execute arbitrary code via a l… | Patch early | 6.5 medium | 63.7% | 2006-07-21 |
| CVE-2005-1939 EXP | Directory traversal vulnerability in Ipswitch WhatsUp Small Business 2004 allows remote attackers to read arbitrary files via ".." (dot dot) sequences… | Patch early | 5.0 medium | 63.6% | 2005-12-31 |
| CVE-2003-0245 EXP | Vulnerability in the apr_psprintf function in the Apache Portable Runtime (APR) library for Apache 2.0.37 through 2.0.45 allows remote attackers to ca… | Patch early | 5.0 medium | 63.5% | 2003-06-09 |
| CVE-2018-9948 EXP | This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.0.0.29935. User interaction… | Patch early | 6.5 medium | 63.1% | 2018-05-17 |
| CVE-2007-3220 EXP | PHP remote file inclusion vulnerability in admin/editor2/spaw_control.class.php in the Cjay Content 3 module for XOOPS allows remote attackers to exec… | Patch early | 6.8 medium | 62.7% | 2007-06-14 |
| CVE-2023-34096 EXP | Thruk is a multibackend monitoring webinterface which currently supports Naemon, Icinga, Shinken and Nagios as backends. In versions 3.06 and prior, t… | Patch early | 6.5 medium | 62.7% | 2023-06-08 |
| CVE-2007-5333 EXP | Apache Tomcat 6.0.0 through 6.0.14, 5.5.0 through 5.5.25, and 4.1.0 through 4.1.36 does not properly handle (1) double quote (") characters or (2) %5C… | Patch early | 5.0 medium | 62.6% | 2008-02-12 |
| CVE-2019-13396 EXP | FlightPath 4.x and 5.0-x allows directory traversal and Local File Inclusion through the form_include parameter in an index.php?q=system-handle-form-s… | Patch early | 5.3 medium | 62.6% | 2019-07-10 |
| CVE-2000-0760 EXP | The Snoop servlet in Jakarta Tomcat 3.1 and 3.0 under Apache reveals sensitive system information when a remote attacker requests a nonexistent URL wi… | Patch early | 6.4 medium | 62.5% | 2000-10-20 |
| CVE-2015-1793 EXP | The X509_verify_cert function in crypto/x509/x509_vfy.c in OpenSSL 1.0.1n, 1.0.1o, 1.0.2b, and 1.0.2c does not properly process X.509 Basic Constraint… | Patch early | 6.5 medium | 62.4% | 2015-07-09 |
| CVE-2012-2329 EXP | Buffer overflow in the apache_request_headers function in sapi/cgi/cgi_main.c in PHP 5.4.x before 5.4.3 allows remote attackers to cause a denial of s… | Patch early | 5.0 medium | 62.3% | 2012-05-11 |
| CVE-2006-4446 EXP | Heap-based buffer overflow in DirectAnimation.PathControl COM object (daxctle.ocx) in Microsoft Internet Explorer 6.0 SP1 allows remote attackers to c… | Patch early | 5.0 medium | 62.2% | 2006-08-30 |
| CVE-2012-2982 EXP | file/show.cgi in Webmin 1.590 and earlier allows remote authenticated users to execute arbitrary commands via an invalid character in a pathname, as d… | Patch early | 6.5 medium | 62.2% | 2012-09-11 |
| CVE-2006-4318 EXP | Buffer overflow in WFTPD Server 3.23 allows remote attackers to execute arbitrary code via long SIZE commands. | Patch early | 6.5 medium | 62.1% | 2006-08-24 |
| CVE-2005-2120 EXP | Stack-based buffer overflow in the Plug and Play (PnP) service (UMPNPMGR.DLL) in Microsoft Windows 2000 SP4, and XP SP1 and SP2, allows remote or loca… | Patch early | 6.5 medium | 62% | 2005-10-13 |
| CVE-2005-0277 EXP | Buffer overflow in the FTP service in 3Com 3CDaemon 2.0 revision 10 allows remote attackers to cause a denial of service (application crash) and execu… | Patch early | 5.0 medium | 61.9% | 2005-05-02 |
| CVE-2007-1061 EXP | SQL injection vulnerability in index.php in Francisco Burzi PHP-Nuke 8.0 Final and earlier, when the "HTTP Referers" block is enabled, allows remote a… | Patch early | 6.8 medium | 61.8% | 2007-02-22 |
| CVE-2007-3632 EXP | Multiple PHP remote file inclusion vulnerabilities in LimeSurvey (aka PHPSurveyor) 1.49RC2 allow remote attackers to execute arbitrary PHP code via a… | Patch early | 6.8 medium | 61.5% | 2007-07-10 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt