CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
401,058 CVEs
1,733 on KEV
17,286 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-03
401,058 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2007-2216 EXP | The tblinf32.dll (aka vstlbinf.dll) ActiveX control for Internet Explorer 5.01, 6 SP1, and 7 uses an incorrect IObjectsafety implementation, which all… | Patch early | 9.3 high | 41.4% | 2007-08-14 |
| CVE-2020-10882 EXP | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1… | Patch early | 8.8 high | 41.4% | 2020-03-25 |
| CVE-2002-0866 EXP | Java Database Connectivity (JDBC) classes in Microsoft Virtual Machine (VM) up to and including 5.0.3805 allow remote attackers to load and execute DL… | Patch early | 7.5 high | 41.4% | 2002-10-11 |
| CVE-2011-0966 EXP | Directory traversal vulnerability in cwhp/auditLog.do in the Homepage Auditing component in Cisco CiscoWorks Common Services 3.3 and earlier allows re… | Patch early | 6.8 medium | 41.3% | 2011-05-20 |
| CVE-2016-3386 EXP | The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via… | Patch early | 7.5 high | 41.3% | 2016-10-14 |
| CVE-2004-0430 EXP | Stack-based buffer overflow in AppleFileServer for Mac OS X 10.3.3 and earlier allows remote attackers to execute arbitrary code via a LoginExt packet… | Patch early | 5.1 medium | 41.3% | 2004-07-07 |
| CVE-2006-6561 EXP | Unspecified vulnerability in Microsoft Word 2000, 2002, and Word Viewer 2003 allows user-assisted remote attackers to execute arbitrary code via a cra… | Patch early | 9.3 high | 41.3% | 2006-12-14 |
| CVE-2010-0231 EXP | The SMB implementation in the Server service in Microsoft Windows 2000 SP4, Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista Gold, SP1,… | Patch early | 10.0 high | 41.3% | 2010-02-10 |
| CVE-2005-3757 EXP | The Saxon XSLT parser in Google Mini Search Appliance, and possibly Google Search Appliance, allows remote attackers to obtain sensitive information a… | Patch early | 7.5 high | 41.3% | 2005-11-22 |
| CVE-2008-0955 EXP | Stack-based buffer overflow in the Creative Software AutoUpdate Engine ActiveX control in CTSUEng.ocx allows remote attackers to execute arbitrary cod… | Patch early | 9.3 high | 41.2% | 2008-05-29 |
| CVE-2007-2365 EXP | Buffer overflow in Adobe Photoshop CS2 and CS3, Photoshop Elements 5.0, Illustrator CS3, and GoLive 9 allows user-assisted remote attackers to execute… | Patch early | 9.3 high | 41.2% | 2007-04-30 |
| CVE-2020-14425 EXP | Foxit Reader before 10.0 allows Remote Command Execution via the app.opencPDFWebPage JavsScript API. An attacker can execute local files and bypass th… | Patch early | 7.8 high | 41.1% | 2020-11-02 |
| CVE-2016-0122 EXP | Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Word 2016 for Mac, Office Compatibility Pack SP3, and Excel V… | Patch early | 7.8 high | 41.1% | 2016-04-12 |
| CVE-2006-3059 EXP | Unspecified vulnerability in Microsoft Excel 2000 through 2004 allows remote user-assisted attackers to execute arbitrary code via unspecified vectors… | Patch early | 9.3 high | 41.1% | 2006-06-17 |
| CVE-2022-29548 EXP | A reflected XSS issue exists in the Management Console of several WSO2 products. This affects API Manager 2.2.0, 2.5.0, 2.6.0, 3.0.0, 3.1.0, 3.2.0, an… | Patch early | 4.6 medium | 41.1% | 2022-04-21 |
| CVE-2015-2065 EXP | SQL injection vulnerability in videogalleryrss.php in the Apptha WordPress Video Gallery (contus-video-gallery) plugin before 2.8 for WordPress allows… | Patch early | 7.5 high | 41.1% | 2015-02-24 |
| CVE-2015-3083 EXP | Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on Linux, Adobe AIR before 17… | Patch early | 6.4 medium | 41.1% | 2015-05-13 |
| CVE-2022-23513 EXP | Pi-Hole is a network-wide ad blocking via your own Linux hardware, AdminLTE is a Pi-hole Dashboard for stats and more. In case of an attack, the threa… | Patch early | 5.3 medium | 41.1% | 2022-12-23 |
| CVE-2007-5654 EXP | LiteSpeed Web Server before 3.2.4 allows remote attackers to trigger use of an arbitrary MIME type for a file via a "%00." sequence followed by a new… | Patch early | 5.0 medium | 41.1% | 2007-10-23 |
| CVE-2005-0416 EXP | The Windows Animated Cursor (ANI) capability in Windows NT, Windows 2000 through SP4, Windows XP through SP1, and Windows 2003 allows remote attackers… | Patch early | 7.5 high | 41% | 2005-04-27 |
| CVE-2019-12593 EXP | IceWarp Mail Server through 10.4.4 is prone to a local file inclusion vulnerability via webmail/calendar/minimizer/index.php?style=..%5c directory tra… | Patch early | 7.5 high | 41% | 2019-06-03 |
| CVE-2015-0097 EXP | Microsoft Excel 2007 SP3, PowerPoint 2007 SP3, Word 2007 SP3, Excel 2010 SP2, PowerPoint 2010 SP2, and Word 2010 SP2 allow remote attackers to execute… | Patch early | 9.3 high | 40.9% | 2015-03-11 |
| CVE-2003-0434 EXP | Various PDF viewers including (1) Adobe Acrobat 5.06 and (2) Xpdf 1.01 allow remote attackers to execute arbitrary commands via shell metacharacters i… | Patch early | 7.5 high | 40.9% | 2003-07-24 |
| CVE-2018-14493 EXP | Cross-site scripting (XSS) vulnerability in the Groups Page in Open-Audit Community 2.2.6 allows remote attackers to inject arbitrary web script or HT… | Patch early | 6.1 medium | 40.9% | 2018-07-25 |
| CVE-2007-1286 EXP | Integer overflow in PHP 4.4.4 and earlier allows remote context-dependent attackers to execute arbitrary code via a long string to the unserialize fun… | Patch early | 6.8 medium | 40.9% | 2007-03-06 |
| CVE-2015-5621 EXP | The snmp_pdu_parse function in snmp_api.c in net-snmp 5.7.2 and earlier does not remove the varBind variable in a netsnmp_variable_list item when pars… | Patch early | 7.5 high | 40.9% | 2015-08-19 |
| CVE-2024-0132 EXP | NVIDIA Container Toolkit 1.16.1 or earlier contains a Time-of-check Time-of-Use (TOCTOU) vulnerability when used with default configuration where a sp… | Patch early | 9.0 critical | 40.8% | 2024-09-26 |
| CVE-2014-8676 EXP | Directory traversal vulnerability in the file_get_contents function in SOPlanning 1.32 and earlier allows remote attackers to determine the existence… | Patch early | 5.3 medium | 40.8% | 2017-08-31 |
| CVE-2017-7442 EXP | Nitro Pro 11.0.3.173 allows remote attackers to execute arbitrary code via saveAs and launchURL calls with directory traversal sequences. | Patch early | 8.8 high | 40.7% | 2017-08-03 |
| CVE-2015-8044 EXP | Use-after-free vulnerability in Adobe Flash Player before 18.0.0.261 and 19.x before 19.0.0.245 on Windows and OS X and before 11.2.202.548 on Linux,… | Patch early | 10.0 high | 40.7% | 2015-11-11 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt