CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
401,071 CVEs
1,733 on KEV
17,290 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-04
186,447 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2014-1797 EXP | Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted… | Patch early | 9.3 high | 24.5% | 2014-06-11 |
| CVE-2014-1800 EXP | Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf… | Patch early | 9.3 high | 24.5% | 2014-06-11 |
| CVE-2007-2795 EXP | Multiple buffer overflows in Ipswitch IMail before 2006.21 allow remote attackers or authenticated users to execute arbitrary code via (1) the authent… | Patch early | 9.0 high | 24.5% | 2009-01-27 |
| CVE-2019-13360 EXP | In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.836, remote attackers can bypass authentication in the login process by leveraging knowledge o… | Patch early | 9.8 critical | 24.5% | 2019-07-16 |
| CVE-2001-0419 EXP | Buffer overflow in shared library ndwfn4.so for iPlanet Web Server (iWS) 4.1, when used as a web listener for Oracle application server 4.0.8.2, allow… | Patch early | 7.5 high | 24.4% | 2001-07-02 |
| CVE-2018-11652 EXP | CSV Injection vulnerability in Nikto 2.1.6 and earlier allows remote attackers to inject arbitrary OS commands via the Server field in an HTTP respons… | Patch early | 9.8 critical | 24.4% | 2018-06-01 |
| CVE-1999-0702 EXP | Internet Explorer 5.0 and 5.01 allows remote attackers to modify or execute files via the Import/Export Favorites feature, aka the "ImportExportFavori… | Patch early | 10.0 high | 24.4% | 1999-09-10 |
| CVE-2013-1592 EXP | A Buffer Overflow vulnerability exists in the Message Server service _MsJ2EE_AddStatistics() function when sending specially crafted SAP Message Serve… | Patch early | 9.8 critical | 24.4% | 2020-01-23 |
| CVE-2019-13577 EXP | SnmpAdm.exe in MAPLE WBT SNMP Administrator v2.0.195.15 has an Unauthenticated Remote Buffer Overflow via a long string to the CE Remote feature liste… | Patch early | 9.8 critical | 24.4% | 2019-07-17 |
| CVE-2008-3892 EXP | Buffer overflow in a certain ActiveX control in the COM API in VMware Workstation 5.5.x before 5.5.8 build 108000, VMware Workstation 6.0.x before 6.0… | Patch early | 10.0 high | 24.4% | 2008-09-03 |
| CVE-2018-12584 EXP | The ConnectionBase::preparseNewBytes function in resip/stack/ConnectionBase.cxx in reSIProcate through 1.10.2 allows remote attackers to cause a denia… | Patch early | 9.8 critical | 24.3% | 2018-07-16 |
| CVE-2019-13358 EXP | lib/DocumentToText.php in OpenCats before 0.9.4-3 has XXE that allows remote users to read files on the underlying operating system. The attacker must… | Patch early | 7.5 high | 24.3% | 2019-07-05 |
| CVE-2004-0110 EXP | Buffer overflow in the (1) nanohttp or (2) nanoftp modules in XMLSoft Libxml 2 (Libxml2) 2.6.0 through 2.6.5 allow remote attackers to execute arbitra… | Patch early | 7.5 high | 24.2% | 2004-03-15 |
| CVE-2004-0333 EXP | Buffer overflow in the UUDeview package, as used in WinZip 6.2 through WinZip 8.1 SR-1, and possibly other packages, allows remote attackers to execut… | Patch early | 10.0 high | 24.2% | 2004-11-23 |
| CVE-2014-1779 EXP | Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf… | Patch early | 9.3 high | 24.2% | 2014-06-11 |
| CVE-2015-2097 EXP | Multiple buffer overflows in WebGate Embedded Standard Protocol (WESP) SDK allow remote attackers to execute arbitrary code via unspecified vectors to… | Patch early | 7.5 high | 24.1% | 2015-03-09 |
| CVE-2008-3641 EXP | The Hewlett-Packard Graphics Language (HPGL) filter in CUPS before 1.3.9 allows remote attackers to execute arbitrary code via crafted pen width and p… | Patch early | 10.0 high | 24.1% | 2008-10-10 |
| CVE-2010-3714 EXP | The jumpUrl (aka access tracking) implementation in tslib/class.tslib_fe.php in TYPO3 4.2.x before 4.2.15, 4.3.x before 4.3.7, and 4.4.x before 4.4.4… | Patch early | 7.1 high | 24.1% | 2010-10-25 |
| CVE-2011-4542 EXP | Hastymail2 2.1.1 before RC2 allows remote attackers to execute arbitrary commands via the (1) rs or (2) rsargs[] parameter in a mailbox Drafts action… | Patch early | 7.5 high | 24.1% | 2011-11-30 |
| CVE-2011-3625 EXP | Stack-based buffer overflow in the sub_read_line_sami function in subreader.c in MPlayer, as used in SMPlayer 0.6.9, allows remote attackers to cause… | Patch early | 9.3 high | 24.1% | 2014-06-11 |
| CVE-2015-5468 EXP | Directory traversal vulnerability in the WP e-Commerce Shop Styling plugin before 2.6 for WordPress allows remote attackers to read arbitrary files vi… | Patch early | 7.5 high | 24.1% | 2017-05-23 |
| CVE-2024-25830 EXP | F-logic DataCube3 v1.0 is vulnerable to Incorrect Access Control due to an improper directory access restriction. An unauthenticated, remote attacker… | Patch early | 9.8 critical | 24% | 2024-02-29 |
| CVE-2002-1317 EXP | Buffer overflow in Dispatch() routine for XFS font server (fs.auto) on Solaris 2.5.1 through 9 allows remote attackers to cause a denial of service (c… | Patch early | 7.5 high | 24% | 2002-12-11 |
| CVE-2017-8798 EXP | Integer signedness error in MiniUPnP MiniUPnPc v1.4.20101221 through v2.0 allows remote attackers to cause a denial of service or possibly have unspec… | Patch early | 9.8 critical | 24% | 2017-05-11 |
| CVE-2016-2819 EXP | Heap-based buffer overflow in Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2 allows remote attackers to execute arbitrary code via forei… | Patch early | 8.8 high | 24% | 2016-06-13 |
| CVE-2021-46418 EXP | An unauthorized file creation vulnerability in Telesquare TLR-2855KS6 via PUT method can allow creation of CGI scripts. | Patch early | 7.5 high | 23.9% | 2022-04-07 |
| CVE-2014-8322 EXP | Stack-based buffer overflow in the tcp_test function in aireplay-ng.c in Aircrack-ng before 1.2 RC 1 allows remote attackers to execute arbitrary code… | Patch early | 9.8 critical | 23.9% | 2020-01-31 |
| CVE-2024-27356 EXP | An issue was discovered on certain GL-iNet devices. Attackers can download files such as logs via commands, potentially obtaining critical user inform… | Patch early | 7.5 high | 23.9% | 2024-02-27 |
| CVE-2018-12453 EXP | Type confusion in the xgroupCommand function in t_stream.c in redis-server in Redis before 5.0 allows remote attackers to cause denial-of-service via… | Patch early | 7.5 high | 23.9% | 2018-06-16 |
| CVE-2022-24630 EXP | An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. BrowseFiles.php allows a ?cmd=ssh POST request with an ssh_comma… | Patch early | 7.2 high | 23.9% | 2023-05-29 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt