CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
401,092 CVEs
1,733 on KEV
17,290 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-04
186,455 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2017-5972 EXP | The TCP stack in the Linux kernel 3.x does not properly implement a SYN cookie protection mechanism for the case of a fast network connection, which a… | Patch early | 7.5 high | 23.9% | 2017-02-14 |
| CVE-2007-2293 EXP | Multiple stack-based buffer overflows in the process_sdp function in chan_sip.c of the SIP channel T.38 SDP parser in Asterisk before 1.4.3 allow remo… | Patch early | 7.6 high | 23.9% | 2007-04-26 |
| CVE-2004-0552 EXP | Sophos Small Business Suite 1.00 on Windows does not properly handle files whose names contain reserved MS-DOS device names such as (1) LPT1, (2) COM1… | Patch early | 7.5 high | 23.9% | 2004-11-03 |
| CVE-2003-0015 EXP | Double-free vulnerability in CVS 1.11.4 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via a mal… | Patch early | 7.5 high | 23.9% | 2003-02-07 |
| CVE-2012-1661 EXP | ESRI ArcMap 9 and ArcGIS 10.0.2.3200 and earlier does not properly prompt users before executing embedded VBA macros, which allows user-assisted remot… | Patch early | 9.3 high | 23.8% | 2012-07-12 |
| CVE-2010-2745 EXP | Microsoft Windows Media Player (WMP) 9 through 12 does not properly deallocate objects during a browser reload action, which allows user-assisted remo… | Patch early | 9.3 high | 23.8% | 2010-10-13 |
| CVE-2015-0081 EXP | Windows Text Services (WTS) in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Win… | Patch early | 9.3 high | 23.8% | 2015-03-11 |
| CVE-2012-5469 EXP | The Portable phpMyAdmin plugin before 1.3.1 for WordPress allows remote attackers to bypass authentication and obtain phpMyAdmin console access via a… | Patch early | 7.5 high | 23.7% | 2012-12-20 |
| CVE-2019-9624 EXP | Webmin 1.900 allows remote attackers to execute arbitrary code by leveraging the "Java file manager" and "Upload and Download" privileges to upload a… | Patch early | 7.8 high | 23.7% | 2019-03-07 |
| CVE-2017-17058 EXP | The WooCommerce plugin through 3.x for WordPress has a Directory Traversal Vulnerability via a /wp-content/plugins/woocommerce/templates/emails/plain/… | Patch early | 7.5 high | 23.7% | 2017-11-29 |
| CVE-2020-24219 EXP | An issue was discovered on URayTech IPTV/H.264/H.265 video encoders through 1.97. Attackers can send crafted unauthenticated HTTP requests to exploit… | Patch early | 7.5 high | 23.6% | 2020-10-06 |
| CVE-2014-8147 EXP | The resolveImplicitLevels function in common/ubidi.c in the Unicode Bidirectional Algorithm implementation in ICU4C in International Components for Un… | Patch early | 7.5 high | 23.6% | 2015-05-25 |
| CVE-2013-3146 EXP | Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web si… | Patch early | 9.3 high | 23.6% | 2013-07-10 |
| CVE-2013-3152 EXP | Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web si… | Patch early | 9.3 high | 23.6% | 2013-07-10 |
| CVE-2013-3164 EXP | Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web sit… | Patch early | 9.3 high | 23.6% | 2013-07-10 |
| CVE-2024-27747 EXP | File Upload vulnerability in Petrol Pump Mangement Software v.1.0 allows an attacker to execute arbitrary code via a crafted payload to the email Imag… | Patch early | 9.8 critical | 23.6% | 2024-03-01 |
| CVE-2019-1117 EXP | A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite Remote Code Execution Vulnerabili… | Patch early | 8.8 high | 23.6% | 2019-07-15 |
| CVE-2019-1118 EXP | A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite Remote Code Execution Vulnerabili… | Patch early | 8.8 high | 23.6% | 2019-07-15 |
| CVE-2018-6396 EXP | SQL Injection exists in the Google Map Landkarten through 4.2.3 component for Joomla! via the cid or id parameter in a layout=form_markers action, or… | Patch early | 9.8 critical | 23.6% | 2018-02-17 |
| CVE-2018-5997 EXP | An issue was discovered in the HTTP Server in RAVPower Filehub 2.000.056. Due to an unrestricted upload feature and a path traversal vulnerability, it… | Patch early | 9.8 critical | 23.5% | 2018-01-25 |
| CVE-2002-1375 EXP | The COM_CHANGE_USER command in MySQL 3.x before 3.23.54, and 4.x to 4.0.6, allows remote attackers to execute arbitrary code via a long response. | Patch early | 7.5 high | 23.5% | 2002-12-23 |
| CVE-2010-3139 EXP | Untrusted search path vulnerability in Microsoft Windows Progman Group Converter (grpconv.exe) allows local users, and possibly remote attackers, to e… | Patch early | 9.3 high | 23.5% | 2010-08-27 |
| CVE-2022-31101 EXP | prestashop/blockwishlist is a prestashop extension which adds a block containing the customer's wishlists. In affected versions an authenticated custo… | Patch early | 8.1 high | 23.5% | 2022-06-27 |
| CVE-2024-56902 EXP | Information disclosure vulnerability in Geovision GV-ASManager web application with the version v6.1.0.0 or less, which discloses account information,… | Patch early | 7.5 high | 23.4% | 2025-02-03 |
| CVE-2013-1606 EXP | Buffer overflow in the ubnt-streamer RTSP service on the Ubiquiti UBNT AirCam with airVision firmware before 1.1.6 allows remote attackers to execute… | Patch early | 7.5 high | 23.4% | 2013-07-18 |
| CVE-2015-7622 EXP | Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acr… | Patch early | 10.0 high | 23.4% | 2015-10-14 |
| CVE-2008-3529 EXP | Heap-based buffer overflow in the xmlParseAttValueComplex function in parser.c in libxml2 before 2.7.0 allows context-dependent attackers to cause a d… | Patch early | 10.0 high | 23.4% | 2008-09-12 |
| CVE-2002-0647 EXP | Buffer overflow in a legacy ActiveX control used to display specially formatted text in Microsoft Internet Explorer 5.01, 5.5, and 6.0 allows remote a… | Patch early | 7.5 high | 23.3% | 2002-09-24 |
| CVE-2004-2289 EXP | Microsoft Windows XP Explorer allows local users to execute arbitrary code via a system folder with a Desktop.ini file containing a .ShellClassInfo sp… | Patch early | 10.0 high | 23.3% | 2004-12-31 |
| CVE-2012-2052 EXP | Stack-based buffer overflow in the U3D.8BI library plugin in Adobe Photoshop CS5 12.x before 12.0.5 and CS5.1 12.1.x before 12.1.1 allows remote attac… | Patch early | 9.3 high | 23.3% | 2014-06-19 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt