CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
401,074 CVEs
1,733 on KEV
17,290 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-04
186,447 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2023-37629 EXP | Online Piggery Management System 1.0 is vulnerable to File Upload. An unauthenticated user can upload a php file by sending a POST request to "add-pig… | Patch early | 9.8 critical | 23.3% | 2023-07-12 |
| CVE-2016-9682 EXP | The SonicWall Secure Remote Access server (version 8.1.0.2-14sv) is vulnerable to two Remote Command Injection vulnerabilities in its web administrati… | Patch early | 9.8 critical | 23.3% | 2017-02-22 |
| CVE-2005-3120 EXP | Stack-based buffer overflow in the HTrjis function in Lynx 2.8.6 and earlier allows remote NNTP servers to execute arbitrary code via certain article… | Patch early | 9.8 critical | 23.3% | 2005-10-17 |
| CVE-2008-2281 EXP | Cross-zone scripting vulnerability in the Print Table of Links feature in Internet Explorer 6.0, 7.0, and 8.0b allows user-assisted remote attackers t… | Patch early | 9.3 high | 23.2% | 2008-05-18 |
| CVE-2013-1360 EXP | An Authentication Bypass vulnerability exists in DELL SonicWALL Global Management System (GMS) 4.1, 5.0, 5.1, 6.0, and 7.0, Analyzer 7.0, Universal Ma… | Patch early | 9.8 critical | 23.2% | 2020-02-11 |
| CVE-2009-1960 EXP | inc/init.php in DokuWiki 2009-02-14, rc2009-02-06, and rc2009-01-30, when register_globals is enabled, allows remote attackers to include and execute… | Patch early | 9.3 high | 23.2% | 2009-06-08 |
| CVE-2007-0021 EXP | Format string vulnerability in Apple iChat 3.1.6 allows remote attackers to cause a denial of service (null pointer dereference and application crash)… | Patch early | 7.5 high | 23.1% | 2007-01-23 |
| CVE-2019-11354 EXP | The client in Electronic Arts (EA) Origin 10.5.36 on Windows allows template injection in the title parameter of the Origin2 URI handler. This can be… | Patch early | 7.8 high | 23.1% | 2019-04-19 |
| CVE-2011-1938 EXP | Stack-based buffer overflow in the socket_connect function in ext/sockets/sockets.c in PHP 5.3.3 through 5.3.6 might allow context-dependent attackers… | Patch early | 7.5 high | 23.1% | 2011-05-31 |
| CVE-2019-7265 EXP | Linear eMerge E3-Series devices allow Remote Code Execution (root access over SSH). | Patch early | 9.8 critical | 23.1% | 2019-07-02 |
| CVE-2002-2029 EXP | PHP, when installed on Windows with Apache and ScriptAlias for /php/ set to c:/php/, allows remote attackers to read arbitrary files and possibly exec… | Patch early | 7.5 high | 23.1% | 2002-12-31 |
| CVE-2021-44567 EXP | An unauthenticated SQL Injection vulnerability exists in RosarioSIS before 7.6.1 via the votes parameter in ProgramFunctions/PortalPollsNotes.fnc.php. | Patch early | 9.8 critical | 23.1% | 2022-02-24 |
| CVE-2002-0033 EXP | Heap-based buffer overflow in cfsd_calloc function of Solaris cachefsd allows remote attackers to execute arbitrary code via a request with a long dir… | Patch early | 10.0 high | 23.1% | 2002-05-29 |
| CVE-2017-15367 EXP | Bacula-web before 8.0.0-rc2 is affected by multiple SQL Injection vulnerabilities that could allow an attacker to access the Bacula database and, depe… | Patch early | 9.8 critical | 23.1% | 2018-03-07 |
| CVE-2014-4971 EXP | Microsoft Windows XP SP3 does not validate addresses in certain IRP handler routines, which allows local users to write data to arbitrary memory locat… | Patch early | 7.2 high | 23% | 2014-07-26 |
| CVE-2025-26264 EXP | GeoVision GV-ASWeb with the version 6.1.2.0 or less (fixed in 6.2.0), contains a Remote Code Execution (RCE) vulnerability within its Notification Set… | Patch early | 8.8 high | 23% | 2025-02-27 |
| CVE-2014-2777 EXP | Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary web script with increased privileges via unspecified vectors, ak… | Patch early | 7.5 high | 23% | 2014-06-11 |
| CVE-2013-2470 EXP | Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0… | Patch early | 10.0 high | 23% | 2013-06-18 |
| CVE-2013-2472 EXP | Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0… | Patch early | 10.0 high | 23% | 2013-06-18 |
| CVE-2007-5863 EXP | Software Update in Apple Mac OS X 10.5.1 allows remote attackers to execute arbitrary commands via a man-in-the-middle (MITM) attack between the clien… | Patch early | 9.3 high | 23% | 2007-12-19 |
| CVE-2023-48292 EXP | The XWiki Admin Tools Application provides tools to help the administration of XWiki. Starting in version 4.4 and prior to version 4.5.1, a cross site… | Patch early | 9.6 critical | 22.9% | 2023-11-20 |
| CVE-2021-44596 EXP | Wondershare LTD Dr. Fone as of 2021-12-06 version is affected by Remote code execution. Due to software design flaws an unauthenticated user can commu… | Patch early | 9.8 critical | 22.9% | 2022-04-29 |
| CVE-2007-5133 EXP | Microsoft Windows Explorer (explorer.exe) allows user-assisted remote attackers to cause a denial of service (CPU consumption) via a certain PNG file… | Patch early | 7.1 high | 22.9% | 2007-09-27 |
| CVE-2019-8195 EXP | Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and earlier, an… | Patch early | 9.8 critical | 22.9% | 2019-10-17 |
| CVE-2019-8196 EXP | Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and earlier, an… | Patch early | 9.8 critical | 22.9% | 2019-10-17 |
| CVE-2010-3131 EXP | Untrusted search path vulnerability in Mozilla Firefox before 3.5.12 and 3.6.x before 3.6.9, Thunderbird before 3.0.7 and 3.1.x before 3.1.3, and SeaM… | Patch early | 9.3 high | 22.9% | 2010-08-26 |
| CVE-2017-0781 EXP | A remote code execution vulnerability in the Android system (bluetooth). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.… | Patch early | 8.8 high | 22.9% | 2017-09-14 |
| CVE-2014-2757 EXP | Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf… | Patch early | 9.3 high | 22.8% | 2014-06-11 |
| CVE-2014-1775 EXP | Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf… | Patch early | 9.3 high | 22.8% | 2014-06-11 |
| CVE-2014-1803 EXP | Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf… | Patch early | 9.3 high | 22.8% | 2014-06-11 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt