CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
401,075 CVEs
1,733 on KEV
17,290 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-04
319,690 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2005-2871 EXP | Buffer overflow in the International Domain Name (IDN) support in Mozilla Firefox 1.0.6 and earlier, and Netscape 8.0.3.3 and 7.2, allows remote attac… | Patch early | 7.5 high | 21.1% | 2005-09-09 |
| CVE-2002-0201 EXP | Cyberstop Web Server for Windows 0.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long HTTP… | Patch early | 5.0 medium | 21.1% | 2002-05-16 |
| CVE-2003-1083 EXP | Stack-based buffer overflow in Monit 1.4 to 4.1 allows remote attackers to execute arbitrary code via a long HTTP request. | Patch early | 10.0 high | 21.1% | 2003-12-31 |
| CVE-2011-4362 EXP | Integer signedness error in the base64_decode function in the HTTP authentication functionality (http_auth.c) in lighttpd 1.4 before 1.4.30 and 1.5 be… | Patch early | 5.0 medium | 21.1% | 2011-12-24 |
| CVE-2020-3956 EXP | VMware Cloud Director 10.0.x before 10.0.0.2, 9.7.0.x before 9.7.0.5, 9.5.0.x before 9.5.0.6, and 9.1.0.x before 9.1.0.4 do not properly handle input… | Patch early | 8.8 high | 21.1% | 2020-05-20 |
| CVE-1999-0153 EXP | Windows 95/NT out of band (OOB) data denial of service through NETBIOS port, aka WinNuke. | Patch early | 5.0 medium | 21.1% | 1997-07-01 |
| CVE-2016-3223 EXP | Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Wind… | Patch early | 8.1 high | 21.1% | 2016-06-16 |
| CVE-2006-6379 EXP | Buffer overflow in the BrightStor Backup Discovery Service in multiple CA products, including ARCserve Backup r11.5 SP1 and earlier, ARCserve Backup 9… | Patch early | 7.5 high | 21.1% | 2006-12-10 |
| CVE-2025-58180 EXP | OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.11.2 contain a vulnerability that… | Patch early | 8.8 high | 21.1% | 2025-09-09 |
| CVE-2008-4864 EXP | Multiple integer overflows in imageop.c in the imageop module in Python 1.5.2 through 2.5.1 allow context-dependent attackers to break out of the Pyth… | Patch early | 7.5 high | 21% | 2008-11-01 |
| CVE-2010-3274 EXP | Multiple cross-site scripting (XSS) vulnerabilities in EmployeeSearch.cc in the Employee Search Engine in ZOHO ManageEngine ADSelfService Plus before… | Patch early | 4.3 medium | 21% | 2011-02-17 |
| CVE-2010-2265 EXP | Cross-site scripting (XSS) vulnerability in the GetServerName function in sysinfo/commonFunc.js in Microsoft Windows Help and Support Center for Windo… | Patch early | 4.3 medium | 21% | 2010-06-15 |
| CVE-2011-4804 EXP | Directory traversal vulnerability in the obSuggest (com_obsuggest) component before 1.8 for Joomla! allows remote attackers to read arbitrary files vi… | Patch early | 5.0 medium | 21% | 2011-12-14 |
| CVE-2006-1490 EXP | PHP before 5.1.3-RC1 might allow remote attackers to obtain portions of memory via crafted binary data sent to a script that processes user input in t… | Patch early | 5.0 medium | 21% | 2006-03-29 |
| CVE-2021-46387 EXP | ZyXEL ZyWALL 2 Plus Internet Security Appliance is affected by Cross Site Scripting (XSS). Insecure URI handling leads to bypass security restriction… | Patch early | 6.1 medium | 21% | 2022-03-01 |
| CVE-2001-0322 EXP | MSHTML.DLL HTML parser in Internet Explorer 4.0, and other versions, allows remote attackers to cause a denial of service (application crash) via a sc… | Patch early | 5.0 medium | 21% | 2001-06-02 |
| CVE-2014-1777 EXP | Microsoft Internet Explorer 10 and 11 allows remote attackers to read local files on the client via a crafted web site, aka "Internet Explorer Informa… | Patch early | 4.3 medium | 21% | 2014-06-11 |
| CVE-2013-2113 EXP | The create method in app/controllers/users_controller.rb in Foreman before 1.2.0-RC2 allows remote authenticated users with permissions to create or e… | Patch early | 6.0 medium | 20.9% | 2013-07-31 |
| CVE-2019-6110 EXP | In OpenSSH 7.9, due to accepting and displaying arbitrary stderr output from the server, a malicious server (or Man-in-The-Middle attacker) can manipu… | Patch early | 6.8 medium | 20.9% | 2019-01-31 |
| CVE-2015-1579 EXP | Directory traversal vulnerability in the Elegant Themes Divi theme for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in… | Patch early | 5.0 medium | 20.9% | 2015-02-11 |
| CVE-2020-9283 EXP | golang.org/x/crypto before v0.0.0-20200220183623-bac4c82f6975 for Go allows a panic during signature verification in the golang.org/x/crypto/ssh packa… | Patch early | 7.5 high | 20.9% | 2020-02-20 |
| CVE-2016-2209 EXP | Buffer overflow in Dec2SS.dll in the AntiVirus Decomposer engine in Symantec Advanced Threat Protection (ATP); Symantec Data Center Security:Server (S… | Patch early | 7.3 high | 20.9% | 2016-06-30 |
| CVE-2006-3655 EXP | Unspecified vulnerability in mso.dll in Microsoft PowerPoint 2003 allows user-assisted attackers to execute arbitrary code via a crafted PowerPoint fi… | Patch early | 5.1 medium | 20.9% | 2006-07-18 |
| CVE-2011-1866 EXP | Buffer overflow in omniinet.exe in the inet service in HP OpenView Storage Data Protector 6.00 through 6.20 allows remote attackers to execute arbitra… | Patch early | 10.0 high | 20.9% | 2011-07-01 |
| CVE-2016-6272 EXP | XPath injection vulnerability in Epic MyChart allows remote attackers to access contents of an XML document containing static display strings, such as… | Patch early | 7.5 high | 20.9% | 2018-02-20 |
| CVE-2013-0633 EXP | Buffer overflow in Adobe Flash Player before 10.3.183.51 and 11.x before 11.5.502.149 on Windows and Mac OS X, before 10.3.183.51 and 11.x before 11.2… | Patch early | 9.3 high | 20.9% | 2013-02-08 |
| CVE-2007-1306 EXP | Asterisk 1.4 before 1.4.1 and 1.2 before 1.2.16 allows remote attackers to cause a denial of service (crash) by sending a Session Initiation Protocol… | Patch early | 7.8 high | 20.9% | 2007-03-07 |
| CVE-2006-7065 EXP | Microsoft Internet Explorer allows remote attackers to cause a denial of service (crash) via an IFRAME with a certain XML file and XSL stylesheet that… | Patch early | 5.0 medium | 20.9% | 2007-03-02 |
| CVE-2023-0830 EXP | A vulnerability classified as critical has been found in EasyNAS 1.1.0. Affected is the function system of the file /backup.pl. The manipulation leads… | Patch early | 6.3 medium | 20.9% | 2023-02-14 |
| CVE-2014-2908 EXP | Cross-site scripting (XSS) vulnerability in the integrated web server on Siemens SIMATIC S7-1200 CPU devices 2.x and 3.x allows remote attackers to in… | Patch early | 4.3 medium | 20.9% | 2014-04-25 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt