CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
401,092 CVEs
1,733 on KEV
17,290 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-04
186,455 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2013-0657 EXP | Stack-based buffer overflow in Schneider Electric Interactive Graphical SCADA System (IGSS) 10 and earlier allows remote attackers to execute arbitrar… | Patch early | 10.0 high | 21.3% | 2013-01-21 |
| CVE-2010-1173 EXP | The sctp_process_unk_param function in net/sctp/sm_make_chunk.c in the Linux kernel 2.6.33.3 and earlier, when SCTP is enabled, allows remote attacker… | Patch early | 7.1 high | 21.2% | 2010-05-07 |
| CVE-2004-0083 EXP | Buffer overflow in ReadFontAlias from dirfile.c of XFree86 4.1.0 through 4.3.0 allows local users and remote attackers to execute arbitrary code via a… | Patch early | 10.0 high | 21.2% | 2004-03-03 |
| CVE-2025-47166 EXP | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | Patch early | 8.8 high | 21.2% | 2025-06-10 |
| CVE-2016-9899 EXP | Use-after-free while manipulating DOM events and removing audio elements due to errors in the handling of node adoption. This vulnerability affects Fi… | Patch early | 9.8 critical | 21.1% | 2018-06-11 |
| CVE-2017-2931 EXP | Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable memory corruption vulnerability related to the parsing of SWF metadata. Success… | Patch early | 8.8 high | 21.1% | 2017-01-11 |
| CVE-2016-4338 EXP | The mysql user parameter configuration script (userparameter_mysql.conf) in the agent in Zabbix before 2.0.18, 2.2.x before 2.2.13, and 3.0.x before 3… | Patch early | 8.1 high | 21.1% | 2017-01-23 |
| CVE-2005-2842 EXP | Buffer overflow in dwrcs.exe in DameWare Mini Remote Control before 4.9.0 allows remote attackers to execute arbitrary code via the username. | Patch early | 7.5 high | 21.1% | 2005-09-08 |
| CVE-2021-44595 EXP | Wondershare Dr. Fone Latest version as of 2021-12-06 is vulnerable to Incorrect Access Control. A normal user can send manually crafted packets to the… | Patch early | 8.8 high | 21.1% | 2022-04-29 |
| CVE-2005-2871 EXP | Buffer overflow in the International Domain Name (IDN) support in Mozilla Firefox 1.0.6 and earlier, and Netscape 8.0.3.3 and 7.2, allows remote attac… | Patch early | 7.5 high | 21.1% | 2005-09-09 |
| CVE-2003-1083 EXP | Stack-based buffer overflow in Monit 1.4 to 4.1 allows remote attackers to execute arbitrary code via a long HTTP request. | Patch early | 10.0 high | 21.1% | 2003-12-31 |
| CVE-2020-3956 EXP | VMware Cloud Director 10.0.x before 10.0.0.2, 9.7.0.x before 9.7.0.5, 9.5.0.x before 9.5.0.6, and 9.1.0.x before 9.1.0.4 do not properly handle input… | Patch early | 8.8 high | 21.1% | 2020-05-20 |
| CVE-2016-3223 EXP | Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Wind… | Patch early | 8.1 high | 21.1% | 2016-06-16 |
| CVE-2006-6379 EXP | Buffer overflow in the BrightStor Backup Discovery Service in multiple CA products, including ARCserve Backup r11.5 SP1 and earlier, ARCserve Backup 9… | Patch early | 7.5 high | 21.1% | 2006-12-10 |
| CVE-2025-58180 EXP | OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.11.2 contain a vulnerability that… | Patch early | 8.8 high | 21.1% | 2025-09-09 |
| CVE-2018-5159 EXP | An integer overflow can occur in the Skia library due to 32-bit integer use in an array without integer overflow checks, resulting in possible out-of-… | Patch early | 9.8 critical | 21% | 2018-06-11 |
| CVE-2008-4864 EXP | Multiple integer overflows in imageop.c in the imageop module in Python 1.5.2 through 2.5.1 allow context-dependent attackers to break out of the Pyth… | Patch early | 7.5 high | 21% | 2008-11-01 |
| CVE-2021-26599 EXP | ImpressCMS before 1.4.3 allows include/findusers.php groups SQL Injection. | Patch early | 9.8 critical | 21% | 2022-03-28 |
| CVE-2020-9283 EXP | golang.org/x/crypto before v0.0.0-20200220183623-bac4c82f6975 for Go allows a panic during signature verification in the golang.org/x/crypto/ssh packa… | Patch early | 7.5 high | 20.9% | 2020-02-20 |
| CVE-2016-2209 EXP | Buffer overflow in Dec2SS.dll in the AntiVirus Decomposer engine in Symantec Advanced Threat Protection (ATP); Symantec Data Center Security:Server (S… | Patch early | 7.3 high | 20.9% | 2016-06-30 |
| CVE-2011-1866 EXP | Buffer overflow in omniinet.exe in the inet service in HP OpenView Storage Data Protector 6.00 through 6.20 allows remote attackers to execute arbitra… | Patch early | 10.0 high | 20.9% | 2011-07-01 |
| CVE-2016-6272 EXP | XPath injection vulnerability in Epic MyChart allows remote attackers to access contents of an XML document containing static display strings, such as… | Patch early | 7.5 high | 20.9% | 2018-02-20 |
| CVE-2013-0633 EXP | Buffer overflow in Adobe Flash Player before 10.3.183.51 and 11.x before 11.5.502.149 on Windows and Mac OS X, before 10.3.183.51 and 11.x before 11.2… | Patch early | 9.3 high | 20.9% | 2013-02-08 |
| CVE-2007-1306 EXP | Asterisk 1.4 before 1.4.1 and 1.2 before 1.2.16 allows remote attackers to cause a denial of service (crash) by sending a Session Initiation Protocol… | Patch early | 7.8 high | 20.9% | 2007-03-07 |
| CVE-2005-1250 EXP | SQL injection vulnerability in the logon screen of the web front end (NmConsole/Login.asp) for IpSwitch WhatsUp Professional 2005 SP1 allows remote at… | Patch early | 7.5 high | 20.9% | 2005-06-22 |
| CVE-2004-0933 EXP | Computer Associates (CA) InoculateIT 6.0, eTrust Antivirus r6.0 through r7.1, eTrust Antivirus for the Gateway r7.0 and r7.1, eTrust Secure Content Ma… | Patch early | 7.5 high | 20.9% | 2005-01-27 |
| CVE-2016-5639 EXP | Directory traversal vulnerability in cgi-bin/login.cgi on Crestron AirMedia AM-100 devices with firmware before 1.4.0.13 allows remote attackers to re… | Patch early | 7.5 high | 20.8% | 2016-08-03 |
| CVE-2020-35598 EXP | ACS Advanced Comment System 1.0 is affected by Directory Traversal via an advanced_component_system/index.php?ACS_path=..%2f URI. NOTE: this might be… | Patch early | 7.5 high | 20.8% | 2020-12-23 |
| CVE-2004-1137 EXP | Multiple vulnerabilities in the IGMP functionality for Linux kernel 2.4.22 to 2.4.28, and 2.6.x to 2.6.9, allow local and remote attackers to cause a… | Patch early | 10.0 high | 20.8% | 2005-01-10 |
| CVE-2017-1000112 EXP | Linux kernel: Exploitable memory corruption due to UFO to non-UFO path switch. When building a UFO packet with MSG_MORE __ip_append_data() calls ip_uf… | Patch early | 7.0 high | 20.8% | 2017-10-05 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt