CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
401,123 CVEs
1,733 on KEV
17,292 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-04
149,763 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2002-1660 EXP | calendar.php in vBulletin before 2.2.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the command parameter. | Patch early | 7.5 high | 11.1% | 2002-12-31 |
| CVE-2007-1687 EXP | Multiple buffer overflows in the Internet Pictures Corporation iPIX Image Well ActiveX control (iPIX-ImageWell-ipix.dll) allow remote attackers to exe… | Patch early | 10.0 high | 11.1% | 2007-04-10 |
| CVE-2008-5409 EXP | Unspecified vulnerability in the pdf.xmd module in (1) BitDefender Free Edition 10 and Antivirus Standard 10, (2) BullGuard Internet Security 8.5, and… | Patch early | 9.3 high | 11.1% | 2008-12-10 |
| CVE-2017-2619 EXP | Samba before versions 4.6.1, 4.5.7 and 4.4.11 are vulnerable to a malicious client using a symlink race to allow access to areas of the server file sy… | Patch early | 7.5 high | 11.1% | 2018-03-12 |
| CVE-2019-8518 EXP | Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, watchOS 5.2, Safari 12.1,… | Patch early | 8.8 high | 11.1% | 2019-12-18 |
| CVE-2022-25090 EXP | Printix Secure Cloud Print Management through 1.3.1106.0 creates a temporary temp.ini file in a directory with insecure permissions, leading to privil… | Patch early | 8.1 high | 11.1% | 2022-03-10 |
| CVE-2016-8020 EXP | Improper control of generation of code vulnerability in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) allows remote authenticat… | Patch early | 8.0 high | 11.1% | 2017-03-14 |
| CVE-2007-1085 EXP | Cross-site scripting (XSS) vulnerability in Google Desktop allows remote attackers to bypass protection schemes and inject arbitrary web script or HTM… | Patch early | 7.6 high | 11.1% | 2007-02-23 |
| CVE-2011-4878 EXP | Directory traversal vulnerability in miniweb.exe in the HMI web server in Siemens WinCC flexible 2004, 2005, 2007, and 2008 before SP3; WinCC V11 (aka… | Patch early | 7.8 high | 11.1% | 2012-02-03 |
| CVE-2007-1413 EXP | Buffer overflow in the snmpget function in the snmp extension in PHP 5.2.3 and earlier, including PHP 4.4.6 and probably other PHP 4 versions, allows… | Patch early | 7.5 high | 11.1% | 2007-03-12 |
| CVE-2003-1123 EXP | Sun Java Runtime Environment (JRE) and SDK 1.4.0_01 and earlier allows untrusted applets to access certain information within trusted applets, which a… | Patch early | 7.5 high | 11.1% | 2003-12-31 |
| CVE-2017-6320 EXP | A remote command injection vulnerability exists in the Barracuda Load Balancer product line (confirmed on v5.4.0.004 (2015-11-26) and v6.0.1.006 (2016… | Patch early | 8.8 high | 11.1% | 2017-07-18 |
| CVE-2003-0770 EXP | FUNC.pm in IkonBoard 3.1.2a and earlier, including 3.1.1, does not properly cleanse the "lang" cookie when it contains illegal characters, which allow… | Patch early | 7.5 high | 11.1% | 2003-09-22 |
| CVE-2010-2034 EXP | Directory traversal vulnerability in the Percha Image Attach (com_perchaimageattach) component 1.1 for Joomla! allows remote attackers to read arbitra… | Patch early | 7.5 high | 11.1% | 2010-05-25 |
| CVE-2010-2037 EXP | Directory traversal vulnerability in the Percha Downloads Attach (com_perchadownloadsattach) component 1.1 for Joomla! allows remote attackers to read… | Patch early | 7.5 high | 11.1% | 2010-05-25 |
| CVE-2017-17867 EXP | Inteno iopsys 2.0-3.14 and 4.0 devices allow remote authenticated users to execute arbitrary OS commands by modifying the leasetrigger field in the od… | Patch early | 8.8 high | 11.1% | 2018-01-04 |
| CVE-2000-0010 EXP | WebWho+ whois.cgi program allows remote attackers to execute commands via shell metacharacters in the TLD parameter. | Patch early | 10.0 high | 11.1% | 1999-12-26 |
| CVE-2017-7397 EXP | BackBox Linux 4.6 allows remote attackers to cause a denial of service (ksoftirqd CPU consumption) via a flood of packets with Martian source IP addre… | Patch early | 7.5 high | 11.1% | 2017-04-03 |
| CVE-2014-9260 EXP | The basic_settings function in the download manager plugin for WordPress before 2.7.3 allows remote authenticated users to update every WordPress opti… | Patch early | 8.8 high | 11.1% | 2017-08-07 |
| CVE-2014-2030 EXP | Stack-based buffer overflow in the WritePSDImage function in coders/psd.c in ImageMagick, possibly 6.8.8-5, allows remote attackers to cause a denial… | Patch early | 8.8 high | 11.1% | 2020-02-06 |
| CVE-2008-0295 EXP | Heap-based buffer overflow in modules/access/rtsp/real_sdpplin.c in the Xine library, as used in VideoLAN VLC Media Player 0.8.6d and earlier, allows… | Patch early | 8.5 high | 11.1% | 2008-01-16 |
| CVE-2011-3596 EXP | Polipo before 1.0.4.1 suffers from a DoD vulnerability via specially-crafted HTTP POST / PUT request. | Patch early | 7.5 high | 11.1% | 2019-11-26 |
| CVE-2004-2044 EXP | PHP-Nuke 7.3, and other products that use the PHP-Nuke codebase such as the Nuke Cops betaNC PHP-Nuke Bundle, OSCNukeLite 3.1, and OSC2Nuke 7x do not… | Patch early | 7.5 high | 11% | 2004-06-01 |
| CVE-2021-27973 EXP | SQL injection exists in Piwigo before 11.4.0 via the language parameter to admin.php?page=languages. | Patch early | 7.2 high | 11% | 2021-04-02 |
| CVE-2007-0126 EXP | Heap-based buffer overflow in Opera 9.02 allows remote attackers to execute arbitrary code via a JPEG file with an invalid number of index bytes in th… | Patch early | 9.3 high | 11% | 2007-01-09 |
| CVE-2019-8646 EXP | An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 12.4, macOS Mojave 10.14.6, tvOS 12.4, watchOS 5.3. A r… | Patch early | 7.5 high | 11% | 2019-12-18 |
| CVE-2019-8672 EXP | Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.4, macOS Mojave 10.14.6, tvOS 12.4, watc… | Patch early | 8.8 high | 11% | 2019-12-18 |
| CVE-2002-0749 EXP | CGIscript.net csMailto.cgi allows remote attackers to execute arbitrary commands via shell metacharacters in the form-attachment field. | Patch early | 7.5 high | 11% | 2002-08-12 |
| CVE-2018-8947 EXP | rap2hpoutre Laravel Log Viewer before v0.13.0 relies on Base64 encoding for l, dl, and del requests, which makes it easier for remote attackers to byp… | Patch early | 7.5 high | 11% | 2018-03-25 |
| CVE-2007-1620 EXP | Multiple PHP remote file inclusion vulnerabilities in PHP DB Designer 1.02 and earlier allow remote attackers to execute arbitrary PHP code via a URL… | Patch early | 10.0 high | 11% | 2007-03-23 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt