CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
401,133 CVEs
1,734 on KEV
17,292 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-05
149,770 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2014-8656 EXP | The Compal Broadband Networks (CBN) CH6640E and CG6640E Wireless Gateway 1.0 with firmware CH6640-3.5.11.7-NOSH have a default password of (1) admin f… | Patch early | 10.0 high | 10.9% | 2014-11-06 |
| CVE-2016-8371 EXP | The web server in Phoenix Contact ILC PLCs can be accessed without authenticating even if the authentication mechanism is enabled. | Patch early | 7.3 high | 10.9% | 2018-04-05 |
| CVE-2016-8380 EXP | The web server in Phoenix Contact ILC PLCs allows access to read and write PLC variables without authentication. | Patch early | 7.3 high | 10.9% | 2018-04-05 |
| CVE-2009-3382 EXP | layout/base/nsCSSFrameConstructor.cpp in the browser engine in Mozilla Firefox 3.0.x before 3.0.15 does not properly handle first-letter frames, which… | Patch early | 10.0 high | 10.8% | 2009-10-29 |
| CVE-2009-2753 EXP | Multiple buffer overflows in the authentication functionality in librpc.dll in the Informix Storage Manager (ISM) Portmapper service (aka portmap.exe)… | Patch early | 10.0 high | 10.8% | 2010-03-05 |
| CVE-2015-6567 EXP | Wolf CMS before 0.8.3.1 allows unrestricted file upload and PHP Code Execution because admin/plugin/file_manager/browse/ (aka the filemanager) does no… | Patch early | 8.8 high | 10.8% | 2017-04-14 |
| CVE-2005-3243 EXP | Multiple buffer overflows in Ethereal 0.10.12 and earlier might allow remote attackers to execute arbitrary code via unknown vectors in the (1) SLIMP3… | Patch early | 7.5 high | 10.8% | 2005-10-27 |
| CVE-2017-3006 EXP | Adobe Thor versions 3.9.5.353 and earlier have a vulnerability related to the use of improper resource permissions during the installation of Creative… | Patch early | 8.8 high | 10.8% | 2017-04-12 |
| CVE-2001-1130 EXP | Sdbsearch.cgi in SuSE Linux 6.0-7.2 could allow remote attackers to execute arbitrary commands by uploading a keylist.txt file that contains filenames… | Patch early | 7.5 high | 10.8% | 2001-08-02 |
| CVE-2007-6485 EXP | Multiple PHP remote file inclusion vulnerabilities in Centreon 1.4.1 (aka Oreon 1.4) allow remote attackers to execute arbitrary PHP code via a URL in… | Patch early | 7.5 high | 10.8% | 2007-12-20 |
| CVE-2017-11661 EXP | The _WM_SetupMidiEvent function in internal_midi.c:2318 in WildMIDI 0.4.2 can cause a denial of service (invalid memory read and application crash) vi… | Patch early | 7.5 high | 10.8% | 2017-08-17 |
| CVE-2013-3075 EXP | Multiple buffer overflows in ActUWzd.dll 1.0.0.1 in Mitsubishi MX Component 3, as distributed in Citect CitectFacilities 7.10 and CitectScada 7.10r1,… | Patch early | 10.0 high | 10.8% | 2013-04-19 |
| CVE-2010-1932 EXP | Heap-based buffer overflow in XnView 1.97.4 and possibly earlier allows remote attackers to execute arbitrary code via a MultiBitMap (MBM) file with a… | Patch early | 9.3 high | 10.8% | 2010-06-16 |
| CVE-2008-0619 EXP | Buffer overflow in NeroMediaPlayer.exe in Nero Media Player 1.4.0.35 and earlier allows remote attackers to execute arbitrary code or cause a denial o… | Patch early | 9.3 high | 10.8% | 2008-02-06 |
| CVE-2018-19125 EXP | PrestaShop 1.6.x before 1.6.1.23 and 1.7.x before 1.7.4.4 allows remote attackers to delete an image directory. | Patch early | 7.5 high | 10.8% | 2018-11-09 |
| CVE-2007-1733 EXP | Buffer overflow in InterVations NaviCOPA HTTP Server 2.01 allows remote attackers to execute arbitrary code via a long (1) /cgi-bin/ or (2) /cgi/ path… | Patch early | 10.0 high | 10.8% | 2007-03-28 |
| CVE-2013-1616 EXP | The management console on the Symantec Web Gateway (SWG) appliance before 5.1.1 allows remote attackers to execute arbitrary commands by injecting a c… | Patch early | 8.3 high | 10.7% | 2013-08-01 |
| CVE-2010-0288 EXP | A typo in the administrator permission check in the ACL Manager plugin (plugins/acl/ajax.php) in DokuWiki before 2009-12-25b allows remote attackers t… | Patch early | 7.5 high | 10.7% | 2010-02-15 |
| CVE-2004-0194 EXP | Stack-based buffer overflow in the OutputDebugString function for Adobe Acrobat Reader 5.1 allows remote attackers to execute arbitrary code via a PDF… | Patch early | 7.5 high | 10.7% | 2004-03-29 |
| CVE-2002-0595 EXP | Buffer overflow in WTRS_UI.EXE (WTX_REMOTE.DLL) for WebTrends Reporting Center 4.0d allows remote attackers to execute arbitrary code via a long HTTP… | Patch early | 7.5 high | 10.7% | 2002-06-18 |
| CVE-2007-6697 EXP | Buffer overflow in the LWZReadByte function in IMG_gif.c in SDL_image before 1.2.7 allows remote attackers to cause a denial of service (application c… | Patch early | 7.5 high | 10.7% | 2008-02-01 |
| CVE-2001-0432 EXP | Buffer overflows in various CGI programs in the remote administration service for Trend Micro Interscan VirusWall 3.01 allow remote attackers to execu… | Patch early | 10.0 high | 10.7% | 2001-07-02 |
| CVE-2002-0665 EXP | Macromedia JRun Administration Server allows remote attackers to bypass authentication on the login form via an extra slash (/) in the URL. | Patch early | 10.0 high | 10.7% | 2002-07-11 |
| CVE-2008-4501 EXP | Directory traversal vulnerability in the FTP server in Serv-U 7.0.0.1 through 7.3, including 7.2.0.1, allows remote authenticated users to overwrite o… | Patch early | 9.0 high | 10.7% | 2008-10-09 |
| CVE-2005-2968 EXP | Firefox 1.0.6 and Mozilla 1.7.10 allows attackers to execute arbitrary commands via shell metacharacters in a URL that is provided to the browser on t… | Patch early | 7.5 high | 10.7% | 2005-09-20 |
| CVE-2004-0953 EXP | Buffer overflow in the C2S module in the open source Jabber 2.x server (Jabberd) allows remote attackers to cause a denial of service (application cra… | Patch early | 10.0 high | 10.7% | 2005-01-10 |
| CVE-2014-9456 EXP | Buffer overflow in NotePad++ 6.6.9 allows remote attackers to have unspecified impact via a long Time attribute in an Event element in an XML file. N… | Patch early | 10.0 high | 10.7% | 2015-01-02 |
| CVE-2008-0248 EXP | Buffer overflow in an ActiveX control in ccpm_0237.dll for StreamAudio ChainCast ProxyManager allows remote attackers to execute arbitrary code via a… | Patch early | 9.3 high | 10.7% | 2008-01-12 |
| CVE-2008-2702 EXP | Directory traversal vulnerability in the FTP client in ALTools ESTsoft ALFTP 4.1 beta 2 and 5.0 allows remote FTP servers to create or overwrite arbit… | Patch early | 9.3 high | 10.7% | 2008-06-13 |
| CVE-2011-4342 EXP | PHP remote file inclusion vulnerability in wp_xml_export.php in the BackWPup plugin before 1.7.2 for WordPress allows remote attackers to execute arbi… | Patch early | 7.5 high | 10.7% | 2012-10-08 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt