CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
401,200 CVEs
1,734 on KEV
17,292 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-05
169,976 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2017-9128 EXP | The quicktime_video_width function in lqt_quicktime.c in libquicktime 1.2.4 allows remote attackers to cause a denial of service (heap-based buffer ov… | Patch early | 6.5 medium | 3.8% | 2017-06-12 |
| CVE-2006-1497 EXP | Directory traversal vulnerability in index.php in ViHor Design allows remote attackers to read arbitrary files via the page parameter. | Patch early | 5.0 medium | 3.8% | 2006-03-30 |
| CVE-2004-2617 EXP | Directory traversal vulnerability in Pegasi Web Server (PWS) 0.2.2 allows remote attackers to read files outside of the web root via a .. (dot dot) di… | Patch early | 5.0 medium | 3.8% | 2004-12-31 |
| CVE-2007-2048 EXP | Directory traversal vulnerability in /console in the Management Console in webMethods Glue 6.5.1 and earlier allows remote attackers to read arbitrary… | Patch early | 5.0 medium | 3.8% | 2007-04-16 |
| CVE-2015-4064 EXP | SQL injection vulnerability in modules/module.ab-testing.php in the Landing Pages plugin before 1.8.5 for WordPress allows remote authenticated users… | Patch early | 6.5 medium | 3.8% | 2015-05-27 |
| CVE-2007-4482 EXP | Cross-site scripting (XSS) vulnerability in index.php in the Pool 1.0.7 theme for WordPress allows remote attackers to inject arbitrary web script or… | Patch early | 4.3 medium | 3.8% | 2007-08-22 |
| CVE-2007-4032 EXP | Buffer overflow in CrystalPlayer Pro 1.98 allows user-assisted remote attackers to execute arbitrary code via a long string in a .mls Playlist file. | Patch early | 6.8 medium | 3.8% | 2007-07-27 |
| CVE-2006-2141 EXP | Cross-site scripting (XSS) vulnerability in popup_image in Collaborative Portal Server (CPS) 3.4.0 and earlier allows remote attackers to inject arbit… | Patch early | 4.3 medium | 3.8% | 2006-05-02 |
| CVE-2006-2892 EXP | Cross-site scripting (XSS) vulnerability in index.php in GANTTy 1.0.3 allows remote attackers to inject arbitrary HTML and web script via the message… | Patch early | 4.3 medium | 3.8% | 2006-06-07 |
| CVE-2010-1131 EXP | JavaScriptCore.dll, as used in Apple Safari 4.0.5 on Windows XP SP3, allows remote attackers to cause a denial of service (application crash) via an H… | Patch early | 4.3 medium | 3.8% | 2010-03-27 |
| CVE-2010-0475 EXP | Cross-site scripting (XSS) vulnerability in esp/editUser.esp in the Palo Alto Networks firewall 3.0.x before 3.0.9 and 3.1.x before 3.1.1 allows remot… | Patch early | 4.3 medium | 3.8% | 2010-05-14 |
| CVE-2004-1395 EXP | The Lithtech engine, as used in (1) Contract Jack 1.1 and earlier, (2) No one lives forever 2 1.3 and earlier, (3) Tron 2.0 1.042 and earlier, (4) F.E… | Patch early | 5.0 medium | 3.8% | 2004-12-31 |
| CVE-2004-1887 EXP | Ada Image Server (ImgSvr) 0.4 allows remote attackers to view directories or download files via an HTTP request with a trailing %00 (null). | Patch early | 5.0 medium | 3.8% | 2004-12-31 |
| CVE-2007-5290 EXP | Multiple cross-site scripting (XSS) vulnerabilities in MailBee WebMail Pro 3.4 and earlier; and possibly MailBee WebMail Pro ASP before 3.4.64, WebMai… | Patch early | 4.3 medium | 3.8% | 2007-10-09 |
| CVE-2005-0438 EXP | awstats.pl in AWStats 6.3 and 6.4 allows remote attackers to obtain sensitive information by setting the debug parameter. | Patch early | 5.0 medium | 3.8% | 2005-05-02 |
| CVE-2015-4425 EXP | Directory traversal vulnerability in pimcore before build 3473 allows remote authenticated users with the "assets" permission to create or write to ar… | Patch early | 4.9 medium | 3.8% | 2015-08-18 |
| CVE-2004-2366 EXP | Buffer overflow in GlobalSCAPE Secure FTP Server 2.0 B03.11.2004.2 allows remote attackers to cause a denial of service (crash) via a SITE command wit… | Patch early | 5.0 medium | 3.8% | 2004-12-31 |
| CVE-2012-4344 EXP | Cross-site scripting (XSS) vulnerability in Ipswitch WhatsUp Gold 15.02 allows remote attackers to inject arbitrary web script or HTML via unspecified… | Patch early | 4.3 medium | 3.8% | 2012-08-15 |
| CVE-2008-4671 EXP | Cross-site scripting (XSS) vulnerability in wp-admin/wp-blogs.php in Wordpress MU (WPMU) before 2.6 allows remote attackers to inject arbitrary web sc… | Patch early | 4.3 medium | 3.8% | 2008-10-22 |
| CVE-2003-0624 EXP | Cross-site scripting (XSS) vulnerability in InteractiveQuery.jsp for BEA WebLogic 8.1 and earlier allows remote attackers to inject malicious web scri… | Patch early | 4.3 medium | 3.8% | 2003-12-01 |
| CVE-2015-0060 EXP | The font mapper in win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1,… | Patch early | 4.7 medium | 3.8% | 2015-02-11 |
| CVE-2006-2635 EXP | Multiple cross-site scripting (XSS) vulnerabilities in Tikiwiki (aka Tiki CMS/Groupware) 1.9.x allow remote attackers to inject arbitrary web script o… | Patch early | 4.3 medium | 3.8% | 2006-05-30 |
| CVE-2007-0019 EXP | Multiple heap-based buffer overflows in rumpusd in Rumpus 5.1 and earlier (1) allow remote authenticated users to execute arbitrary code via a long LI… | Patch early | 6.5 medium | 3.8% | 2007-01-19 |
| CVE-2006-2899 EXP | Unspecified vulnerability in ESTsoft InternetDISK versions before 2006/04/20 allows remote authenticated users to execute arbitrary code, possibly by… | Patch early | 6.5 medium | 3.8% | 2006-06-07 |
| CVE-2008-5712 EXP | The HTML parser in KDE Konqueror 3.5.9 allows remote attackers to cause a denial of service (application crash) via (1) a long COLOR attribute in an H… | Patch early | 5.0 medium | 3.8% | 2008-12-24 |
| CVE-2020-18723 EXP | Stored cross-site scripting (XSS) in file attachment field in MDaemon webmail 19.5.5 allows an attacker to execute code on the email recipient side wh… | Patch early | 5.4 medium | 3.8% | 2021-02-03 |
| CVE-2004-2021 EXP | Directory traversal vulnerability in file_manager.php in osCommerce 2.2 allows remote attackers to view arbitrary files via a .. (dot dot) in the file… | Patch early | 5.0 medium | 3.8% | 2004-12-31 |
| CVE-2003-0495 EXP | Cross-site scripting (XSS) vulnerability in LedNews 0.7 allows remote attackers to insert arbitrary web script via a news item. | Patch early | 4.3 medium | 3.8% | 2003-08-07 |
| CVE-2008-3365 EXP | Directory traversal vulnerability in index.php in Pixelpost 1.7.1 on Windows, when register_globals is enabled, allows remote attackers to include and… | Patch early | 6.8 medium | 3.8% | 2008-07-30 |
| CVE-2017-11331 EXP | The wav_open function in oggenc/audio.c in Xiph.Org vorbis-tools 1.4.0 allows remote attackers to cause a denial of service (memory allocation error)… | Patch early | 5.5 medium | 3.8% | 2017-07-31 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt