CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
401,116 CVEs
1,733 on KEV
17,290 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-04
319,716 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2018-17408 EXP | Stack-based buffer overflows in Zahir Accounting Enterprise Plus 6 through build 10b allow remote attackers to execute arbitrary code via a crafted CS… | Patch early | 7.8 high | 19% | 2018-10-03 |
| CVE-2019-12735 EXP | getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6 allows remote attackers to execute arbitrary OS commands via the :source! command in a modeli… | Patch early | 8.6 high | 19% | 2019-06-05 |
| CVE-2004-1096 EXP | Archive::Zip Perl module before 1.14, when used by antivirus programs such as amavisd-new, allows remote attackers to bypass antivirus protection via… | Patch early | 7.5 high | 19% | 2005-01-10 |
| CVE-2011-0020 EXP | Heap-based buffer overflow in the pango_ft2_font_render_box_glyph function in pango/pangoft2-render.c in libpango in Pango 1.28.3 and earlier, when th… | Patch early | 7.6 high | 18.9% | 2011-01-24 |
| CVE-2009-2433 EXP | Stack-based buffer overflow in the AddFavorite method in Microsoft Internet Explorer allows remote attackers to cause a denial of service (application… | Patch early | 4.3 medium | 18.9% | 2009-07-10 |
| CVE-2018-20556 EXP | SQL injection vulnerability in Booking Calendar plugin 8.4.3 for WordPress allows remote attackers to execute arbitrary SQL commands via the booking_i… | Patch early | 8.8 high | 18.9% | 2019-03-21 |
| CVE-2006-6059 EXP | Buffer overflow in MA521nd5.SYS driver 5.148.724.2003 for NetGear MA521 PCMCIA adapter allows remote attackers to execute arbitrary code via (1) beaco… | Patch early | 10.0 high | 18.9% | 2006-11-22 |
| CVE-2010-4409 EXP | Integer overflow in the NumberFormatter::getSymbol (aka numfmt_get_symbol) function in PHP 5.3.3 and earlier allows context-dependent attackers to cau… | Patch early | 5.0 medium | 18.9% | 2010-12-06 |
| CVE-2007-2194 EXP | Stack-based buffer overflow in XnView 1.90.3 allows user-assisted remote attackers to execute arbitrary code via a crafted XPM file with a long sectio… | Patch early | 10.0 high | 18.9% | 2007-04-24 |
| CVE-2010-1980 EXP | Directory traversal vulnerability in joomlaflickr.php in the Joomla Flickr (com_joomlaflickr) component 1.0.3 for Joomla! allows remote attackers to i… | Patch early | 7.5 high | 18.8% | 2010-05-19 |
| CVE-2014-10037 EXP | Directory traversal vulnerability in DomPHP 0.83 and earlier allows remote attackers to have unspecified impact via a .. (dot dot) in the url paramete… | Patch early | 7.5 high | 18.8% | 2015-01-13 |
| CVE-2019-9881 EXP | The createComment mutation in the WPGraphQL 0.2.3 plugin for WordPress allows unauthenticated users to post comments on any article, even when 'allow… | Patch early | 5.3 medium | 18.8% | 2019-06-10 |
| CVE-2007-1285 EXP | The Zend Engine in PHP 4.x before 4.4.7, and 5.x before 5.2.2, allows remote attackers to cause a denial of service (stack exhaustion and PHP crash) v… | Patch early | 7.5 high | 18.8% | 2007-03-06 |
| CVE-2015-4414 EXP | Directory traversal vulnerability in download_audio.php in the SE HTML5 Album Audio Player (se-html5-album-audio-player) plugin 1.1.0 and earlier for… | Patch early | 5.0 medium | 18.8% | 2015-06-17 |
| CVE-2004-0771 EXP | Buffer overflow in the extract_one function from lhext.c in LHA may allow attackers to execute arbitrary code via a long w (working directory) command… | Patch early | 10.0 high | 18.8% | 2004-11-23 |
| CVE-2010-4597 EXP | Stack-based buffer overflow in the save method in the IntegraXor.Project ActiveX control in igcomm.dll in Ecava IntegraXor Human-Machine Interface (HM… | Patch early | 10.0 high | 18.8% | 2010-12-23 |
| CVE-2014-5368 EXP | Directory traversal vulnerability in the file_get_contents function in downloadfiles/download.php in the WP Content Source Control (wp-source-control)… | Patch early | 5.0 medium | 18.8% | 2014-08-22 |
| CVE-2010-1983 EXP | Directory traversal vulnerability in the redTWITTER (com_redtwitter) component 1.0.x including 1.0b11 for Joomla! allows remote attackers to read arbi… | Patch early | 7.5 high | 18.8% | 2010-05-19 |
| CVE-2008-2650 EXP | Directory traversal vulnerability in cmsimple/cms.php in CMSimple 3.1, when register_globals is enabled, allows remote attackers to include and execut… | Patch early | 6.8 medium | 18.8% | 2008-06-10 |
| CVE-2008-1391 EXP | Multiple integer overflows in libc in NetBSD 4.x, FreeBSD 6.x and 7.x, and probably other BSD and Apple Mac OS platforms allow context-dependent attac… | Patch early | 7.5 high | 18.8% | 2008-03-27 |
| CVE-2004-0501 EXP | Outlook 2003 allows remote attackers to bypass intended access restrictions and cause Outlook to request a URL from a remote site via an HTML e-mail m… | Patch early | 5.0 medium | 18.7% | 2004-08-18 |
| CVE-2005-1279 EXP | tcpdump 3.8.3 and earlier allows remote attackers to cause a denial of service (infinite loop) via a crafted (1) BGP packet, which is not properly han… | Patch early | 5.0 medium | 18.7% | 2005-05-02 |
| CVE-2006-3990 EXP | Multiple PHP remote file inclusion vulnerabilities in Paul M. Jones Savant2, possibly when used with the com_mtree component for Mambo and Joomla!, al… | Patch early | 7.5 high | 18.7% | 2006-08-05 |
| CVE-2012-6495 EXP | Multiple directory traversal vulnerabilities in the (1) twikidraw (action/twikidraw.py) and (2) anywikidraw (action/anywikidraw.py) actions in MoinMoi… | Patch early | 6.0 medium | 18.7% | 2013-01-03 |
| CVE-2010-1353 EXP | Directory traversal vulnerability in the LoginBox Pro (com_loginbox) component for Joomla! allows remote attackers to read arbitrary files via a .. (d… | Patch early | 5.0 medium | 18.7% | 2010-04-12 |
| CVE-2010-1714 EXP | Directory traversal vulnerability in the Arcade Games (com_arcadegames) component 1.0 for Joomla! allows remote attackers to read arbitrary files via… | Patch early | 5.0 medium | 18.7% | 2010-05-04 |
| CVE-2009-4098 EXP | Unrestricted file upload vulnerability in banner-edit.php in OpenX adserver 2.8.1 and earlier allows remote authenticated users with banner / file upl… | Patch early | 6.0 medium | 18.7% | 2009-11-29 |
| CVE-2010-3147 EXP | Untrusted search path vulnerability in wab.exe 6.00.2900.5512 in Windows Address Book in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Wi… | Patch early | 9.3 high | 18.7% | 2010-08-27 |
| CVE-2013-1861 EXP | MariaDB 5.5.x before 5.5.30, 5.3.x before 5.3.13, 5.2.x before 5.2.15, and 5.1.x before 5.1.68, and Oracle MySQL 5.1.69 and earlier, 5.5.31 and earlie… | Patch early | 5.0 medium | 18.7% | 2013-03-28 |
| CVE-2007-4033 EXP | Buffer overflow in the intT1_EnvGetCompletePath function in lib/t1lib/t1env.c in t1lib 5.1.1 allows context-dependent attackers to execute arbitrary c… | Patch early | 7.5 high | 18.7% | 2007-07-27 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt