CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
401,121 CVEs
1,733 on KEV
17,292 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-04
186,472 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2010-0108 EXP | Buffer overflow in the cliproxy.objects.1 ActiveX control in the Symantec Client Proxy (CLIproxy.dll) in Symantec AntiVirus 10.0.x, 10.1.x before MR9,… | Patch early | 10.0 high | 19.4% | 2010-02-19 |
| CVE-2019-1119 EXP | A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite Remote Code Execution Vulnerabili… | Patch early | 8.8 high | 19.4% | 2019-07-15 |
| CVE-2025-64459 EXP | An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8. The methods `QuerySet.filter()`, `QuerySet.exclude()`, and `Que… | Patch early | 9.1 critical | 19.4% | 2025-11-05 |
| CVE-2006-4018 EXP | Heap-based buffer overflow in the pefromupx function in libclamav/upx.c in Clam AntiVirus (ClamAV) 0.81 through 0.88.3 allows remote attackers to exec… | Patch early | 7.5 high | 19.4% | 2006-08-08 |
| CVE-2008-3533 EXP | Format string vulnerability in the window_error function in yelp-window.c in yelp in Gnome after 2.19.90 and before 2.24 allows remote attackers to ex… | Patch early | 10.0 high | 19.4% | 2008-08-18 |
| CVE-2019-10008 EXP | Zoho ManageEngine ServiceDesk 9.3 allows session hijacking and privilege escalation because an established guest session is automatically converted in… | Patch early | 8.8 high | 19.4% | 2019-04-24 |
| CVE-2011-1568 EXP | Format string vulnerability in the logText function in shmemmgr9.dll in IGSSdataServer.exe 9.00.00.11074, and 9.00.00.11063 and earlier, in 7-Technolo… | Patch early | 10.0 high | 19.4% | 2011-04-05 |
| CVE-2017-14094 EXP | A vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could allow an attacker to perform remote command execution… | Patch early | 9.8 critical | 19.4% | 2018-01-19 |
| CVE-2010-1119 EXP | Use-after-free vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, Safari before 4.1 on Mac OS X 10.4, and S… | Patch early | 10.0 high | 19.4% | 2010-03-25 |
| CVE-2002-0379 EXP | Buffer overflow in University of Washington imap server (uw-imapd) imap-2001 (imapd 2001.315) and imap-2001a (imapd 2001.315) with legacy RFC 1730 sup… | Patch early | 7.5 high | 19.4% | 2002-06-25 |
| CVE-2007-2057 EXP | Stack-based buffer overflow in aircrack-ng airodump-ng 0.7 allows remote attackers to execute arbitrary code via crafted 802.11 authentication packets… | Patch early | 10.0 high | 19.4% | 2007-04-18 |
| CVE-2017-7997 EXP | Multiple SQL injection vulnerabilities in Gespage before 7.4.9 allow remote attackers to execute arbitrary SQL commands via the (1) show_prn parameter… | Patch early | 9.8 critical | 19.3% | 2018-01-08 |
| CVE-2017-7285 EXP | A vulnerability in the network stack of MikroTik Version 6.38.5 released 2017-03-09 could allow an unauthenticated remote attacker to exhaust all avai… | Patch early | 7.5 high | 19.3% | 2017-03-29 |
| CVE-2002-1183 EXP | Microsoft Windows 98 and Windows NT 4.0 do not properly verify the Basic Constraints of digital certificates, allowing remote attackers to execute cod… | Patch early | 7.5 high | 19.3% | 2002-12-11 |
| CVE-2001-0247 EXP | Buffer overflows in BSD-based FTP servers allows remote attackers to execute arbitrary commands via a long pattern string containing a {} sequence, as… | Patch early | 10.0 high | 19.3% | 2001-06-18 |
| CVE-2019-18634 EXP | In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the privileged sudo process. (pwfe… | Patch early | 7.8 high | 19.3% | 2020-01-29 |
| CVE-2018-15139 EXP | Unrestricted file upload in interface/super/manage_site_files.php in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to exec… | Patch early | 8.8 high | 19.3% | 2018-08-13 |
| CVE-2019-9017 EXP | DWRCC in SolarWinds DameWare Mini Remote Control 10.0 x64 has a Buffer Overflow associated with the size field for the machine name. | Patch early | 7.5 high | 19.2% | 2019-05-02 |
| CVE-2019-19208 EXP | Codiad Web IDE through 2.8.4 allows PHP Code injection. | Patch early | 9.8 critical | 19.2% | 2020-03-16 |
| CVE-2016-6598 EXP | BMC Track-It! 11.4 before Hotfix 3 exposes an unauthenticated .NET remoting file storage service (FileStorageService) on port 9010. This service conta… | Patch early | 9.8 critical | 19.2% | 2018-01-30 |
| CVE-2013-3684 EXP | NextGEN Gallery plugin before 1.9.13 for WordPress: ngggallery.php file upload | Patch early | 9.8 critical | 19.2% | 2020-02-11 |
| CVE-2016-2208 EXP | The kernel component in Symantec Anti-Virus Engine (AVE) 20151.1 before 20151.1.1.4 allows remote attackers to execute arbitrary code or cause a denia… | Patch early | 9.1 critical | 19.2% | 2016-05-19 |
| CVE-2017-16949 EXP | An issue was discovered in the AccessKeys AccessPress Anonymous Post Pro plugin through 3.1.9 for WordPress. Improper input sanitization allows the at… | Patch early | 9.8 critical | 19.2% | 2017-12-19 |
| CVE-2018-5972 EXP | SQL Injection exists in Classified Ads CMS Quickad 4.0 via the keywords, placeid, cat, or subcat parameter to the listing URI. | Patch early | 9.8 critical | 19.2% | 2018-01-24 |
| CVE-2018-5979 EXP | SQL Injection exists in Wchat Fully Responsive PHP AJAX Chat Script 1.5 via the login.php User field. | Patch early | 9.8 critical | 19.2% | 2018-01-24 |
| CVE-2018-5985 EXP | SQL Injection exists in the LiveCRM SaaS Cloud 1.0 component for Joomla! via an r=site/login&company_id= request. | Patch early | 9.8 critical | 19.2% | 2018-01-24 |
| CVE-2018-5988 EXP | SQL Injection exists in Flexible Poll 1.2 via the id parameter to mobile_preview.php or index.php. | Patch early | 9.8 critical | 19.2% | 2018-01-24 |
| CVE-2018-6006 EXP | SQL Injection exists in the JS Autoz 1.0.9 component for Joomla! via the vtype, pre, or prs parameter. | Patch early | 9.8 critical | 19.2% | 2018-02-17 |
| CVE-2018-6583 EXP | SQL Injection exists in the Timetable Responsive Schedule 1.5 component for Joomla! via a view=event&alias= request. | Patch early | 9.8 critical | 19.2% | 2018-02-17 |
| CVE-2018-7313 EXP | SQL Injection exists in the CW Tags 2.0.6 component for Joomla! via the searchtext array parameter. | Patch early | 9.8 critical | 19.2% | 2018-02-22 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt