CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
401,121 CVEs
1,733 on KEV
17,292 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-04
186,472 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2011-1564 EXP | Multiple integer overflows in the HMI application in DATAC RealFlex RealWin 2.1 (Build 6.1.10.10) and earlier allow remote attackers to execute arbitr… | Patch early | 10.0 high | 18.6% | 2011-04-05 |
| CVE-2019-0566 EXP | An elevation of privilege vulnerability exists in Microsoft Edge Browser Broker COM object, aka "Microsoft Edge Elevation of Privilege Vulnerability."… | Patch early | 8.8 high | 18.6% | 2019-01-08 |
| CVE-2009-2994 EXP | Buffer overflow in Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2 might allow attackers to execute arbitrary code via… | Patch early | 9.3 high | 18.6% | 2009-10-19 |
| CVE-2007-5322 EXP | Insecure method vulnerability in the FPOLE.OCX 6.0.8450.0 ActiveX control in Microsoft Visual FoxPro 6.0 allows remote attackers to execute arbitrary… | Patch early | 7.5 high | 18.6% | 2007-10-09 |
| CVE-2018-4243 EXP | An issue was discovered in certain Apple products. iOS before 11.4 is affected. macOS before 10.13.5 is affected. tvOS before 11.4 is affected. watchO… | Patch early | 7.8 high | 18.5% | 2018-06-08 |
| CVE-2018-20469 EXP | An issue was discovered in Tyto Sahi Pro through 7.x.x and 8.0.0. A parameter in the web reports module is vulnerable to h2 SQL injection. This can be… | Patch early | 9.8 critical | 18.5% | 2019-06-17 |
| CVE-2010-2738 EXP | The Uniscribe (aka new Unicode Script Processor) implementation in USP10.DLL in Microsoft Windows XP SP2 and SP3, Server 2003 SP2, Vista SP1 and SP2,… | Patch early | 9.3 high | 18.5% | 2010-09-15 |
| CVE-2017-5465 EXP | An out-of-bounds read while processing SVG content in "ConvolvePixel". This results in a crash and also allows for otherwise inaccessible memory being… | Patch early | 9.1 critical | 18.5% | 2018-06-11 |
| CVE-2024-58258 EXP | SugarCRM before 13.0.4 and 14.x before 14.0.1 allows SSRF in the API module because a limited type of code injection can occur. | Patch early | 7.2 high | 18.5% | 2025-07-13 |
| CVE-2010-4091 EXP | The EScript.api plugin in Adobe Reader and Acrobat 10.x before 10.0.1, 9.x before 9.4.1, and 8.x before 8.2.6 on Windows and Mac OS X allows remote at… | Patch early | 9.3 high | 18.5% | 2010-11-07 |
| CVE-2018-15716 EXP | NUUO NVRMini2 version 3.9.1 is vulnerable to authenticated remote command injection. An attacker can send crafted requests to upgrade_handle.php to ex… | Patch early | 8.8 high | 18.5% | 2018-11-30 |
| CVE-2018-8897 EXP | A statement in the System Programming Guide of the Intel 64 and IA-32 Architectures Software Developer's Manual (SDM) was mishandled in the developmen… | Patch early | 7.8 high | 18.5% | 2018-05-08 |
| CVE-2013-3248 EXP | Untrusted search path vulnerability in Corel PDF Fusion 1.11 allows local users to gain privileges via a Trojan horse wintab32.dll file in the current… | Patch early | 9.3 high | 18.5% | 2013-10-03 |
| CVE-2025-20124 EXP | A vulnerability in an API of Cisco ISE could allow an authenticated, remote attacker to execute arbitrary commands as the root user on an affected dev… | Patch early | 9.9 critical | 18.5% | 2025-02-05 |
| CVE-2008-5297 EXP | Buffer overflow in No-IP DUC 2.1.7 and earlier allows remote HTTP servers to execute arbitrary code via a crafted response to a DNS update request, re… | Patch early | 7.6 high | 18.5% | 2008-12-01 |
| CVE-2025-60787 EXP | MotionEye v0.43.1b4 and before is vulnerable to OS Command Injection in configuration parameters such as image_file_name. Unsanitized user input is wr… | Patch early | 7.2 high | 18.5% | 2025-10-03 |
| CVE-2007-0465 EXP | Format string vulnerability in Apple Installer 2.1.5 on Mac OS X 10.4.8 allows user-assisted remote attackers to execute arbitrary code via format str… | Patch early | 7.6 high | 18.5% | 2007-01-31 |
| CVE-2018-5701 EXP | In Iolo System Shield AntiVirus and AntiSpyware 5.0.0.136, the amp.sys driver file contains an Arbitrary Write vulnerability due to not validating inp… | Patch early | 9.8 critical | 18.5% | 2018-01-31 |
| CVE-2010-1495 EXP | Directory traversal vulnerability in the Matamko (com_matamko) component 1.01 for Joomla! allows remote attackers to read arbitrary files via a .. (do… | Patch early | 7.5 high | 18.5% | 2010-04-23 |
| CVE-2012-3576 EXP | Unrestricted file upload vulnerability in php/upload.php in the wpStoreCart plugin before 2.5.30 for WordPress allows remote attackers to execute arbi… | Patch early | 10.0 high | 18.4% | 2012-06-16 |
| CVE-2021-3018 EXP | ipeak Infosystems ibexwebCMS (aka IPeakCMS) 3.5 is vulnerable to an unauthenticated Boolean-based SQL injection via the id parameter on the /cms/print… | Patch early | 9.8 critical | 18.4% | 2021-01-05 |
| CVE-2017-6190 EXP | Directory traversal vulnerability in the web interface on the D-Link DWR-116 device with firmware before V1.05b09 allows remote attackers to read arbi… | Patch early | 7.5 high | 18.4% | 2017-04-10 |
| CVE-2020-25787 EXP | An issue was discovered in Tiny Tiny RSS (aka tt-rss) before 2020-09-16. It does not validate all URLs before requesting them. | Patch early | 9.8 critical | 18.4% | 2020-09-19 |
| CVE-2019-1124 EXP | A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite Remote Code Execution Vulnerabili… | Patch early | 8.8 high | 18.4% | 2019-07-15 |
| CVE-1999-0005 EXP | Arbitrary command execution via IMAP buffer overflow in authenticate command. | Patch early | 10.0 high | 18.4% | 1998-07-20 |
| CVE-2007-6335 EXP | Integer overflow in libclamav in ClamAV before 0.92 allows remote attackers to execute arbitrary code via a crafted MEW packed PE file, which triggers… | Patch early | 7.5 high | 18.4% | 2007-12-20 |
| CVE-2016-6855 EXP | Eye of GNOME (aka eog) 3.16.5, 3.17.x, 3.18.x before 3.18.3, 3.19.x, and 3.20.x before 3.20.4, when used with glib before 2.44.1, allow remote attacke… | Patch early | 7.5 high | 18.4% | 2016-09-07 |
| CVE-2022-25089 EXP | Printix Secure Cloud Print Management through 1.3.1106.0 incorrectly uses Privileged APIs to modify values in HKEY_LOCAL_MACHINE via UITasks.Persisten… | Patch early | 9.8 critical | 18.4% | 2022-03-03 |
| CVE-2007-1071 EXP | Integer overflow in the gifGetBandProc function in ImageIO in Apple Mac OS X 10.4.8 allows remote attackers to cause a denial of service (segmentation… | Patch early | 7.8 high | 18.4% | 2007-02-22 |
| CVE-2011-1018 EXP | logwatch.pl in Logwatch 7.3.6 allows remote attackers to execute arbitrary commands via shell metacharacters in a log file name, as demonstrated via a… | Patch early | 10.0 high | 18.3% | 2011-02-25 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt