CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
401,289 CVEs
1,734 on KEV
17,292 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-05
170,047 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-1999-1170 EXP | IPswitch IMail allows local users to gain additional privileges and modify or add mail accounts by setting the "flags" registry key to 1920. | Patch early | 4.6 medium | 3.7% | 1999-01-02 |
| CVE-2018-14888 EXP | inc/plugins/thankyoulike.php in the Eldenroot Thank You/Like plugin before 3.1.0 for MyBB allows XSS via a post or thread subject. | Patch early | 6.1 medium | 3.7% | 2018-08-14 |
| CVE-2013-3739 EXP | Directory traversal vulnerability in editor.php in Network Weathermap 0.97c and earlier allows remote attackers to read arbitrary files via a .. (dot… | Patch early | 5.0 medium | 3.7% | 2014-06-05 |
| CVE-2019-16116 EXP | EnterpriseDT CompleteFTP Server prior to version 12.1.3 is vulnerable to information exposure in the Bootstrap.log file. This allows an attacker to ob… | Patch early | 4.3 medium | 3.7% | 2019-10-02 |
| CVE-2017-8708 EXP | The Windows kernel component on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT… | Patch early | 4.7 medium | 3.7% | 2017-09-13 |
| CVE-2007-6457 EXP | Stack-based buffer overflow in the webmail feature in SurgeMail 38k4 allows remote attackers to cause a denial of service (crash) via a long Host head… | Patch early | 5.0 medium | 3.7% | 2007-12-20 |
| CVE-2011-3862 EXP | Cross-site scripting (XSS) vulnerability in the Morning Coffee theme before 3.6 for WordPress allows remote attackers to inject arbitrary web script o… | Patch early | 4.3 medium | 3.7% | 2011-09-28 |
| CVE-2008-6997 EXP | Google Chrome 0.2.149.27 allows user-assisted remote attackers to cause a denial of service (browser crash) via an IMG tag with a long src attribute,… | Patch early | 4.3 medium | 3.7% | 2009-08-19 |
| CVE-2000-0648 EXP | WFTPD and WFTPD Pro 2.41 allows local users to cause a denial of service by executing the RENAME TO (RNTO) command before a RENAME FROM (RNFR) command… | Patch early | 5.0 medium | 3.7% | 2000-07-11 |
| CVE-2019-16173 EXP | LimeSurvey before v3.17.14 allows reflected XSS for escalating privileges from a low-privileged account to, for example, SuperAdmin. This occurs in ap… | Patch early | 5.4 medium | 3.7% | 2019-09-09 |
| CVE-2001-0574 EXP | Directory traversal vulnerability in MP3Mystic prior to 1.04b3 allows a remote attacker to download arbitrary files via a '..' (dot dot) in the URL. | Patch early | 5.0 medium | 3.7% | 2001-08-14 |
| CVE-2001-0615 EXP | Directory traversal vulnerability in Faust Informatics Freestyle Chat server prior to 4.1 SR3 allows a remote attacker to read arbitrary files via a s… | Patch early | 5.0 medium | 3.7% | 2001-08-14 |
| CVE-2001-0630 EXP | Directory traversal vulnerability in MIMAnet viewsrc.cgi 2.0 allows a remote attacker to read arbitrary files via a '..' (dot dot) attack in the 'loc'… | Patch early | 5.0 medium | 3.7% | 2001-08-22 |
| CVE-2001-0804 EXP | Directory traversal vulnerability in story.pl in Interactive Story 1.3 allows a remote attacker to read arbitrary files via a .. (dot dot) attack on t… | Patch early | 5.0 medium | 3.7% | 2001-12-06 |
| CVE-2000-1005 EXP | Directory traversal vulnerability in html_web_store.cgi and web_store.cgi CGI programs in eXtropia WebStore allows remote attackers to read arbitrary… | Patch early | 5.0 medium | 3.7% | 2000-12-11 |
| CVE-2018-14840 EXP | uploads/.htaccess in Subrion CMS 4.2.1 allows XSS because it does not block .html file uploads (but does block, for example, .htm file uploads). | Patch early | 6.1 medium | 3.7% | 2018-08-02 |
| CVE-2013-4241 EXP | Multiple cross-site scripting (XSS) vulnerabilities in the HMS Testimonials plugin before 2.0.11 for WordPress allow remote attackers to inject arbitr… | Patch early | 6.1 medium | 3.7% | 2020-01-30 |
| CVE-2017-9095 EXP | XXE in Diving Log 6.0 allows attackers to remotely view local files through a crafted dive.xml file that is mishandled during a Subsurface import. | Patch early | 5.5 medium | 3.7% | 2017-09-08 |
| CVE-2023-33580 EXP | Phpgurukul Student Study Center Management System V1.0 is vulnerable to Cross Site Scripting (XSS) in the "Admin Name" field on Admin Profile page. | Patch early | 4.8 medium | 3.7% | 2023-06-26 |
| CVE-2006-0976 EXP | Directory traversal vulnerability in scan_lang_insert.php in Boris Herbiniere-Seve SPiD 1.3.1 allows remote attackers to read arbitrary files via the… | Patch early | 5.0 medium | 3.7% | 2006-03-03 |
| CVE-2005-4245 EXP | Cross-site scripting (XSS) vulnerability in search.php in Snipe Gallery 3.1.4 and earlier allows remote attackers to inject arbitrary web script or HT… | Patch early | 4.3 medium | 3.7% | 2005-12-14 |
| CVE-2010-2627 EXP | Multiple directory traversal vulnerabilities in the Refractor 2 engine, as used in Battlefield 2 1.50 (1.5.3153-802.0) and earlier, and Battlefield 21… | Patch early | 6.8 medium | 3.7% | 2010-07-02 |
| CVE-2016-3411 EXP | Cross-site scripting (XSS) vulnerability in Zimbra Collaboration before 8.7.0 allows remote attackers to inject arbitrary web script or HTML via unspe… | Patch early | 6.1 medium | 3.7% | 2017-01-18 |
| CVE-2003-1278 EXP | Cross-site scripting vulnerability (XSS) in OpenTopic 2.3.1 allows remote attackers to execute arbitrary script as other users and possibly steal auth… | Patch early | 4.3 medium | 3.7% | 2003-12-31 |
| CVE-2000-0922 EXP | Directory traversal vulnerability in Bytes Interactive Web Shopper shopping cart program (shopper.cgi) 2.0 and earlier allows remote attackers to read… | Patch early | 5.0 medium | 3.7% | 2000-12-19 |
| CVE-2006-5125 EXP | Directory traversal vulnerability in window.php, possibly used by home.php, in Joshua Muheim phpMyWebmin 1.0 allows remote attackers to obtain sensiti… | Patch early | 5.0 medium | 3.7% | 2006-10-03 |
| CVE-2012-6007 EXP | Cross-site scripting (XSS) vulnerability in screens/base/web_auth_custom.html on Cisco Wireless LAN Controller (WLC) devices with software 7.2.110.0 a… | Patch early | 4.3 medium | 3.7% | 2012-12-19 |
| CVE-2006-5244 EXP | Multiple PHP remote file inclusion vulnerabilities in OpenDock Easy Blog 1.4 and earlier, when register_globals is enabled, allow remote attackers to… | Patch early | 5.1 medium | 3.7% | 2006-10-12 |
| CVE-2017-0058 EXP | A Win32k information disclosure vulnerability exists in Microsoft Windows when the win32k component improperly provides kernel information. An attacke… | Patch early | 4.7 medium | 3.7% | 2017-04-12 |
| CVE-2012-6041 EXP | Double free vulnerability in GreenBrowser before 6.0.1002, when the keyword search bar (F6) is activated, allows remote attackers to execute arbitrary… | Patch early | 6.8 medium | 3.7% | 2012-11-26 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt