CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
401,295 CVEs
1,734 on KEV
17,292 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-05
319,860 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2016-4136 EXP | Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11… | Patch early | 8.8 high | 16.4% | 2016-06-16 |
| CVE-2016-4137 EXP | Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11… | Patch early | 8.8 high | 16.4% | 2016-06-16 |
| CVE-2007-0949 EXP | Stack-based buffer overflow in iTinySoft Studio Total Video Player 1.03, and possibly earlier, allows remote attackers to execute arbitrary code via a… | Patch early | 10.0 high | 16.4% | 2007-02-15 |
| CVE-2021-25161 EXP | A remote cross-site scripting (xss) vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.4.x:… | Patch early | 6.1 medium | 16.4% | 2021-03-30 |
| CVE-2006-6293 EXP | Heap-based buffer overflow in FRISK Software F-Prot Antivirus before 4.6.7 allows user-assisted remote attackers to execute arbitrary code via a craft… | Patch early | 7.5 high | 16.4% | 2006-12-05 |
| CVE-2005-1193 EXP | The bbencode_second_pass and make_clickable functions in bbcode.php for phpBB before 2.0.15, as used in viewtopic.php, privmsg.php, and other scripts,… | Patch early | 7.5 high | 16.4% | 2005-05-16 |
| CVE-2007-4890 EXP | Absolute directory traversal vulnerability in a certain ActiveX control in the VB To VSI Support Library (VBTOVSI.DLL) 1.0.0.0 in Microsoft Visual Stu… | Patch early | 5.8 medium | 16.4% | 2007-09-14 |
| CVE-2003-0407 EXP | Buffer overflow in gbnserver for Gnome Batalla Naval 1.0.4 allows remote attackers to execute arbitrary code via a long connection string. | Patch early | 10.0 high | 16.4% | 2003-06-30 |
| CVE-2007-6506 EXP | The HPRulesEngine.ContentCollection.1 ActiveX Control in RulesEngine.dll for HP Software Update 4.000.005.007 and earlier, including 3.0.8.4, allows r… | Patch early | 9.3 high | 16.3% | 2007-12-20 |
| CVE-2001-0775 EXP | Buffer overflow in xloadimage 4.1 (aka xli 1.16 and 1.17) in Linux allows remote attackers to execute arbitrary code via a FACES format image containi… | Patch early | 7.5 high | 16.3% | 2001-10-18 |
| CVE-2009-1217 EXP | Off-by-one error in the GpFont::SetData function in gdiplus.dll in Microsoft GDI+ on Windows XP allows remote attackers to cause a denial of service (… | Patch early | 4.3 medium | 16.3% | 2009-04-01 |
| CVE-2005-4717 EXP | Microsoft Internet Explorer 6.0 on Windows NT 4.0 SP6a, Windows 2000 SP4, Windows XP SP1, Windows XP SP2, and Windows Server 2003 SP1 allows remote at… | Patch early | 5.0 medium | 16.3% | 2005-12-31 |
| CVE-2015-5065 EXP | Absolute path traversal vulnerability in proxy.php in the google currency lookup in the Paypal Currency Converter Basic For WooCommerce plugin before… | Patch early | 5.0 medium | 16.3% | 2015-06-24 |
| CVE-2000-0580 EXP | Windows 2000 Server allows remote attackers to cause a denial of service by sending a continuous stream of binary zeros to various TCP and UDP ports,… | Patch early | 5.0 medium | 16.3% | 2000-06-30 |
| CVE-2008-2005 EXP | The SuiteLink Service (aka slssvc.exe) in WonderWare SuiteLink before 2.0 Patch 01, as used in WonderWare InTouch 8.0, allows remote attackers to caus… | Patch early | 5.0 medium | 16.3% | 2008-05-06 |
| CVE-2006-3771 EXP | Multiple PHP remote file inclusion vulnerabilities in component.php in iManage CMS 4.0.12 and earlier allow remote attackers to execute arbitrary PHP… | Patch early | 7.5 high | 16.3% | 2006-07-24 |
| CVE-2006-3911 EXP | PHP remote file inclusion vulnerability in OSI Codes PHP Live! 3.2.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in th… | Patch early | 7.5 high | 16.3% | 2006-07-28 |
| CVE-2013-3166 EXP | Cross-site scripting (XSS) vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to inject arbitrary web script or HTML vi… | Patch early | 4.3 medium | 16.3% | 2013-07-10 |
| CVE-1999-0095 EXP | The debug command in Sendmail is enabled, allowing attackers to execute commands as root. | Patch early | 10.0 high | 16.3% | 1988-10-01 |
| CVE-2010-3142 EXP | Untrusted search path vulnerability in Microsoft Office PowerPoint 2007 allows local users, and possibly remote attackers, to execute arbitrary code a… | Patch early | 9.3 high | 16.3% | 2010-08-27 |
| CVE-2007-1578 EXP | Multiple integer signedness errors in the NTLM implementation in Atrium MERCUR IMAPD (mcrimap4.exe) 5.00.14, with SP4, allow remote attackers to execu… | Patch early | 10.0 high | 16.3% | 2007-03-21 |
| CVE-2008-1320 EXP | Multiple buffer overflows in ASG-Sentry Network Manager 7.0.0 and earlier allow remote attackers to execute arbitrary code or cause a denial of servic… | Patch early | 10.0 high | 16.3% | 2008-03-13 |
| CVE-2007-4642 EXP | Multiple buffer overflows in Doomsday (aka deng) 1.9.0-beta5.1 and earlier allow remote attackers to execute arbitrary code via a long chat (PKT_CHAT)… | Patch early | 10.0 high | 16.3% | 2007-08-31 |
| CVE-2010-2862 EXP | Integer overflow in CoolType.dll in Adobe Reader 8.2.3 and 9.3.3, and Acrobat 9.3.3, allows remote attackers to execute arbitrary code via a TrueType… | Patch early | 9.3 high | 16.3% | 2010-08-05 |
| CVE-2007-2718 EXP | Cross-site scripting (XSS) vulnerability in the WebMail system in Stalker CommuniGate Pro 5.1.8 and earlier, when using Microsoft Internet Explorer, a… | Patch early | 4.3 medium | 16.3% | 2007-05-16 |
| CVE-2006-5506 EXP | Multiple PHP remote file inclusion vulnerabilities in WiClear 0.10 allow remote attackers to execute arbitrary PHP code via the path parameter in (1)… | Patch early | 7.5 high | 16.3% | 2006-10-25 |
| CVE-2019-7262 EXP | Linear eMerge E3-Series devices allow Cross-Site Request Forgery (CSRF). | Patch early | 8.8 high | 16.3% | 2019-07-02 |
| CVE-2010-4543 EXP | Heap-based buffer overflow in the read_channel_data function in file-psp.c in the Paint Shop Pro (PSP) plugin in GIMP 2.6.11 allows remote attackers t… | Patch early | 7.5 high | 16.3% | 2011-01-07 |
| CVE-1999-0233 EXP | IIS 1.0 allows users to execute arbitrary commands using .bat or .cmd files. | Patch early | 10.0 high | 16.3% | 1996-02-25 |
| CVE-2011-0501 EXP | Stack-based buffer overflow in Music Animation Machine MIDI Player 2006aug19 Release 035 and possibly other versions allows user-assisted remote attac… | Patch early | 9.3 high | 16.3% | 2011-01-20 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt