CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
401,123 CVEs
1,733 on KEV
17,292 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-04
401,123 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2016-0997 EXP | Use-after-free vulnerability in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.5… | Patch early | 8.8 high | 28.5% | 2016-03-12 |
| CVE-2022-28079 EXP | College Management System v1.0 was discovered to contain a SQL injection vulnerability via the course_code parameter. | Patch early | 8.8 high | 28.5% | 2022-05-05 |
| CVE-2007-2903 EXP | Buffer overflow in the HelpPopup method in the Microsoft Office 2000 Controllo UA di Microsoft Office ActiveX control (OUACTRL.OCX) 1.0.1.9 allows rem… | Patch early | 5.0 medium | 28.5% | 2007-05-30 |
| CVE-2009-0520 EXP | Adobe Flash Player 9.x before 9.0.159.0 and 10.x before 10.0.22.87 does not properly remove references to destroyed objects during Shockwave Flash fil… | Patch early | 9.3 high | 28.5% | 2009-02-26 |
| CVE-2010-0211 EXP | The slap_modrdn2mods function in modrdn.c in OpenLDAP 2.4.22 does not check the return value of a call to the smr_normalize function, which allows rem… | Patch early | 9.8 critical | 28.5% | 2010-07-28 |
| CVE-2014-6363 EXP | vbscript.dll in Microsoft VBScript 5.6 through 5.8, as used with Internet Explorer 6 through 11 and other products, allows remote attackers to execute… | Patch early | 9.3 high | 28.4% | 2014-12-11 |
| CVE-2019-14974 EXP | SugarCRM Enterprise 9.0.0 allows mobile/error-not-supported-platform.html?desktop_url= XSS. | Patch early | 6.1 medium | 28.4% | 2019-08-14 |
| CVE-2010-0269 EXP | The SMB client in Microsoft Windows 2000 SP4, Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista Gold, SP1, and SP2, Windows Server 2008 G… | Patch early | 10.0 high | 28.4% | 2010-04-14 |
| CVE-2012-4914 EXP | Stack-based buffer overflow in the reader in CoolPDF 3.0.2.256 allows remote attackers to execute arbitrary code via a PDF document with a crafted str… | Patch early | 9.3 high | 28.4% | 2013-01-26 |
| CVE-2010-3329 EXP | mshtmled.dll in Microsoft Internet Explorer 7 and 8 allows remote attackers to execute arbitrary code via a crafted Microsoft Office document that cau… | Patch early | 9.3 high | 28.4% | 2010-10-13 |
| CVE-2012-0663 EXP | Multiple stack-based buffer overflows in Apple QuickTime before 7.7.2 on Windows allow remote attackers to execute arbitrary code or cause a denial of… | Patch early | 9.3 high | 28.3% | 2012-05-16 |
| CVE-2016-3324 EXP | Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf… | Patch early | 8.8 high | 28.3% | 2016-09-14 |
| CVE-2016-0998 EXP | Use-after-free vulnerability in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.5… | Patch early | 8.8 high | 28.3% | 2016-03-12 |
| CVE-2006-3431 EXP | Buffer overflow in certain Asian language versions of Microsoft Excel might allow user-assisted attackers to execute arbitrary code via a crafted STYL… | Patch early | 7.5 high | 28.3% | 2006-07-07 |
| CVE-2009-3976 EXP | Buffer overflow in Labtam ProFTP 2.9 allows remote FTP servers to cause a denial of service (application crash) or execute arbitrary code via a long 2… | Patch early | 9.3 high | 28.3% | 2009-11-18 |
| CVE-2007-6026 EXP | Stack-based buffer overflow in Microsoft msjet40.dll 4.0.8618.0 (aka Microsoft Jet Engine), as used by Access 2003 in Microsoft Office 2003 SP3, allow… | Patch early | 9.3 high | 28.3% | 2007-11-20 |
| CVE-2010-4715 EXP | Multiple directory traversal vulnerabilities in the (1) WebAccess Agent and (2) Document Viewer Agent components in Novell GroupWise before 8.02HP all… | Patch early | 5.0 medium | 28.3% | 2011-01-31 |
| CVE-2004-0990 EXP | Integer overflow in GD Graphics Library libgd 2.0.28 (libgd2), and possibly other versions, allows remote attackers to cause a denial of service and p… | Patch early | 10.0 high | 28.3% | 2005-03-01 |
| CVE-2009-3270 EXP | Microsoft Internet Explorer 7 through 7.0.6000.16711 allows remote attackers to cause a denial of service (unusable browser) by calling the window.pri… | Patch early | 5.0 medium | 28.2% | 2009-09-18 |
| CVE-2011-1276 EXP | Buffer overflow in Microsoft Excel 2002 SP3, 2003 SP3, and 2007 SP2; Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Excel Viewe… | Patch early | 9.3 high | 28.2% | 2011-06-16 |
| CVE-2010-0696 EXP | Directory traversal vulnerability in includes/download.php in the JoomlaWorks AllVideos (Jw_allVideos) plugin 3.0 through 3.2 for Joomla! allows remot… | Patch early | 5.0 medium | 28.2% | 2010-02-23 |
| CVE-2018-19571 EXP | GitLab CE/EE, versions 8.18 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an SSRF vulnerability in webhooks… | Patch early | 7.7 high | 28.2% | 2019-07-10 |
| CVE-2011-0041 EXP | Integer overflow in gdiplus.dll in GDI+ in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 G… | Patch early | 9.3 high | 28.2% | 2011-04-13 |
| CVE-2003-1566 EXP | Microsoft Internet Information Services (IIS) 5.0 does not log requests that use the TRACK method, which allows remote attackers to obtain sensitive i… | Patch early | 5.0 medium | 28.1% | 2009-01-15 |
| CVE-2014-1912 EXP | Buffer overflow in the socket.recvfrom_into function in Modules/socketmodule.c in Python 2.5 before 2.7.7, 3.x before 3.3.4, and 3.4.x before 3.4rc1 a… | Patch early | 7.5 high | 28.1% | 2014-03-01 |
| CVE-2011-1137 EXP | Integer overflow in the mod_sftp (aka SFTP) module in ProFTPD 1.3.3d and earlier allows remote attackers to cause a denial of service (memory consumpt… | Patch early | 5.0 medium | 28.1% | 2011-03-11 |
| CVE-2001-0875 EXP | Internet Explorer 5.5 and 6.0 allows remote attackers to cause the File Download dialogue box to misrepresent the name of the file in the dialogue in… | Patch early | 7.5 high | 28.1% | 2001-11-26 |
| CVE-2009-0689 EXP | Array index error in the (1) dtoa implementation in dtoa.c (aka pdtoa.c) and the (2) gdtoa (aka new dtoa) implementation in gdtoa/misc.c in libc, as u… | Patch early | 6.8 medium | 28.1% | 2009-07-01 |
| CVE-2020-35606 EXP | Arbitrary command execution can occur in Webmin through 1.962. Any user authorized for the Package Updates module can execute arbitrary commands with… | Patch early | 8.8 high | 28% | 2020-12-21 |
| CVE-2018-12327 EXP | Stack-based buffer overflow in ntpq and ntpdc of NTP version 4.2.8p11 allows an attacker to achieve code execution or escalate to higher privileges vi… | Patch early | 9.8 critical | 28% | 2018-06-20 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt