CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
401,200 CVEs
1,734 on KEV
17,292 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-05
206,685 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2009-2044 EXP | Mozilla Firefox 3.0.10 and earlier on Linux allows remote attackers to cause a denial of service (application crash) via a URI for a large GIF image i… | Patch early | 4.3 medium | 5.9% | 2009-06-12 |
| CVE-2013-4095 EXP | plain/actionsets.html in the SecureSphere Operations Manager (SOM) Management Server in Imperva SecureSphere 9.0.0.5 allows remote authenticated users… | Patch early | 6.5 medium | 5.9% | 2013-06-28 |
| CVE-2021-41318 EXP | In Progress WhatsUp Gold prior to version 21.1.0, an application endpoint failed to adequately sanitize malicious input. which could allow an unauthen… | Patch early | 6.1 medium | 5.9% | 2021-09-28 |
| CVE-2001-0214 EXP | Way-board CGI program allows remote attackers to read arbitrary files by specifying the filename in the db parameter and terminating the filename with… | Patch early | 5.0 medium | 5.9% | 2001-06-02 |
| CVE-2023-30330 EXP | SoftExpert (SE) Excellence Suite 2.x versions before 2.1.3 is vulnerable to Local File Inclusion in the function /se/v42300/generic/gn_defaultframe/2.… | Patch early | 9.8 critical | 5.9% | 2023-05-12 |
| CVE-2013-6246 EXP | The Dell Quest One Password Manager, possibly 5.0, allows remote attackers to bypass CAPTCHA protections and obtain sensitive information (user's full… | Patch early | 5.0 medium | 5.9% | 2013-10-24 |
| CVE-2006-6042 EXP | PHP remote file inclusion vulnerability in core/editor.php in phpWebThings 1.5.2 and earlier, when register_globals is enabled, allows remote attacker… | Patch early | 6.8 medium | 5.9% | 2006-11-22 |
| CVE-2003-0314 EXP | Snowblind Web Server 1.0 allows remote attackers to cause a denial of service (crash) via a URL that ends in a "</" sequence. | Patch early | 6.4 medium | 5.9% | 2003-06-16 |
| CVE-2005-0952 EXP | Cross-site scripting vulnerability in pafiledb.php in PaFileDB 3.1 allows remote attackers to inject arbitrary web script or HTML via the id parameter… | Patch early | 5.0 medium | 5.9% | 2005-05-02 |
| CVE-2020-8547 EXP | phpList 3.5.0 allows type juggling for admin login bypass because == is used instead of === for password hashes, which mishandles hashes that begin wi… | Patch early | 9.8 critical | 5.9% | 2020-02-03 |
| CVE-2006-3774 EXP | PHP remote file inclusion vulnerability in performs.php in the perForms component (com_performs) 1.0 and earlier for Joomla! allows remote attackers t… | Patch early | 6.8 medium | 5.9% | 2006-07-24 |
| CVE-2002-2032 EXP | sql_layer.php in PHP-Nuke 5.4 and earlier does not restrict access to debugging features, which allows remote attackers to gain SQL query information… | Patch early | 5.0 medium | 5.9% | 2002-12-31 |
| CVE-2011-1956 EXP | The bytes_repr_len function in Wireshark 1.4.5 uses an incorrect pointer argument, which allows remote attackers to cause a denial of service (NULL po… | Patch early | 4.3 medium | 5.9% | 2011-06-06 |
| CVE-2007-1690 EXP | Multiple stack-based buffer overflows in Second Sight Software ActiveGS ActiveX control (ActiveGS.ocx) allow remote attackers to execute arbitrary cod… | Patch early | 6.8 medium | 5.9% | 2007-04-19 |
| CVE-2007-1691 EXP | Stack-based buffer overflow in Second Sight Software ActiveMod ActiveX control (ActiveMod.ocx) allows remote attackers to execute arbitrary code via u… | Patch early | 6.8 medium | 5.9% | 2007-04-19 |
| CVE-2012-5470 EXP | libpng_plugin in VideoLAN VLC media player 2.0.3 allows remote attackers to cause a denial of service (application crash) via a crafted PNG file. | Patch early | 4.3 medium | 5.8% | 2012-10-26 |
| CVE-2008-7216 EXP | Peter's Math Anti-Spam Spinoff plugin for WordPress generates audio CAPTCHA clips by concatenating static audio files without any additional distortio… | Patch early | 4.3 medium | 5.8% | 2009-09-11 |
| CVE-2006-1584 EXP | Unspecified vulnerability in index.php in Warcraft III Replay Parser for PHP 1.8c allows remote attackers to inject arbitrary web script or HTML via t… | Patch early | 6.4 medium | 5.8% | 2006-04-02 |
| CVE-1999-0215 EXP | Routed allows attackers to append data to files. | Patch early | 6.4 medium | 5.8% | 1998-10-26 |
| CVE-2014-3439 EXP | ConsoleServlet in Symantec Endpoint Protection Manager (SEPM) 12.1 before RU5 allows remote attackers to write to arbitrary files via unspecified vect… | Patch early | 6.1 medium | 5.8% | 2014-11-07 |
| CVE-2005-3189 EXP | Directory traversal vulnerability in Qualcomm WorldMail IMAP Server allows remote attackers to read arbitrary email messages via ".." sequences in the… | Patch early | 5.0 medium | 5.8% | 2005-11-18 |
| CVE-2015-3898 EXP | Multiple open redirect vulnerabilities in Bonita BPM Portal before 6.5.3 allow remote attackers to redirect users to arbitrary web sites and conduct p… | Patch early | 6.1 medium | 5.8% | 2018-02-28 |
| CVE-2003-1521 EXP | Sun Java Plug-In 1.4 through 1.4.2_02 allows remote attackers to repeatedly access the floppy drive via the createXmlDocument method in the org.apache… | Patch early | 6.4 medium | 5.8% | 2003-12-31 |
| CVE-2002-0874 EXP | Vulnerability in Interchange 4.8.6, 4.8.3, and other versions, when running in INET mode, allows remote attackers to read arbitrary files. | Patch early | 5.0 medium | 5.8% | 2002-09-05 |
| CVE-2000-0054 EXP | search.cgi in the SolutionScripts Home Free package allows remote attackers to view directories via a .. (dot dot) attack. | Patch early | 5.0 medium | 5.8% | 1999-01-03 |
| CVE-2008-0240 EXP | /idm/help/index.jsp in Sun Java System Identity Manager 6.0 SP1 through SP3, 7.0, and 7.1 allows remote attackers to inject frames from arbitrary web… | Patch early | 4.3 medium | 5.8% | 2008-01-11 |
| CVE-2005-1105 EXP | Directory traversal vulnerability in the MimeBodyPart.getFileName method in JavaMail 1.3.2 allows remote attackers to write arbitrary files via a .. (… | Patch early | 5.0 medium | 5.8% | 2005-05-02 |
| CVE-2010-1944 EXP | Multiple PHP remote file inclusion vulnerabilities in openMairie openCimetiere 2.01, when register_globals is enabled, allow remote attackers to execu… | Patch early | 6.8 medium | 5.8% | 2010-05-19 |
| CVE-2010-1946 EXP | Multiple PHP remote file inclusion vulnerabilities in openMairie Openregistrecil 1.02, when register_globals is enabled, allow remote attackers to exe… | Patch early | 6.8 medium | 5.8% | 2010-05-19 |
| CVE-2021-42565 EXP | myfactory.FMS before 7.1-912 allows XSS via the UID parameter. | Patch early | 6.1 medium | 5.8% | 2021-10-18 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt