CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
401,289 CVEs
1,734 on KEV
17,292 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-05
186,517 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2004-1018 EXP | Multiple integer handling errors in PHP before 4.3.10 allow attackers to bypass safe mode restrictions, cause a denial of service, or execute arbitrar… | Patch early | 10.0 high | 16.2% | 2005-01-10 |
| CVE-2020-15956 EXP | ActiveMediaServer.exe in ACTi NVR3 Standard Server 3.0.12.42 allows remote unauthenticated attackers to trigger a buffer overflow and application term… | Patch early | 7.5 high | 16.2% | 2020-08-04 |
| CVE-2008-0748 EXP | Buffer overflow in the Sony AxRUploadServer.AxRUploadControl.1 ActiveX control in AxRUploadServer.dll 1.0.0.38 in SonyISUpload.cab 1.0.0.38 for Sony I… | Patch early | 10.0 high | 16.2% | 2008-02-13 |
| CVE-2007-0656 EXP | PHP remote file inclusion vulnerability in includes/functions.php in phpBB2-MODificat 0.2.0 and earlier allows remote attackers to execute arbitrary P… | Patch early | 7.5 high | 16.2% | 2007-02-01 |
| CVE-2010-1471 EXP | Directory traversal vulnerability in the AddressBook (com_addressbook) component 1.5.0 for Joomla! allows remote attackers to read arbitrary files via… | Patch early | 7.5 high | 16.2% | 2010-04-19 |
| CVE-2010-1953 EXP | Directory traversal vulnerability in the iNetLanka Multiple Map (com_multimap) component 1.0 for Joomla! allows remote attackers to read arbitrary fil… | Patch early | 7.5 high | 16.2% | 2010-05-19 |
| CVE-2010-1954 EXP | Directory traversal vulnerability in the iNetLanka Multiple root (com_multiroot) component 1.0 and 1.1 for Joomla! allows remote attackers to read arb… | Patch early | 7.5 high | 16.2% | 2010-05-19 |
| CVE-2017-7981 EXP | Tuleap before 9.7 allows command injection via the PhpWiki 1.3.10 SyntaxHighlighter plugin. This occurs in the Project Wiki component because the proc… | Patch early | 8.8 high | 16.1% | 2017-04-29 |
| CVE-2002-1809 EXP | The default configuration of the Windows binary release of MySQL 3.23.2 through 3.23.52 has a NULL root password, which could allow remote attackers t… | Patch early | 7.5 high | 16.1% | 2002-12-31 |
| CVE-2019-8375 EXP | The UIProcess subsystem in WebKit, as used in WebKitGTK through 2.23.90 and WebKitGTK+ through 2.22.6 and other products, does not prevent the script… | Patch early | 9.8 critical | 16.1% | 2019-02-24 |
| CVE-2001-1067 EXP | Buffer overflow in AOLserver 3.0 allows remote attackers to cause a denial of service, and possibly execute arbitrary code, via an HTTP request with a… | Patch early | 10.0 high | 16.1% | 2001-08-31 |
| CVE-2006-0230 EXP | Symantec Scan Engine 5.0.0.24, and possibly other versions before 5.1.0.7, uses a client-side check to verify a password, which allows remote attacker… | Patch early | 10.0 high | 16.1% | 2006-04-25 |
| CVE-2010-1929 EXP | Multiple stack-based buffer overflows in the jclient._Java_novell_jclient_JClient_defineClass@20 function in jclient.dll in the Tomcat web server in N… | Patch early | 9.0 high | 16.1% | 2010-06-28 |
| CVE-2013-7137 EXP | The "remember me" functionality in login.php in Burden before 1.8.1 allows remote attackers to bypass authentication and gain privileges by setting th… | Patch early | 9.8 critical | 16.1% | 2014-01-26 |
| CVE-2006-5084 EXP | Format string vulnerability in the NSRunAlertPanel function in eBay Skype for Mac 1.5.*.79 and earlier allows remote attackers to cause a denial of se… | Patch early | 7.5 high | 16.1% | 2006-09-29 |
| CVE-2007-2362 EXP | Multiple buffer overflows in MyDNS 1.1.0 allow remote attackers to (1) cause a denial of service (daemon crash) and possibly execute arbitrary code vi… | Patch early | 9.0 high | 16.1% | 2007-04-30 |
| CVE-2008-2427 EXP | Stack-based buffer overflow in NConvert 4.92, GFL SDK 2.82, and XnView 1.93.6 on Windows and 1.70 on Linux and FreeBSD allows user-assisted remote att… | Patch early | 9.3 high | 16.1% | 2008-06-24 |
| CVE-2005-2103 EXP | Buffer overflow in the AIM and ICQ module in Gaim before 1.5.0 allows remote attackers to cause a denial of service (application crash) and possibly e… | Patch early | 9.8 critical | 16.1% | 2005-08-16 |
| CVE-2007-4938 EXP | Heap-based buffer overflow in libmpdemux/aviheader.c in MPlayer 1.0rc1 and earlier allows remote attackers to cause a denial of service (application c… | Patch early | 7.6 high | 16% | 2007-09-18 |
| CVE-2018-1247 EXP | RSA Authentication Manager Security Console, version 8.3 and earlier, contains a XML External Entity (XXE) vulnerability. This could potentially allow… | Patch early | 7.1 high | 16% | 2018-05-08 |
| CVE-2010-4231 EXP | Directory traversal vulnerability in the web-based administration interface on the Camtron CMNC-200 Full HD IP Camera and TecVoz CMNC-200 Megapixel IP… | Patch early | 7.8 high | 16% | 2010-11-17 |
| CVE-2015-8396 EXP | Integer overflow in the ImageRegionReader::ReadIntoBuffer function in MediaStorageAndFileFormat/gdcmImageRegionReader.cxx in Grassroots DICOM (aka GDC… | Patch early | 10.0 critical | 16% | 2016-01-12 |
| CVE-2001-0679 EXP | A buffer overflow in InterScan VirusWall 3.23 and 3.3 allows a remote attacker to execute arbitrary code by sending a long HELO command to the server. | Patch early | 10.0 high | 16% | 1999-11-08 |
| CVE-2018-15442 EXP | A vulnerability in the update service of Cisco Webex Meetings Desktop App for Windows could allow an authenticated, local attacker to execute arbitrar… | Patch early | 7.8 high | 16% | 2018-10-24 |
| CVE-2019-8045 EXP | Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015… | Patch early | 9.8 critical | 16% | 2019-08-20 |
| CVE-2009-0341 EXP | The shell32 module in Microsoft Internet Explorer 7.0 on Windows XP SP3 might allow remote attackers to execute arbitrary code via a long VALUE attrib… | Patch early | 9.3 high | 16% | 2009-01-29 |
| CVE-2017-12785 EXP | The novish command-line interface, included in the NoviWare software distribution through NW400.2.6 and deployed on NoviSwitch devices, is prone to a… | Patch early | 9.8 critical | 16% | 2017-08-22 |
| CVE-2004-1170 EXP | a2ps 4.13 allows remote attackers to execute arbitrary commands via shell metacharacters in the filename. | Patch early | 10.0 high | 16% | 2005-01-10 |
| CVE-2006-3468 EXP | Linux kernel 2.6.x, when using both NFS and EXT3, allows remote attackers to cause a denial of service (file system panic) via a crafted UDP packet wi… | Patch early | 7.8 high | 16% | 2006-07-21 |
| CVE-2020-23934 EXP | An issue was discovered in RiteCMS 2.2.1. An authenticated user can directly execute system commands by uploading a php web shell in the "Filemanager"… | Patch early | 8.8 high | 16% | 2020-08-18 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt