CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
401,317 CVEs
1,734 on KEV
17,292 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-05
149,818 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2008-5183 EXP | cupsd in CUPS 1.3.9 and earlier allows local users, and possibly remote attackers, to cause a denial of service (daemon crash) by adding a large numbe… | Patch early | 7.5 high | 9.2% | 2008-11-21 |
| CVE-2008-4101 EXP | Vim 3.0 through 7.x before 7.2.010 does not properly escape characters, which allows user-assisted attackers to (1) execute arbitrary shell commands b… | Patch early | 9.3 high | 9.2% | 2008-09-18 |
| CVE-2015-5895 EXP | Multiple unspecified vulnerabilities in SQLite before 3.8.10.2, as used in Apple iOS before 9, have unknown impact and attack vectors. | Patch early | 10.0 high | 9.2% | 2015-09-18 |
| CVE-2011-1519 EXP | The remote console in the Server Controller in IBM Lotus Domino 7.x and 8.x verifies credentials against a file located at a UNC share pathname specif… | Patch early | 10.0 high | 9.2% | 2011-03-25 |
| CVE-2018-6092 EXP | An integer overflow on 32-bit systems in WebAssembly in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code insid… | Patch early | 8.8 high | 9.2% | 2018-12-04 |
| CVE-2022-26982 EXP | SimpleMachinesForum 2.1.1 and earlier allows remote authenticated administrators to execute arbitrary code by inserting a vulnerable php code because… | Patch early | 7.2 high | 9.2% | 2022-04-05 |
| CVE-2014-7226 EXP | The file comment feature in Rejetto HTTP File Server (hfs) 2.3c and earlier allows remote attackers to execute arbitrary code by uploading a file with… | Patch early | 7.5 high | 9.2% | 2014-10-10 |
| CVE-2021-46360 EXP | Authenticated remote code execution (RCE) in Composr-CMS 10.0.39 and earlier allows remote attackers to execute arbitrary code via uploading a PHP she… | Patch early | 8.8 high | 9.2% | 2022-02-09 |
| CVE-2011-2194 EXP | Integer overflow in the XSPF playlist parser in VideoLAN VLC media player 0.8.5 through 1.1.9 allows remote attackers to cause a denial of service (cr… | Patch early | 9.3 high | 9.2% | 2011-06-24 |
| CVE-2014-5112 EXP | maint/modules/home/index.php in Fonality trixbox allows remote attackers to execute arbitrary commands via shell metacharacters in the lang parameter. | Patch early | 7.5 high | 9.2% | 2014-07-28 |
| CVE-2007-4816 EXP | Multiple buffer overflows in the BaoFeng2 storm ActiveX control in Mps.dll allow remote attackers to have an unknown impact via a long (1) URL, (2) ba… | Patch early | 7.5 high | 9.2% | 2007-09-11 |
| CVE-2004-2496 EXP | The HTTP daemon in OpenText FirstClass 7.1 and 8.0 allows remote attackers to cause a denial of service (service availability loss) via a large number… | Patch early | 7.8 high | 9.2% | 2004-12-31 |
| CVE-2002-0652 EXP | xfsmd for IRIX 6.5 through 6.5.16 allows remote attackers to execute arbitrary code via shell metacharacters that are not properly filtered from sever… | Patch early | 7.5 high | 9.1% | 2002-07-03 |
| CVE-2007-6276 EXP | The accept_connections function in the virtual private network daemon (vpnd) in Apple Mac OS X 10.5 before 10.5.4 allows remote attackers to cause a d… | Patch early | 7.8 high | 9.1% | 2007-12-07 |
| CVE-2017-15662 EXP | In Flexense VX Search Enterprise v10.1.12, the Control Protocol suffers from a denial of service vulnerability. The attack vector is a crafted SERVER_… | Patch early | 7.5 high | 9.1% | 2018-01-10 |
| CVE-2017-15664 EXP | In Flexense Sync Breeze Enterprise v10.1.16, the Control Protocol suffers from a denial of service vulnerability. The attack vector is a crafted SERVE… | Patch early | 7.5 high | 9.1% | 2018-01-10 |
| CVE-2017-15665 EXP | In Flexense DiskBoss Enterprise 8.5.12, the Control Protocol suffers from a denial of service vulnerability. The attack vector is a crafted SERVER_GET… | Patch early | 7.5 high | 9.1% | 2018-01-10 |
| CVE-2014-8997 EXP | Unrestricted file upload vulnerability in the Photo functionality in DigitalVidhya Digi Online Examination System 2.0 allows remote attackers to execu… | Patch early | 7.5 high | 9.1% | 2014-11-20 |
| CVE-2017-13713 EXP | T&W WIFI Repeater BE126 allows remote authenticated users to execute arbitrary code via shell metacharacters in the user parameter to cgi-bin/webupg. | Patch early | 8.8 high | 9.1% | 2017-09-07 |
| CVE-2008-7005 EXP | include/modules/top/1-random_quote.php in Minb Is Not a Blog (minb) 0.1.0 allows remote attackers to execute arbitrary PHP code via the quotes_to_edit… | Patch early | 7.5 high | 9.1% | 2009-08-19 |
| CVE-2004-1264 EXP | Buffer overflow in the simplify_path function in config.c for ChBg 1.5 allows remote attackers to execute arbitrary code via a crafted chbg scenario f… | Patch early | 10.0 high | 9.1% | 2005-01-10 |
| CVE-2004-1282 EXP | Buffer overflow in the strexpand function in string.c for LinPopUp 1.2.0 allows remote attackers to execute arbitrary code via a crafted message that… | Patch early | 10.0 high | 9.1% | 2005-01-10 |
| CVE-2004-1300 EXP | Buffer overflow in the open_aiff_file function in demux_aiff.c for xine-lib (libxine) 1-rc7 allows remote attackers to execute arbitrary code via a cr… | Patch early | 10.0 high | 9.1% | 2005-01-10 |
| CVE-2005-4211 EXP | PHP remote file inclusion vulnerability in coin_includes/db.php in phpCOIN 1.2.2 allows remote attackers to execute arbitrary PHP code via a URL in th… | Patch early | 7.5 high | 9.1% | 2005-12-14 |
| CVE-2013-4096 EXP | ServerAdmin/TestTelnetConnection.jsp in DS3 Authentication Server allows remote authenticated users to execute arbitrary commands via shell metacharac… | Patch early | 9.0 high | 9.1% | 2013-06-28 |
| CVE-2019-5788 EXP | An integer overflow that leads to a use-after-free in Blink Storage in Google Chrome on Linux prior to 73.0.3683.75 allowed a remote attacker who had… | Patch early | 8.8 high | 9.1% | 2019-05-23 |
| CVE-1999-0041 EXP | Buffer overflow in NLS (Natural Language Service). | Patch early | 7.5 high | 9.1% | 1997-02-13 |
| CVE-2009-0813 EXP | Insecure method vulnerability in the ImeraIEPlugin ActiveX control (ImeraIEPlugin.dll 1.0.2.54) in Imera TeamLinks Client allows remote attackers to f… | Patch early | 9.3 high | 9.1% | 2009-03-05 |
| CVE-2002-0813 EXP | Heap-based buffer overflow in the TFTP server capability in Cisco IOS 11.1, 11.2, and 11.3 allows remote attackers to cause a denial of service (reset… | Patch early | 7.1 high | 9.1% | 2002-08-12 |
| CVE-1999-0219 EXP | Buffer overflow in FTP Serv-U 2.5 allows remote authenticated users to cause a denial of service (crash) via a long (1) CWD or (2) LS (list) command. | Patch early | 7.8 high | 9.1% | 1997-07-01 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt