CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
401,178 CVEs
1,734 on KEV
17,292 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-05
401,178 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2004-0558 EXP | The Internet Printing Protocol (IPP) implementation in CUPS before 1.1.21 allows remote attackers to cause a denial of service (service hang) via a ce… | Patch early | 5.0 medium | 26.8% | 2004-09-28 |
| CVE-2020-11819 EXP | In Rukovoditel 2.5.2, an attacker may inject an arbitrary .php file location instead of a language file and thus achieve command execution. | Patch early | 9.8 critical | 26.8% | 2020-04-16 |
| CVE-2009-0026 EXP | Multiple cross-site scripting (XSS) vulnerabilities in Apache Jackrabbit before 1.5.2 allow remote attackers to inject arbitrary web script or HTML vi… | Patch early | 4.3 medium | 26.8% | 2009-01-21 |
| CVE-2015-2166 EXP | Directory traversal vulnerability in the Instance Monitor in Ericsson Drutt Mobile Service Delivery Platform (MSDP) 4, 5, and 6 allows remote attacker… | Patch early | 5.0 medium | 26.8% | 2015-04-06 |
| CVE-2001-0148 EXP | The WMP ActiveX Control in Windows Media Player 7 allows remote attackers to execute commands in Internet Explorer via javascript URLs, a variant of t… | Patch early | 7.5 high | 26.8% | 2001-06-02 |
| CVE-2009-2727 EXP | Stack-based buffer overflow in the _tt_internal_realpath function in the ToolTalk library (libtt.a) in IBM AIX 5.2.0, 5.3.0, 5.3.7 through 5.3.10, and… | Patch early | 9.3 high | 26.7% | 2009-08-10 |
| CVE-2011-1999 EXP | Microsoft Internet Explorer 8 does not properly allocate and access memory, which allows remote attackers to execute arbitrary code via vectors involv… | Patch early | 9.3 high | 26.7% | 2011-10-12 |
| CVE-2008-4029 EXP | Cross-domain vulnerability in Microsoft XML Core Services 3.0 and 4.0, as used in Internet Explorer, allows remote attackers to obtain sensitive infor… | Patch early | 4.3 medium | 26.7% | 2008-11-12 |
| CVE-2011-4535 EXP | Buffer overflow in TurboPower Abbrevia before 4.0, as used in ScadaTEC ScadaPhone 5.3.11.1230 and earlier, ScadaTEC ModbusTagServer 4.1.1.81 and earli… | Patch early | 6.8 medium | 26.7% | 2012-04-03 |
| CVE-2017-8295 EXP | WordPress through 4.7.4 relies on the Host HTTP header for a password-reset e-mail message, which makes it easier for remote attackers to reset arbitr… | Patch early | 5.9 medium | 26.7% | 2017-05-04 |
| CVE-2020-9375 EXP | TP-Link Archer C50 V3 devices before Build 200318 Rel. 62209 allows remote attackers to cause a denial of service via a crafted HTTP Header containing… | Patch early | 7.5 high | 26.7% | 2020-03-25 |
| CVE-2002-0980 EXP | The Web Folder component for Internet Explorer 5.5 and 6.0 writes an error message to a known location in the temporary folder, which allows remote at… | Patch early | 7.5 high | 26.7% | 2002-09-24 |
| CVE-1999-0021 EXP | Arbitrary command execution via buffer overflow in Count.cgi (wwwcount) cgi-bin program. | Patch early | 7.5 high | 26.7% | 1997-11-05 |
| CVE-2011-4044 EXP | An unspecified ActiveX control in SVUIGrd.ocx in ARC Informatique PcVue 6.0 through 10.0, FrontVue, and PlantVue allows remote attackers to modify fil… | Patch early | 5.8 medium | 26.7% | 2012-04-03 |
| CVE-2013-0108 EXP | An ActiveX control in HscRemoteDeploy.dll in Honeywell Enterprise Buildings Integrator (EBI) R310, R400.2, R410.1, and R410.2; SymmetrE R310, R410.1,… | Patch early | 6.8 medium | 26.6% | 2013-02-24 |
| CVE-2010-0265 EXP | Buffer overflow in Microsoft Windows Movie Maker 2.1, 2.6, and 6.0, and Microsoft Producer 2003, allows remote attackers to execute arbitrary code via… | Patch early | 9.3 high | 26.6% | 2010-03-10 |
| CVE-2016-6255 EXP | Portable UPnP SDK (aka libupnp) before 1.6.21 allows remote attackers to write to arbitrary files in the webroot via a POST request without a register… | Patch early | 7.5 high | 26.6% | 2017-03-07 |
| CVE-2017-15647 EXP | On FiberHome routers, Directory Traversal exists in /cgi-bin/webproc via the getpage parameter in conjunction with a crafted var:page value. | Patch early | 7.5 high | 26.6% | 2017-10-19 |
| CVE-2013-2570 EXP | A Command Injection vulnerability exists in Zavio IP Cameras through 1.6.3 in the General.Time.NTP.Server parameter to the sub_C8C8 function of the bi… | Patch early | 9.8 critical | 26.6% | 2020-01-29 |
| CVE-2008-1682 EXP | PHP remote file inclusion vulnerability in quiz/common/db_config.inc.php in the Online FlashQuiz (com_onlineflashquiz) 1.0.2 component for Joomla! all… | Patch early | 6.8 medium | 26.6% | 2008-04-04 |
| CVE-2008-1773 EXP | PHP remote file inclusion vulnerability in includes/header.inc.php in Dragoon 0.1 allows remote attackers to execute arbitrary PHP code via a URL in t… | Patch early | 6.8 medium | 26.6% | 2008-04-14 |
| CVE-2008-1776 EXP | PHP remote file inclusion vulnerability in modules/basicfog/basicfogfactory.class.php in PhpBlock A8.4 allows remote attackers to execute arbitrary PH… | Patch early | 6.8 medium | 26.6% | 2008-04-14 |
| CVE-2013-6225 EXP | LiveZilla 5.0.1.4 has a Remote Code Execution vulnerability | Patch early | 9.8 critical | 26.6% | 2020-01-13 |
| CVE-2007-3763 EXP | The IAX2 channel driver (chan_iax2) in Asterisk before 1.2.22 and 1.4.x before 1.4.8, Business Edition before B.2.2.1, AsteriskNOW before beta7, Appli… | Patch early | 5.0 medium | 26.6% | 2007-07-18 |
| CVE-2011-2003 EXP | Buffer overflow in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Serv… | Patch early | 9.3 high | 26.6% | 2011-10-12 |
| CVE-2018-8733 EXP | Authentication bypass vulnerability in the core config manager in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an unauthenticated attacker to ma… | Patch early | 9.8 critical | 26.6% | 2018-04-18 |
| CVE-2020-5515 EXP | Gila CMS 1.11.8 allows /admin/sql?query= SQL Injection. | Patch early | 7.2 high | 26.5% | 2020-01-06 |
| CVE-2015-3134 EXP | Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18… | Patch early | 10.0 high | 26.5% | 2015-07-09 |
| CVE-2006-6311 EXP | Microsoft Internet Explorer 6.0.2900.2180 allows remote attackers to cause a denial of service via a style attribute in an HTML table tag with a width… | Patch early | 5.0 medium | 26.5% | 2006-12-06 |
| CVE-2008-6938 EXP | Pi3Web 2.0.3 before PL2, when installed on Windows as a desktop application and without using the Pi3Web/Conf/Intenet.pi3, allows remote attackers to… | Patch early | 4.3 medium | 26.5% | 2009-08-11 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt