CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
401,317 CVEs
1,734 on KEV
17,295 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-05
149,818 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2007-6631 EXP | Multiple buffer overflows in LScube libnemesi 0.6.4-rc1 and earlier allow remote attackers to execute arbitrary code via (1) a reply that begins with… | Patch early | 7.5 high | 9.1% | 2008-01-04 |
| CVE-2009-4672 EXP | Directory traversal vulnerability in main.php in the WP-Lytebox plugin 1.3 for WordPress allows remote attackers to include and execute arbitrary loca… | Patch early | 7.5 high | 9.1% | 2010-03-05 |
| CVE-2007-1942 EXP | Integer overflow in FastStone Image Viewer 2.9 allows context-dependent attackers to cause a denial of service and possibly execute arbitrary code via… | Patch early | 9.3 high | 9.1% | 2007-04-11 |
| CVE-2007-1381 EXP | The wddx_deserialize function in wddx.c 1.119.2.10.2.12 and 1.119.2.10.2.13 in PHP 5, as modified in CVS on 20070224 and fixed on 20070304, calls strl… | Patch early | 7.6 high | 9.1% | 2007-03-10 |
| CVE-2012-2210 EXP | The Sony Bravia TV KDL-32CX525 allows remote attackers to cause a denial of service (configuration outage or device crash) via a flood of TCP SYN pack… | Patch early | 7.8 high | 9.1% | 2012-04-11 |
| CVE-1999-0262 EXP | Hylafax faxsurvey CGI script on Linux allows remote attackers to execute arbitrary commands via shell metacharacters in the query string. | Patch early | 7.5 high | 9.1% | 1998-08-04 |
| CVE-2018-10063 EXP | The Convert Forms extension before 2.0.4 for Joomla! is vulnerable to Remote Command Execution using CSV Injection that is mishandled when exporting a… | Patch early | 7.8 high | 9.1% | 2018-04-12 |
| CVE-2001-1502 EXP | webcart.cgi in Mountain Network Systems WebCart 8.4 allows remote attackers to execute arbitrary commands via shell metacharacters in the NEXTPAGE par… | Patch early | 7.5 high | 9.1% | 2001-12-31 |
| CVE-2003-0117 EXP | Buffer overflow in the HTTP receiver function (BizTalkHTTPReceive.dll ISAPI) of Microsoft BizTalk Server 2002 allows attackers to execute arbitrary co… | Patch early | 7.5 high | 9.1% | 2003-05-12 |
| CVE-2008-0690 EXP | SQL injection vulnerability in index.php in the mosDirectory (com_directory) 2.3.2 component for Joomla! allows remote attackers to execute arbitrary… | Patch early | 7.5 high | 9% | 2008-02-12 |
| CVE-2011-4876 EXP | Directory traversal vulnerability in HmiLoad in the runtime loader in Siemens WinCC flexible 2004, 2005, 2007, and 2008; WinCC V11 (aka TIA portal); t… | Patch early | 9.3 high | 9% | 2012-02-03 |
| CVE-2007-1397 EXP | Multiple stack-based buffer overflows in the (1) ExtractRnick and (2) decrypt_topic_332 functions in FiSH allow remote attackers to execute arbitrary… | Patch early | 10.0 high | 9% | 2007-03-10 |
| CVE-2012-1011 EXP | actions.php in the AllWebMenus plugin 1.1.8 for WordPress allows remote attackers to bypass intended access restrictions to upload and execute arbitra… | Patch early | 7.5 high | 9% | 2012-02-07 |
| CVE-2007-2771 EXP | Stack-based buffer overflow in the LEAD Technologies LeadTools JPEG 2000 LEADJ2K.LEADJ2K.140 ActiveX control (LTJ2K14.ocx) 14.5.0.35 allows remote att… | Patch early | 9.3 high | 9% | 2007-05-21 |
| CVE-2006-2909 EXP | Stack-based buffer overflow in the info tip shell extension (zipinfo.dll) in PicoZip 4.01 allows remote attackers to execute arbitrary code via a long… | Patch early | 7.5 high | 9% | 2006-06-16 |
| CVE-2019-5526 EXP | VMware Workstation (15.x before 15.1.0) contains a DLL hijacking issue because some DLL files are improperly loaded by the application. Successful exp… | Patch early | 7.8 high | 9% | 2019-05-15 |
| CVE-2003-0437 EXP | Buffer overflow in search.cgi for mnoGoSearch 3.2.10 allows remote attackers to execute arbitrary code via a long tmplt parameter. | Patch early | 7.5 high | 9% | 2003-07-24 |
| CVE-2015-5784 EXP | runner in Install.framework in the Install Framework Legacy component in Apple OS X before 10.10.5 does not properly drop privileges, which allows att… | Patch early | 9.3 high | 9% | 2015-08-17 |
| CVE-2008-3076 EXP | The Netrw plugin 125 in netrw.vim in Vim 7.2a.10 allows user-assisted attackers to execute arbitrary code via shell metacharacters in filenames used b… | Patch early | 9.3 high | 9% | 2009-02-21 |
| CVE-2011-4899 EXP | wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier does not ensure that the specified MySQL database service is ap… | Patch early | 7.5 high | 9% | 2012-01-30 |
| CVE-2004-0159 EXP | Format string vulnerability in hsftp 1.11 allows remote authenticated users to cause a denial of service and possibly execute arbitrary code via file… | Patch early | 7.5 high | 9% | 2004-03-15 |
| CVE-2007-1700 EXP | The session extension in PHP 4 before 4.4.5, and PHP 5 before 5.2.1, calculates the reference count for the session variables without considering the… | Patch early | 7.5 high | 9% | 2007-03-27 |
| CVE-2014-0007 EXP | The Smart-Proxy in Foreman before 1.4.5 and 1.5.x before 1.5.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the p… | Patch early | 7.5 high | 9% | 2014-06-20 |
| CVE-2007-1156 EXP | JBrowser allows remote attackers to bypass authentication and access certain administrative capabilities via a direct request for _admin/. | Patch early | 7.5 high | 9% | 2007-03-02 |
| CVE-2019-10849 EXP | Computrols CBAS 18.0.0 allows unprotected Subversion (SVN) directory / source code disclosure. | Patch early | 7.5 high | 9% | 2019-05-23 |
| CVE-2013-0742 EXP | Stack-based buffer overflow in Corel PDF Fusion 1.11 allows remote attackers to execute arbitrary code or cause a denial of service (application crash… | Patch early | 9.3 high | 9% | 2013-10-03 |
| CVE-2006-3175 EXP | Multiple PHP remote file inclusion vulnerabilities in mcGuestbook 1.3 allow remote attackers to execute arbitrary PHP code via a URL in the lang param… | Patch early | 7.5 high | 9% | 2006-06-23 |
| CVE-2001-0461 EXP | template.cgi in Free On-Line Dictionary of Computing (FOLDOC) allows remote attackers to read files and execute commands via shell metacharacters in t… | Patch early | 7.5 high | 9% | 2001-06-27 |
| CVE-2005-0892 EXP | Buffer overflow in smail 3.2.0.120 allows remote attackers or local users to execute arbitrary code via a long string in the MAIL FROM command and pos… | Patch early | 10.0 high | 9% | 2005-03-28 |
| CVE-2018-5359 EXP | The server in Flexense SysGauge 3.6.18 operating on port 9221 can be exploited remotely with the attacker gaining system-level access because of a Buf… | Patch early | 8.1 high | 9% | 2018-01-23 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt