CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
401,371 CVEs
1,734 on KEV
17,295 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-05
149,835 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2007-2947 EXP | Multiple PHP remote file inclusion vulnerabilities in OpenBASE Alpha 0.6 allow remote attackers to execute arbitrary PHP code via a URL in the root_pr… | Patch early | 7.5 high | 9% | 2007-05-31 |
| CVE-2007-3297 EXP | Multiple PHP remote file inclusion vulnerabilities in Musoo 0.21 allow remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[ini_arr… | Patch early | 7.5 high | 9% | 2007-06-20 |
| CVE-2006-3144 EXP | PHP remote file inclusion vulnerability in micro_cms_files/microcms-include.php in Implied By Design (IBD) Micro CMS 3.5 (aka 0.3.5) and earlier allow… | Patch early | 7.5 high | 9% | 2006-06-22 |
| CVE-2013-1436 EXP | The XMonad.Hooks.DynamicLog module in xmonad-contrib before 0.11.2 allows remote attackers to execute arbitrary commands via a web page title, which a… | Patch early | 7.5 high | 9% | 2014-10-06 |
| CVE-2013-2118 EXP | SPIP 3.0.x before 3.0.9, 2.1.x before 2.1.22, and 2.0.x before 2.0.23 allows remote attackers to gain privileges and "take editorial control" via vect… | Patch early | 7.5 high | 9% | 2013-07-09 |
| CVE-2016-9315 EXP | Privilege Escalation Vulnerability in com.trend.iwss.gui.servlet.updateaccountadministration in Trend Micro InterScan Web Security Virtual Appliance (… | Patch early | 8.8 high | 9% | 2017-02-21 |
| CVE-2008-4769 EXP | Directory traversal vulnerability in the get_category_template function in wp-includes/theme.php in WordPress 2.3.3 and earlier, and 2.5, allows remot… | Patch early | 9.3 high | 9% | 2008-10-28 |
| CVE-2012-2276 EXP | The IRM Server in EMC Documentum Information Rights Management 4.x before 4.7.0100 and 5.x before 5.0.1030 allows remote attackers to cause a denial o… | Patch early | 7.8 high | 9% | 2012-05-14 |
| CVE-2019-6224 EXP | A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 12.1.3, macOS Mojave 10.14.3, tvOS 12.1.2, watchOS 5.1… | Patch early | 8.8 high | 9% | 2019-03-05 |
| CVE-2013-4985 EXP | Multiple Vivotek IP Cameras remote authentication bypass that could allow access to the video stream | Patch early | 7.5 high | 9% | 2019-12-27 |
| CVE-2018-4218 EXP | An issue was discovered in certain Apple products. iOS before 11.4 is affected. Safari before 11.1.1 is affected. iCloud before 7.5 on Windows is affe… | Patch early | 8.8 high | 9% | 2018-06-08 |
| CVE-2021-44673 EXP | A Remote Code Execution (RCE) vulnerability exists in Croogo 3.0.2via admin/file-manager/attachments, which lets a malicoius user upload a web shell s… | Patch early | 8.8 high | 9% | 2022-03-10 |
| CVE-2025-27533 EXP | Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ. During unmarshalling of OpenWire commands the size value of buffers was… | Patch early | 7.5 high | 9% | 2025-05-07 |
| CVE-2004-0409 EXP | Stack-based buffer overflow in the Socks-5 proxy code for XChat 1.8.0 to 2.0.8, with socks5 traversal enabled, allows remote attackers to execute arbi… | Patch early | 7.5 high | 9% | 2004-06-01 |
| CVE-2007-3336 EXP | Multiple "pointer overwrite" vulnerabilities in Ingres database server 2006 9.0.4, r3, 2.6, and 2.5, as used in multiple CA (formerly Computer Associa… | Patch early | 10.0 high | 9% | 2007-06-22 |
| CVE-2010-1840 EXP | Stack-based buffer overflow in the password-validation functionality in Directory Services in Apple Mac OS X 10.5.8 and 10.6.x before 10.6.5 allows re… | Patch early | 7.5 high | 9% | 2010-11-15 |
| CVE-2009-2817 EXP | Buffer overflow in Apple iTunes before 9.0.1 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a… | Patch early | 9.3 high | 8.9% | 2009-09-24 |
| CVE-1999-0985 EXP | CC Whois program whois.cgi allows remote attackers to execute commands via shell metacharacters in the domain entry. | Patch early | 7.5 high | 8.9% | 1999-11-09 |
| CVE-2012-1010 EXP | Unrestricted file upload vulnerability in actions.php in the AllWebMenus plugin before 1.1.8 for WordPress allows remote attackers to execute arbitrar… | Patch early | 7.5 high | 8.9% | 2012-02-07 |
| CVE-2021-41382 EXP | Plastic SCM before 10.0.16.5622 mishandles the WebAdmin server management interface. | Patch early | 7.5 high | 8.9% | 2021-09-22 |
| CVE-2000-0017 EXP | Buffer overflow in Linux linuxconf package allows remote attackers to gain root privileges via a long parameter. | Patch early | 10.0 high | 8.9% | 1999-12-21 |
| CVE-2007-2363 EXP | Buffer overflow in IrfanView 4.00 and earlier allows user-assisted remote attackers to execute arbitrary code via a crafted .IFF file. | Patch early | 8.5 high | 8.9% | 2007-04-30 |
| CVE-2013-3541 EXP | Directory traversal vulnerability in cgi-bin/admin/fileread in AirLive WL2600CAM and possibly other camera models allows remote attackers to read arbi… | Patch early | 7.8 high | 8.9% | 2013-10-04 |
| CVE-2018-5954 EXP | phpFreeChat 1.7 and earlier allows remote attackers to cause a denial of service by sending a large number of connect commands. | Patch early | 7.5 high | 8.9% | 2018-01-25 |
| CVE-2017-15644 EXP | SSRF exists in Webmin 1.850 via the PATH_INFO to tunnel/link.cgi, as demonstrated by a GET request for tunnel/link.cgi/http://INTRANET-IP:8000. | Patch early | 8.6 high | 8.9% | 2017-10-19 |
| CVE-2010-2045 EXP | Directory traversal vulnerability in the Dione Form Wizard (aka FDione or com_dioneformwizard) component 1.0.2 for Joomla! allows remote attackers to… | Patch early | 7.5 high | 8.9% | 2010-05-25 |
| CVE-2013-6830 EXP | admin/confnetworking.html in PineApp Mail-SeCure 3.70 and earlier on 5099SK and earlier platforms allows remote attackers to execute arbitrary command… | Patch early | 7.5 high | 8.9% | 2013-11-20 |
| CVE-2019-2107 EXP | In ihevcd_parse_pps of ihevcd_parse_headers.c, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code e… | Patch early | 8.8 high | 8.9% | 2019-07-08 |
| CVE-2007-4338 EXP | index.php in Ryan Haudenschilt Family Connections (FCMS) before 0.9 allows remote attackers to access an arbitrary account by placing the account's na… | Patch early | 10.0 high | 8.9% | 2007-08-14 |
| CVE-2010-2300 EXP | Use-after-free vulnerability in the Element::normalizeAttributes function in dom/Element.cpp in WebCore in WebKit in Google Chrome before 5.0.375.70 a… | Patch early | 10.0 high | 8.9% | 2010-06-15 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt