CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
401,371 CVEs
1,734 on KEV
17,295 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-05
319,924 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2008-2138 EXP | Oracle Application Server (OracleAS) Portal 10g allows remote attackers to bypass intended access restrictions and read the contents of /dav_portal/po… | Patch early | 5.0 medium | 15.5% | 2008-05-12 |
| CVE-2019-1151 EXP | A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts. An attacker who succes… | Patch early | 8.8 high | 15.5% | 2019-08-14 |
| CVE-2002-1368 EXP | Common Unix Printing System (CUPS) 1.1.14 through 1.1.17 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary c… | Patch early | 7.5 high | 15.5% | 2002-12-26 |
| CVE-2003-0101 EXP | miniserv.pl in (1) Webmin before 1.070 and (2) Usermin before 1.000 does not properly handle metacharacters such as line feeds and carriage returns (C… | Patch early | 10.0 high | 15.5% | 2003-03-03 |
| CVE-2004-1423 EXP | Multiple PHP remote file inclusion vulnerabilities in Sean Proctor PHP-Calendar before 0.10.1, as used in Commonwealth of Massachusetts Virtual Law Of… | Patch early | 7.5 high | 15.5% | 2004-12-31 |
| CVE-2004-0935 EXP | Eset Anti-Virus before 1.020 (16th September 2004) allows remote attackers to bypass antivirus protection via a compressed file with both local and gl… | Patch early | 7.5 high | 15.5% | 2005-01-27 |
| CVE-2007-0103 EXP | The Adobe PDF specification 1.3, as implemented by Adobe Acrobat before 8.0.0, allows remote attackers to have an unknown impact, possibly including d… | Patch early | 6.8 medium | 15.5% | 2007-01-09 |
| CVE-2014-2069 EXP | Absolute path traversal vulnerability in Eshtery CMS allows remote attackers to read arbitrary files via a full pathname in the file parameter to File… | Patch early | 7.5 high | 15.4% | 2018-04-16 |
| CVE-2008-0175 EXP | Unrestricted file upload vulnerability in GE Fanuc Proficy Real-Time Information Portal 2.6 and earlier allows remote attackers to execute arbitrary c… | Patch early | 7.5 high | 15.4% | 2008-01-29 |
| CVE-2020-28977 EXP | The Canto plugin 1.3.0 for WordPress contains blind SSRF vulnerability. It allows an unauthenticated attacker can make a request to any internal and e… | Patch early | 5.3 medium | 15.4% | 2020-11-30 |
| CVE-2020-28978 EXP | The Canto plugin 1.3.0 for WordPress contains blind SSRF vulnerability. It allows an unauthenticated attacker can make a request to any internal and e… | Patch early | 5.3 medium | 15.4% | 2020-11-30 |
| CVE-2003-0870 EXP | Heap-based buffer overflow in Opera 7.11 and 7.20 allows remote attackers to execute arbitrary code via an HREF with a large number of escaped charact… | Patch early | 7.5 high | 15.4% | 2003-11-17 |
| CVE-2014-1778 EXP | Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary web script with increased privileges via unspecified vectors, ak… | Patch early | 6.8 medium | 15.4% | 2014-06-11 |
| CVE-2003-0845 EXP | Unknown vulnerability in the HSQLDB component in JBoss 3.2.1 and 3.0.8 on Java 1.4.x platforms, when running in the default configuration, allows remo… | Patch early | 7.5 high | 15.4% | 2003-11-17 |
| CVE-2007-2237 EXP | Microsoft Windows Graphics Device Interface (GDI+, GdiPlus.dll) allows context-dependent attackers to cause a denial of service (crash) via an ICO fil… | Patch early | 5.5 medium | 15.4% | 2007-06-06 |
| CVE-2012-3575 EXP | Unrestricted file upload vulnerability in uploader.php in the RBX Gallery plugin 2.1 for WordPress allows remote attackers to execute arbitrary code b… | Patch early | 10.0 high | 15.4% | 2012-06-16 |
| CVE-2018-8463 EXP | An elevation of privilege vulnerability exists in Microsoft Edge that could allow an attacker to escape from the AppContainer sandbox in the browser,… | Patch early | 7.4 high | 15.4% | 2018-09-13 |
| CVE-2018-8469 EXP | An elevation of privilege vulnerability exists in Microsoft Edge that could allow an attacker to escape from the AppContainer sandbox in the browser,… | Patch early | 7.4 high | 15.4% | 2018-09-13 |
| CVE-2017-9414 EXP | Cross-site request forgery (CSRF) vulnerability in the Subscribe to Podcast feature in Subsonic 6.1.1 allows remote attackers to hijack the authentica… | Patch early | 8.8 high | 15.4% | 2018-02-05 |
| CVE-2008-2841 EXP | Argument injection vulnerability in XChat 2.8.7b and earlier on Windows, when Internet Explorer is used, allows remote attackers to execute arbitrary… | Patch early | 6.8 medium | 15.4% | 2008-06-24 |
| CVE-2010-4719 EXP | Directory traversal vulnerability in JRadio (com_jradio) component before 1.5.1 for Joomla! allows remote attackers to read arbitrary files via direct… | Patch early | 7.5 high | 15.4% | 2011-02-01 |
| CVE-2018-20220 EXP | An issue was discovered on Teracue ENC-400 devices with firmware 2.56 and below. While the web interface requires authentication before it can be inte… | Patch early | 7.5 high | 15.4% | 2019-03-21 |
| CVE-2012-0677 EXP | Heap-based buffer overflow in Apple iTunes before 10.6.3 allows remote attackers to execute arbitrary code or cause a denial of service (application c… | Patch early | 9.3 high | 15.4% | 2012-06-12 |
| CVE-2010-3141 EXP | Untrusted search path vulnerability in Microsoft PowerPoint 2010 allows local users, and possibly remote attackers, to execute arbitrary code and cond… | Patch early | 9.3 high | 15.4% | 2010-08-27 |
| CVE-2007-1785 EXP | The RPC service in mediasvr.exe in CA BrightStor ARCserve Backup 11.5 SP2 build 4237 allows remote attackers to execute arbitrary code via crafted xdr… | Patch early | 7.1 high | 15.4% | 2007-03-31 |
| CVE-2009-3170 EXP | Stack-based buffer overflow in AIMP2 Audio Converter 2.53 (build 330) and earlier allows remote attackers to cause a denial of service (crash) or poss… | Patch early | 9.3 high | 15.4% | 2009-09-11 |
| CVE-2012-4886 EXP | Stack-based buffer overflow in wpsio.dll in Kingsoft WPS Office 2012 possibly 8.1.0.3238 allows remote attackers to execute arbitrary code via a long… | Patch early | 10.0 high | 15.3% | 2014-03-24 |
| CVE-2017-1084 EXP | In FreeBSD before 11.2-RELEASE, multiple issues with the implementation of the stack guard-page reduce the protections afforded by the guard-page. Thi… | Patch early | 7.5 high | 15.3% | 2018-09-12 |
| CVE-2005-2943 EXP | Stack-based buffer overflow in sendmail in XMail before 1.22 allows remote attackers to execute arbitrary code via a long -t command line option. | Patch early | 7.5 high | 15.3% | 2005-10-13 |
| CVE-2010-1535 EXP | Directory traversal vulnerability in the TRAVELbook (com_travelbook) component 1.0.1 for Joomla! allows remote attackers to read arbitrary files and p… | Patch early | 7.5 high | 15.3% | 2010-04-26 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt