CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
401,522 CVEs
1,734 on KEV
17,295 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-05
320,025 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2010-2089 EXP | The audioop module in Python 2.7 and 3.2 does not verify the relationships between size arguments and byte string lengths, which allows context-depend… | Patch early | 5.0 medium | 14.6% | 2010-05-27 |
| CVE-2007-5728 EXP | Cross-site scripting (XSS) vulnerability in phpPgAdmin 3.5 to 4.1.1, and possibly 4.1.2, allows remote attackers to inject arbitrary web script or HTM… | Patch early | 4.3 medium | 14.6% | 2007-10-30 |
| CVE-2004-1120 EXP | Multiple buffer overflows in (1) http.c, (2) http-retr.c, (3) main.c and other code that handles network protocols in ProZilla 1.3.6-r2 and earlier al… | Patch early | 10.0 high | 14.6% | 2005-01-10 |
| CVE-2009-2692 EXP | The Linux kernel 2.6.0 through 2.6.30.4, and 2.4.4 through 2.4.37.4, does not initialize all function pointers for socket operations in proto_ops stru… | Patch early | 7.8 high | 14.6% | 2009-08-14 |
| CVE-2009-3663 EXP | Format string vulnerability in the h_readrequest function in http.c in httpdx Web Server 1.4 allows remote attackers to cause a denial of service (cra… | Patch early | 10.0 high | 14.6% | 2009-10-11 |
| CVE-2017-3528 EXP | Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (lists of values, datepicker, etc… | Patch early | 5.4 medium | 14.6% | 2017-04-24 |
| CVE-2010-5300 EXP | Stack-based buffer overflow in Jzip 1.3 through 2.0.0.132900 allows remote attackers to cause a denial of service (crash) and possibly execute arbitra… | Patch early | 6.8 medium | 14.6% | 2014-06-11 |
| CVE-2004-1127 EXP | Buffer overflow in Open Dc Hub 0.7.14 allows remote attackers, with administrator privileges, to execute arbitrary code via a long RedirectAll command… | Patch early | 10.0 high | 14.6% | 2005-01-10 |
| CVE-2006-6125 EXP | Heap-based buffer overflow in the wireless driver (WG311ND5.SYS) 2.3.1.10 for NetGear WG311v1 wireless adapter allows remote attackers to execute arbi… | Patch early | 7.5 high | 14.6% | 2006-11-27 |
| CVE-2006-3199 EXP | Opera 9 allows remote attackers to cause a denial of service (crash) via an A tag with an href attribute with a URL containing a long hostname, which… | Patch early | 5.0 medium | 14.6% | 2006-06-23 |
| CVE-2010-1081 EXP | Directory traversal vulnerability in the Community Polls (com_communitypolls) component 1.5.2, and possibly earlier, for Core Joomla! allows remote at… | Patch early | 5.0 medium | 14.6% | 2010-03-23 |
| CVE-2006-5220 EXP | Multiple PHP remote file inclusion vulnerabilities in WebYep 1.1.9, when register_globals is enabled, allow remote attackers to execute arbitrary PHP… | Patch early | 5.1 medium | 14.6% | 2006-10-10 |
| CVE-2001-0050 EXP | Buffer overflow in BitchX IRC client allows remote attackers to cause a denial of service and possibly execute arbitrary commands via an IP address th… | Patch early | 10.0 high | 14.6% | 2001-02-16 |
| CVE-2008-0296 EXP | Heap-based buffer overflow in the libaccess_realrtsp plugin in VideoLAN VLC Media Player 0.8.6d and earlier on Windows might allow remote RTSP servers… | Patch early | 10.0 high | 14.6% | 2008-01-16 |
| CVE-2013-2567 EXP | An Authentication Bypass vulnerability exists in the web interface in Zavio IP Cameras through 1.6.03 due to a hardcoded admin account found in boa.co… | Patch early | 7.5 high | 14.6% | 2020-01-29 |
| CVE-2006-3890 EXP | Stack-based buffer overflow in the Sky Software FileView ActiveX control, as used in WinZip 10 before build 7245 and in certain other applications, al… | Patch early | 9.3 high | 14.6% | 2006-11-21 |
| CVE-2005-2878 EXP | Format string vulnerability in search.c in the imap4d server in GNU Mailutils 0.6 allows remote authenticated users to execute arbitrary code via form… | Patch early | 7.5 high | 14.6% | 2005-09-13 |
| CVE-2017-11152 EXP | Directory traversal vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to write… | Patch early | 7.5 high | 14.6% | 2017-08-08 |
| CVE-2010-2743 EXP | The kernel-mode drivers in Microsoft Windows XP SP3 do not properly perform indexing of a function-pointer table during the loading of keyboard layout… | Patch early | 7.2 high | 14.6% | 2011-01-20 |
| CVE-2024-46987 EXP | Camaleon CMS is a dynamic and advanced content management system based on Ruby on Rails. A path traversal vulnerability accessible via MediaController… | Patch early | 7.7 high | 14.6% | 2024-09-18 |
| CVE-2001-0233 EXP | Buffer overflow in micq client 0.4.6 and earlier allows remote attackers to cause a denial of service, and possibly execute arbitrary commands, via a… | Patch early | 10.0 high | 14.6% | 2001-03-26 |
| CVE-2018-20219 EXP | An issue was discovered on Teracue ENC-400 devices with firmware 2.56 and below. After successful authentication, the device sends an authentication c… | Patch early | 8.1 high | 14.6% | 2019-03-21 |
| CVE-2020-24223 EXP | Mara CMS 7.5 allows cross-site scripting (XSS) in contact.php via the theme or pagetheme parameters. | Patch early | 6.1 medium | 14.6% | 2020-08-30 |
| CVE-2004-1627 EXP | Buffer overflow in Ability Server 2.25, 2.32, 2.34, and possibly other versions, allows remote attackers to execute arbitrary code via a long APPE com… | Patch early | 7.5 high | 14.5% | 2004-10-22 |
| CVE-2023-5702 EXP | A vulnerability was found in Viessmann Vitogate 300 up to 2.1.3.0 and classified as problematic. Affected by this issue is some unknown functionality… | Patch early | 4.3 medium | 14.5% | 2023-10-23 |
| CVE-2019-9649 EXP | An issue was discovered in the SFTP Server component in Core FTP 2.0 Build 674. Using the MDTM FTP command, a remote attacker can use a directory trav… | Patch early | 5.3 medium | 14.5% | 2019-03-22 |
| CVE-2006-5567 EXP | Multiple heap-based buffer overflows in AOL Nullsoft WinAmp before 5.31 allow user-assisted remote attackers to execute arbitrary code via a crafted (… | Patch early | 9.3 high | 14.5% | 2006-10-27 |
| CVE-2008-0339 EXP | Unspecified vulnerability in the XML DB component in Oracle Database 9.2.0.8, 9.2.0.8DV, 10.1.0.5, and 10.2.0.3 has unknown impact and remote attack v… | Patch early | 10.0 high | 14.5% | 2008-01-17 |
| CVE-2006-2667 EXP | Direct static code injection vulnerability in WordPress 2.0.2 and earlier allows remote attackers to execute arbitrary commands by inserting a carriag… | Patch early | 7.5 high | 14.5% | 2006-05-30 |
| CVE-2005-1306 EXP | The Adobe Reader control in Adobe Reader and Acrobat 7.0 and 7.0.1 allows remote attackers to determine the existence of files via Javascript containi… | Patch early | 7.5 high | 14.5% | 2005-06-15 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt