CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
402,553 CVEs
1,734 on KEV
17,294 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-06
320,595 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2010-0944 EXP | Directory traversal vulnerability in the JCollection (com_jcollection) component for Joomla! allows remote attackers to read arbitrary files via a ..… | Patch early | 5.0 medium | 14% | 2010-03-08 |
| CVE-2010-1304 EXP | Directory traversal vulnerability in userstatus.php in the User Status (com_userstatus) component 1.21.16 for Joomla! allows remote attackers to read… | Patch early | 5.0 medium | 14% | 2010-04-08 |
| CVE-2015-2068 EXP | Multiple cross-site scripting (XSS) vulnerabilities in the MAGMI (aka Magento Mass Importer) plugin for Magento Server allow remote attackers to injec… | Patch early | 4.3 medium | 14% | 2015-02-24 |
| CVE-2010-3132 EXP | Untrusted search path vulnerability in Adobe Dreamweaver CS5 11.0 build 4916, build 4909, and probably other versions, allows local users, and possibl… | Patch early | 9.3 high | 14% | 2010-08-26 |
| CVE-2010-2891 EXP | Buffer overflow in the smiGetNode function in lib/smi.c in libsmi 0.4.8 allows context-dependent attackers to execute arbitrary code via an Object Ide… | Patch early | 7.5 high | 14% | 2010-10-28 |
| CVE-2018-4404 EXP | In iOS before 11.4 and macOS High Sierra before 10.13.5, a memory corruption issue exists and was addressed with improved memory handling. | Patch early | 8.8 high | 14% | 2019-01-11 |
| CVE-2015-2094 EXP | Stack-based buffer overflow in the WESPPlayback.WESPPlaybackCtrl.1 control in WebGate WinRDS allows remote attackers to execute arbitrary code via uns… | Patch early | 7.5 high | 14% | 2015-03-09 |
| CVE-2017-9353 EXP | In Wireshark 2.2.0 to 2.2.6, the IPv6 dissector could crash. This was addressed in epan/dissectors/packet-ipv6.c by validating an IPv6 address. | Patch early | 7.5 high | 14% | 2017-06-02 |
| CVE-2015-6176 EXP | Microsoft Edge mishandles HTML attributes in HTTP responses, which allows remote attackers to bypass a cross-site scripting (XSS) protection mechanism… | Patch early | 4.3 medium | 14% | 2015-12-09 |
| CVE-2010-1308 EXP | Directory traversal vulnerability in the SVMap (com_svmap) component 1.1.1 for Joomla! allows remote attackers to read arbitrary files via a .. (dot d… | Patch early | 5.0 medium | 14% | 2010-04-08 |
| CVE-2006-2557 EXP | PHP remote file inclusion vulnerability in extras/poll/poll.php in Florian Amrhein NewsPortal before 0.37, and TR Newsportal (TRanx rebuilded), allows… | Patch early | 6.4 medium | 14% | 2006-05-24 |
| CVE-2008-5551 EXP | The XSS Filter in Microsoft Internet Explorer 8.0 Beta 2 allows remote attackers to bypass the XSS protection mechanism and conduct XSS attacks by inj… | Patch early | 4.3 medium | 14% | 2008-12-12 |
| CVE-2009-1437 EXP | Stack-based buffer overflow in PortableApps CoolPlayer Portable (aka CoolPlayer+ Portable) 2.19.6 and earlier allows remote attackers to execute arbit… | Patch early | 9.3 high | 14% | 2009-04-27 |
| CVE-2004-1456 EXP | filediff in CVStrac allows remote attackers to execute arbitrary commands via shell metacharacters in rcsinfo. | Patch early | 7.5 high | 14% | 2004-12-31 |
| CVE-2007-4459 EXP | Cisco IP Phone 7940 and 7960 with P0S3-08-6-00 firmware, and other SIP firmware before 8.7(0), allows remote attackers to cause a denial of service (d… | Patch early | 7.1 high | 14% | 2007-08-21 |
| CVE-2011-0354 EXP | The default configuration of Cisco Tandberg C Series Endpoints, and Tandberg E and EX Personal Video units, with software before TC4.0.0 has a blank p… | Patch early | 10.0 high | 14% | 2011-02-03 |
| CVE-2010-1659 EXP | Directory traversal vulnerability in the Ultimate Portfolio (com_ultimateportfolio) component 1.0 for Joomla! allows remote attackers to read arbitrar… | Patch early | 5.0 medium | 14% | 2010-05-03 |
| CVE-2007-0444 EXP | Stack-based buffer overflow in the print provider library (cpprov.dll) in Citrix Presentation Server 4.0, MetaFrame Presentation Server 3.0, and MetaF… | Patch early | 7.2 high | 14% | 2007-01-24 |
| CVE-2015-2098 EXP | Multiple stack-based buffer overflows in WebGate eDVR Manager allow remote attackers to execute arbitrary code via unspecified vectors to the (1) Conn… | Patch early | 8.8 high | 14% | 2021-07-22 |
| CVE-2000-1112 EXP | Microsoft Windows Media Player 7 executes scripts in custom skin (.WMS) files, which could allow remote attackers to gain privileges via a skin that c… | Patch early | 4.6 medium | 14% | 2001-01-09 |
| CVE-2007-4965 EXP | Multiple integer overflows in the imageop module in Python 2.5.1 and earlier allow context-dependent attackers to cause a denial of service (applicati… | Patch early | 5.8 medium | 14% | 2007-09-18 |
| CVE-2016-3473 EXP | Unspecified vulnerability in the BI Publisher (formerly XML Publisher) component in Oracle Fusion Middleware 11.1.1.7.0, 11.1.1.9.0, and 12.2.1.0.0 al… | Patch early | 7.7 high | 13.9% | 2016-10-25 |
| CVE-2008-3734 EXP | Format string vulnerability in Ipswitch WS_FTP Home 2007.0.0.2 and WS_FTP Professional 2007.1.0.0 allows remote FTP servers to cause a denial of servi… | Patch early | 9.3 high | 13.9% | 2008-08-20 |
| CVE-2019-11080 EXP | Sitecore Experience Platform (XP) prior to 9.1.1 is vulnerable to remote code execution via deserialization, aka TFS # 293863. An authenticated user w… | Patch early | 8.8 high | 13.9% | 2019-06-06 |
| CVE-2002-0799 EXP | Buffer overflow in YoungZSoft CMailServer 3.30 allows remote attackers to execute arbitrary code via a long USER argument. | Patch early | 7.5 high | 13.9% | 2002-08-12 |
| CVE-2021-24286 EXP | The settings page of the Redirect 404 to parent WordPress plugin before 1.3.1 did not properly sanitise the tab parameter before outputting it back, l… | Patch early | 6.1 medium | 13.9% | 2021-05-14 |
| CVE-2010-2682 EXP | Directory traversal vulnerability in the Realtyna Translator (com_realtyna) component 1.0.15 for Joomla! allows remote attackers to read arbitrary fil… | Patch early | 7.5 high | 13.9% | 2010-07-12 |
| CVE-2013-3526 EXP | Cross-site scripting (XSS) vulnerability in js/ta_loaded.js.php in the Traffic Analyzer plugin, possibly 3.3.2 and earlier, for WordPress allows remot… | Patch early | 4.3 medium | 13.9% | 2013-05-10 |
| CVE-2017-10246 EXP | Vulnerability in the Oracle Application Object Library component of Oracle E-Business Suite (subcomponent: iHelp). Supported versions that are affecte… | Patch early | 8.2 high | 13.9% | 2017-08-08 |
| CVE-2021-31933 EXP | A remote code execution vulnerability exists in Chamilo through 1.11.14 due to improper input sanitization of a parameter used for file uploads, and i… | Patch early | 7.2 high | 13.9% | 2021-04-30 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt