CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
401,997 CVEs
1,734 on KEV
17,295 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-06
401,997 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2001-0322 EXP | MSHTML.DLL HTML parser in Internet Explorer 4.0, and other versions, allows remote attackers to cause a denial of service (application crash) via a sc… | Patch early | 5.0 medium | 21% | 2001-06-02 |
| CVE-2014-1777 EXP | Microsoft Internet Explorer 10 and 11 allows remote attackers to read local files on the client via a crafted web site, aka "Internet Explorer Informa… | Patch early | 4.3 medium | 21% | 2014-06-11 |
| CVE-2013-2113 EXP | The create method in app/controllers/users_controller.rb in Foreman before 1.2.0-RC2 allows remote authenticated users with permissions to create or e… | Patch early | 6.0 medium | 20.9% | 2013-07-31 |
| CVE-2019-6110 EXP | In OpenSSH 7.9, due to accepting and displaying arbitrary stderr output from the server, a malicious server (or Man-in-The-Middle attacker) can manipu… | Patch early | 6.8 medium | 20.9% | 2019-01-31 |
| CVE-2015-1579 EXP | Directory traversal vulnerability in the Elegant Themes Divi theme for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in… | Patch early | 5.0 medium | 20.9% | 2015-02-11 |
| CVE-2020-9283 EXP | golang.org/x/crypto before v0.0.0-20200220183623-bac4c82f6975 for Go allows a panic during signature verification in the golang.org/x/crypto/ssh packa… | Patch early | 7.5 high | 20.9% | 2020-02-20 |
| CVE-2016-2209 EXP | Buffer overflow in Dec2SS.dll in the AntiVirus Decomposer engine in Symantec Advanced Threat Protection (ATP); Symantec Data Center Security:Server (S… | Patch early | 7.3 high | 20.9% | 2016-06-30 |
| CVE-2006-3655 EXP | Unspecified vulnerability in mso.dll in Microsoft PowerPoint 2003 allows user-assisted attackers to execute arbitrary code via a crafted PowerPoint fi… | Patch early | 5.1 medium | 20.9% | 2006-07-18 |
| CVE-2011-1866 EXP | Buffer overflow in omniinet.exe in the inet service in HP OpenView Storage Data Protector 6.00 through 6.20 allows remote attackers to execute arbitra… | Patch early | 10.0 high | 20.9% | 2011-07-01 |
| CVE-2016-6272 EXP | XPath injection vulnerability in Epic MyChart allows remote attackers to access contents of an XML document containing static display strings, such as… | Patch early | 7.5 high | 20.9% | 2018-02-20 |
| CVE-2013-0633 EXP | Buffer overflow in Adobe Flash Player before 10.3.183.51 and 11.x before 11.5.502.149 on Windows and Mac OS X, before 10.3.183.51 and 11.x before 11.2… | Patch early | 9.3 high | 20.9% | 2013-02-08 |
| CVE-2007-1306 EXP | Asterisk 1.4 before 1.4.1 and 1.2 before 1.2.16 allows remote attackers to cause a denial of service (crash) by sending a Session Initiation Protocol… | Patch early | 7.8 high | 20.9% | 2007-03-07 |
| CVE-2006-7065 EXP | Microsoft Internet Explorer allows remote attackers to cause a denial of service (crash) via an IFRAME with a certain XML file and XSL stylesheet that… | Patch early | 5.0 medium | 20.9% | 2007-03-02 |
| CVE-2023-0830 EXP | A vulnerability classified as critical has been found in EasyNAS 1.1.0. Affected is the function system of the file /backup.pl. The manipulation leads… | Patch early | 6.3 medium | 20.9% | 2023-02-14 |
| CVE-2014-2908 EXP | Cross-site scripting (XSS) vulnerability in the integrated web server on Siemens SIMATIC S7-1200 CPU devices 2.x and 3.x allows remote attackers to in… | Patch early | 4.3 medium | 20.9% | 2014-04-25 |
| CVE-2005-1250 EXP | SQL injection vulnerability in the logon screen of the web front end (NmConsole/Login.asp) for IpSwitch WhatsUp Professional 2005 SP1 allows remote at… | Patch early | 7.5 high | 20.9% | 2005-06-22 |
| CVE-2004-0933 EXP | Computer Associates (CA) InoculateIT 6.0, eTrust Antivirus r6.0 through r7.1, eTrust Antivirus for the Gateway r7.0 and r7.1, eTrust Secure Content Ma… | Patch early | 7.5 high | 20.9% | 2005-01-27 |
| CVE-2016-5639 EXP | Directory traversal vulnerability in cgi-bin/login.cgi on Crestron AirMedia AM-100 devices with firmware before 1.4.0.13 allows remote attackers to re… | Patch early | 7.5 high | 20.8% | 2016-08-03 |
| CVE-2020-35598 EXP | ACS Advanced Comment System 1.0 is affected by Directory Traversal via an advanced_component_system/index.php?ACS_path=..%2f URI. NOTE: this might be… | Patch early | 7.5 high | 20.8% | 2020-12-23 |
| CVE-2012-5612 EXP | Heap-based buffer overflow in Oracle MySQL 5.5.19 and other versions through 5.5.28, and MariaDB 5.5.28a and possibly other versions, allows remote au… | Patch early | 6.5 medium | 20.8% | 2012-12-03 |
| CVE-2004-1137 EXP | Multiple vulnerabilities in the IGMP functionality for Linux kernel 2.4.22 to 2.4.28, and 2.6.x to 2.6.9, allow local and remote attackers to cause a… | Patch early | 10.0 high | 20.8% | 2005-01-10 |
| CVE-2011-1976 EXP | Cross-site scripting (XSS) vulnerability in the Report Viewer Control in Microsoft Visual Studio 2005 SP1 and Report Viewer 2005 SP1 allows remote att… | Patch early | 4.3 medium | 20.8% | 2011-08-10 |
| CVE-2000-0465 EXP | Internet Explorer 4.x and 5.x does not properly verify the domain of a frame within a browser window, which allows a remote attacker to read client f… | Patch early | 5.1 medium | 20.8% | 2000-05-17 |
| CVE-2017-1000112 EXP | Linux kernel: Exploitable memory corruption due to UFO to non-UFO path switch. When building a UFO packet with MSG_MORE __ip_append_data() calls ip_uf… | Patch early | 7.0 high | 20.8% | 2017-10-05 |
| CVE-2006-3471 EXP | Microsoft Internet Explorer 6 on Windows XP allows remote attackers to cause a denial of service (crash) via a table with a frameset as a child, which… | Patch early | 5.0 medium | 20.8% | 2006-07-10 |
| CVE-2016-4201 EXP | Adobe Reader and Acrobat before 11.0.17, Acrobat and Acrobat Reader DC Classic before 15.006.30198, and Acrobat and Acrobat Reader DC Continuous befor… | Patch early | 9.8 critical | 20.8% | 2016-07-13 |
| CVE-2010-3143 EXP | Untrusted search path vulnerability in Microsoft Windows Contacts allows local users, and possibly remote attackers, to execute arbitrary code and con… | Patch early | 9.3 high | 20.8% | 2010-08-27 |
| CVE-2011-0285 EXP | The process_chpw_request function in schpw.c in the password-changing functionality in kadmind in MIT Kerberos 5 (aka krb5) 1.7 through 1.9 frees an i… | Patch early | 10.0 high | 20.8% | 2011-04-15 |
| CVE-2010-3227 EXP | Stack-based buffer overflow in the UpdateFrameTitleForDocument method in the CFrameWnd class in mfc42.dll in the Microsoft Foundation Class (MFC) Libr… | Patch early | 9.3 high | 20.8% | 2010-10-26 |
| CVE-2022-34046 EXP | An access control issue in Wavlink WN533A8 M33A8.V5030.190716 allows attackers to obtain usernames and passwords via view-source:http://IP_ADDRESS/sys… | Patch early | 7.5 high | 20.8% | 2022-07-20 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt