CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
401,957 CVEs
1,734 on KEV
17,295 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-06
186,766 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2011-4189 EXP | The client in Novell GroupWise 8.0x through 8.02HP3 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corrup… | Patch early | 7.5 high | 11.6% | 2012-03-02 |
| CVE-1999-0710 EXP | The Squid package in Red Hat Linux 5.2 and 6.0, and other distributions, installs cachemgr.cgi in a public web directory, which allows remote attacker… | Patch early | 7.5 high | 11.6% | 1999-07-25 |
| CVE-2002-1456 EXP | Buffer overflow in mIRC 6.0.2 and earlier allows remote attackers to execute arbitrary code via a long $asctime value. | Patch early | 7.5 high | 11.6% | 2003-06-09 |
| CVE-2004-1147 EXP | phpMyAdmin 2.6.0-pl2, and other versions before 2.6.1, with external transformations enabled, allows remote attackers to execute arbitrary commands vi… | Patch early | 10.0 high | 11.6% | 2005-01-10 |
| CVE-2007-0233 EXP | wp-trackback.php in WordPress 2.0.6 and earlier does not properly unset variables when the input data includes a numeric parameter with a value matchi… | Patch early | 7.5 high | 11.6% | 2007-01-13 |
| CVE-2022-22833 EXP | An issue was discovered in Servisnet Tessa 0.0.2. An attacker can obtain sensitive information via a /js/app.js request. | Patch early | 7.5 high | 11.6% | 2022-02-06 |
| CVE-2015-4181 EXP | Directory traversal vulnerability in get_file.php in phpMyBackupPro 2.1 through 2.5 allows remote attackers to read arbitrary files via a .. (dot dot)… | Patch early | 7.5 high | 11.6% | 2017-08-25 |
| CVE-2018-18957 EXP | An issue has been found in libIEC61850 v1.3. It is a stack-based buffer overflow in prepareGooseBuffer in goose/goose_publisher.c. | Patch early | 9.8 critical | 11.6% | 2018-11-05 |
| CVE-2003-0263 EXP | Multiple buffer overflows in Floosietek FTGate Pro Mail Server (FTGatePro) 1.22 allow remote attackers to execute arbitrary code via long (1) MAIL FRO… | Patch early | 7.5 high | 11.6% | 2003-05-27 |
| CVE-2016-9683 EXP | The SonicWall Secure Remote Access server (version 8.1.0.2-14sv) is vulnerable to a Remote Command Injection vulnerability in its web administrative i… | Patch early | 9.8 critical | 11.6% | 2017-02-22 |
| CVE-2013-7186 EXP | Buffer overflow in Steinberg MyMp3PRO 5.0 (Build 5.1.0.21) allows remote attackers to execute arbitrary code via a long string in a .m3u file. | Patch early | 9.3 high | 11.6% | 2013-12-20 |
| CVE-2013-2261 EXP | Cryptocat before 2.0.22 Chrome Extension 'img/keygen.gif' has Information Disclosure | Patch early | 7.5 high | 11.6% | 2019-11-04 |
| CVE-2018-5724 EXP | MASTER IPCAMERA01 3.3.4.2103 devices allow Unauthenticated Configuration Download and Upload, as demonstrated by restore.cgi. | Patch early | 9.8 critical | 11.5% | 2018-01-16 |
| CVE-2019-10709 EXP | AsusPTPFilter.sys on Asus Precision TouchPad 11.0.0.25 hardware has a Pool Overflow associated with the \\.\AsusTP device, leading to a DoS or potenti… | Patch early | 9.8 critical | 11.5% | 2019-09-04 |
| CVE-1999-0284 EXP | Denial of service to NT mail servers including Ipswitch, Mdaemon, and Exchange through a buffer overflow in the SMTP HELO command. | Patch early | 7.5 high | 11.5% | 1998-01-01 |
| CVE-2009-0544 EXP | Buffer overflow in the PyCrypto ARC2 module 2.0.1 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a large… | Patch early | 10.0 high | 11.5% | 2009-02-12 |
| CVE-2008-1289 EXP | Multiple buffer overflows in Asterisk Open Source 1.4.x before 1.4.18.1 and 1.4.19-rc3, Open Source 1.6.x before 1.6.0-beta6, Business Edition C.x.x b… | Patch early | 7.5 high | 11.5% | 2008-03-24 |
| CVE-2002-0599 EXP | Blahz-DNS 0.2 and earlier allows remote attackers to bypass authentication and modify configuration by directly requesting CGI programs such as dostuf… | Patch early | 10.0 high | 11.5% | 2002-06-18 |
| CVE-2000-1014 EXP | Format string vulnerability in the search97.cgi CGI script in SCO help http server for Unixware 7 allows remote attackers to execute arbitrary command… | Patch early | 7.5 high | 11.5% | 2000-12-11 |
| CVE-2004-0816 EXP | Integer underflow in the firewall logging rules for iptables in Linux before 2.6.8 allows remote attackers to cause a denial of service (application c… | Patch early | 7.5 high | 11.5% | 2004-12-23 |
| CVE-2000-0909 EXP | Buffer overflow in the automatic mail checking component of Pine 4.21 and earlier allows remote attackers to execute arbitrary commands via a long Fro… | Patch early | 7.5 high | 11.5% | 2000-12-19 |
| CVE-2011-2543 EXP | Buffer overflow in the cuil component in Cisco Telepresence System Integrator C Series 4.x before TC4.2.0 allows remote authenticated users to cause a… | Patch early | 9.0 high | 11.5% | 2011-09-23 |
| CVE-2016-1610 EXP | Directory traversal vulnerability in the email-template feature in Novell Filr before 1.2 Security Update 3 and 2.0 before Security Update 2 allows re… | Patch early | 7.5 high | 11.5% | 2016-08-01 |
| CVE-2006-2849 EXP | PHP remote file inclusion vulnerability in includes/webdav/server.php in Bytehoard 2.1 Epsilon/Delta allows remote attackers to execute arbitrary PHP… | Patch early | 7.5 high | 11.5% | 2006-06-06 |
| CVE-2017-2523 EXP | An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. macOS before 10.12.5 is affected. tvOS before 10.2.1 is affected. wa… | Patch early | 9.8 critical | 11.5% | 2017-05-22 |
| CVE-2003-1425 EXP | guestbook.cgi in cPanel 5.0 allows remote attackers to execute arbitrary commands via the template parameter. | Patch early | 10.0 high | 11.5% | 2003-12-31 |
| CVE-2005-3486 EXP | Multiple format string vulnerabilities in Scorched 3D 39.1 (bf) and earlier allow remote attackers to execute arbitrary code via various (1) GLConsole… | Patch early | 7.5 high | 11.5% | 2005-11-03 |
| CVE-2009-4112 EXP | Cacti 0.8.7e and earlier allows remote authenticated administrators to gain privileges by modifying the "Data Input Method" for the "Linux - Get Memor… | Patch early | 9.0 high | 11.5% | 2009-11-30 |
| CVE-2018-18428 EXP | TP-Link TL-SC3130 1.6.18P12_121101 devices allow unauthenticated RTSP stream access, as demonstrated by a /jpg/image.jpg URI. | Patch early | 7.5 high | 11.5% | 2018-10-19 |
| CVE-2021-3337 EXP | The Hide-Thread-Content plugin through 2021-01-27 for MyBB allows remote attackers to bypass intended content-reading restrictions by clicking on repl… | Patch early | 7.5 high | 11.5% | 2021-01-28 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt