CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
402,585 CVEs
1,734 on KEV
17,294 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-07
402,585 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2001-0609 EXP | Format string vulnerability in Infodrom cfingerd 1.4.3 and earlier allows a remote attacker to gain additional privileges via a malformed ident reply… | Patch early | 9.8 critical | 18.2% | 2001-08-02 |
| CVE-2003-1118 EXP | Buffer overflow in the SETI@home client 3.03 and other versions allows remote attackers to cause a denial of service (client crash) and execute arbitr… | Patch early | 7.5 high | 18.2% | 2003-12-31 |
| CVE-2018-15142 EXP | Directory traversal in portal/import_template.php in versions of OpenEMR before 5.0.1.4 allows a remote attacker authenticated in the patient portal t… | Patch early | 8.8 high | 18.2% | 2018-08-13 |
| CVE-2005-3774 EXP | Cisco PIX 6.3 and 7.0 allows remote attackers to cause a denial of service (blocked new connections) via spoofed TCP packets that cause the PIX to cre… | Patch early | 5.0 medium | 18.2% | 2005-11-23 |
| CVE-2008-6393 EXP | PSI Jabber client before 0.12.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a file transfer r… | Patch early | 10.0 high | 18.2% | 2009-03-03 |
| CVE-2018-15137 EXP | CeLa Link CLR-M20 devices allow unauthorized users to upload any file (e.g., asp, aspx, cfm, html, jhtml, jsp, or shtml), which causes remote code exe… | Patch early | 9.8 critical | 18.2% | 2018-08-08 |
| CVE-2001-0664 EXP | Internet Explorer 5.5 and 5.01 allows remote attackers to bypass security restrictions via malformed URLs that contain dotless IP addresses, which cau… | Patch early | 7.5 high | 18.2% | 2001-10-30 |
| CVE-2019-12624 EXP | A vulnerability in the web-based management interface of Cisco IOS XE New Generation Wireless Controller (NGWC) could allow an unauthenticated, remote… | Patch early | 8.8 high | 18.2% | 2019-08-21 |
| CVE-2007-2788 EXP | Integer overflow in the embedded ICC profile image parser in Sun Java Development Kit (JDK) before 1.5.0_11-b03 and 1.6.x before 1.6.0_01-b06, and Sun… | Patch early | 6.8 medium | 18.2% | 2007-05-22 |
| CVE-2021-24275 EXP | The Popup by Supsystic WordPress plugin before 1.10.5 did not sanitise the tab parameter of its options page before outputting it in an attribute, lea… | Patch early | 6.1 medium | 18.2% | 2021-05-05 |
| CVE-2005-0701 EXP | Directory traversal vulnerability in Oracle Database Server 8i and 9i allows remote attackers to read or rename arbitrary files via "\\.\\.." (modifi… | Patch early | 5.0 medium | 18.1% | 2005-03-07 |
| CVE-2018-19423 EXP | Codiad 2.8.4 allows remote authenticated administrators to execute arbitrary code by uploading an executable file. | Patch early | 7.2 high | 18.1% | 2018-11-21 |
| CVE-2001-0328 EXP | TCP implementations that use random increments for initial sequence numbers (ISN) can allow remote attackers to perform session hijacking or disruptio… | Patch early | 5.0 medium | 18.1% | 2001-06-27 |
| CVE-2013-5979 EXP | Directory traversal vulnerability in Spring Signage Xibo 1.2.x before 1.2.3 and 1.4.x before 1.4.2 allows remote attackers to read arbitrary files via… | Patch early | 5.0 medium | 18.1% | 2013-10-02 |
| CVE-2006-6601 EXP | Windows Media Player 10.00.00.4036 in Microsoft Windows XP SP2 allows user-assisted remote attackers to cause a denial of service via a .MID (MIDI) fi… | Patch early | 4.3 medium | 18.1% | 2006-12-15 |
| CVE-2016-2207 EXP | The AntiVirus Decomposer engine in Symantec Advanced Threat Protection (ATP); Symantec Data Center Security:Server (SDCS:S) 6.x through 6.6 MP1; Syman… | Patch early | 8.4 high | 18.1% | 2016-06-30 |
| CVE-2017-2988 EXP | Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable memory corruption vulnerability when performing garbage collection. Successful… | Patch early | 8.8 high | 18.1% | 2017-02-15 |
| CVE-2007-1377 EXP | AcroPDF.DLL in Adobe Reader 8.0, when accessed from Mozilla Firefox, Netscape, or Opera, allows remote attackers to cause a denial of service (unspeci… | Patch early | 5.0 medium | 18.1% | 2007-03-10 |
| CVE-2000-0973 EXP | Buffer overflow in curl earlier than 6.0-1.1, and curl-ssl earlier than 6.0-1.2, allows remote attackers to execute arbitrary commands by forcing a lo… | Patch early | 10.0 high | 18.1% | 2000-12-19 |
| CVE-2007-0811 EXP | Microsoft Internet Explorer 6.0 SP1 on Windows 2000, and 6.0 SP2 on Windows XP, allows remote attackers to cause a denial of service (NULL pointer der… | Patch early | 4.3 medium | 18.1% | 2007-02-07 |
| CVE-2009-1331 EXP | Integer overflow in Microsoft Windows Media Player (WMP) 11.0.5721.5260 allows remote attackers to cause a denial of service (application crash) via a… | Patch early | 9.3 high | 18.1% | 2009-04-17 |
| CVE-2010-2259 EXP | Directory traversal vulnerability in the BF Survey (com_bfsurvey) component for Joomla! allows remote attackers to include and execute arbitrary local… | Patch early | 7.5 high | 18.1% | 2010-06-09 |
| CVE-2008-3544 EXP | Multiple stack-based buffer overflows in ovalarmsrv in HP OpenView Network Node Manager (OV NNM) 7.51, and possibly 7.01, 7.50, and 7.53, allow remote… | Patch early | 9.0 high | 18% | 2008-10-13 |
| CVE-2014-8801 EXP | Directory traversal vulnerability in services/getfile.php in the Paid Memberships Pro plugin before 1.7.15 for WordPress allows remote attackers to re… | Patch early | 5.0 medium | 18% | 2014-11-28 |
| CVE-2016-5330 EXP | Untrusted search path vulnerability in the HGFS (aka Shared Folders) feature in VMware Tools 10.0.5 in VMware ESXi 5.0 through 6.0, VMware Workstation… | Patch early | 7.8 high | 18% | 2016-08-08 |
| CVE-2009-0038 EXP | Multiple cross-site scripting (XSS) vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 allow re… | Patch early | 4.3 medium | 18% | 2009-04-17 |
| CVE-2006-2881 EXP | Multiple PHP remote file inclusion vulnerabilities in DreamAccount 3.1 and earlier, when register_globals is enabled, allow remote attackers to execut… | Patch early | 5.1 medium | 18% | 2006-06-07 |
| CVE-2006-3266 EXP | Multiple PHP remote file inclusion vulnerabilities in Bee-hive Lite 1.2 and earlier, when register_globals is enabled, allow remote attackers to execu… | Patch early | 5.1 medium | 18% | 2006-06-27 |
| CVE-2004-0633 EXP | The iSNS dissector for Ethereal 0.10.3 through 0.10.4 allows remote attackers to cause a denial of service (process abort) via an integer overflow. | Patch early | 5.0 medium | 18% | 2004-12-06 |
| CVE-2019-8041 EXP | Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015… | Patch early | 9.8 critical | 17.9% | 2019-08-20 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt