CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
401,997 CVEs
1,734 on KEV
17,295 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-06
186,793 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2008-0295 EXP | Heap-based buffer overflow in modules/access/rtsp/real_sdpplin.c in the Xine library, as used in VideoLAN VLC Media Player 0.8.6d and earlier, allows… | Patch early | 8.5 high | 11.1% | 2008-01-16 |
| CVE-2011-3596 EXP | Polipo before 1.0.4.1 suffers from a DoD vulnerability via specially-crafted HTTP POST / PUT request. | Patch early | 7.5 high | 11.1% | 2019-11-26 |
| CVE-2004-2044 EXP | PHP-Nuke 7.3, and other products that use the PHP-Nuke codebase such as the Nuke Cops betaNC PHP-Nuke Bundle, OSCNukeLite 3.1, and OSC2Nuke 7x do not… | Patch early | 7.5 high | 11% | 2004-06-01 |
| CVE-2021-27973 EXP | SQL injection exists in Piwigo before 11.4.0 via the language parameter to admin.php?page=languages. | Patch early | 7.2 high | 11% | 2021-04-02 |
| CVE-2007-0126 EXP | Heap-based buffer overflow in Opera 9.02 allows remote attackers to execute arbitrary code via a JPEG file with an invalid number of index bytes in th… | Patch early | 9.3 high | 11% | 2007-01-09 |
| CVE-2019-8646 EXP | An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 12.4, macOS Mojave 10.14.6, tvOS 12.4, watchOS 5.3. A r… | Patch early | 7.5 high | 11% | 2019-12-18 |
| CVE-2019-8672 EXP | Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.4, macOS Mojave 10.14.6, tvOS 12.4, watc… | Patch early | 8.8 high | 11% | 2019-12-18 |
| CVE-2002-0749 EXP | CGIscript.net csMailto.cgi allows remote attackers to execute arbitrary commands via shell metacharacters in the form-attachment field. | Patch early | 7.5 high | 11% | 2002-08-12 |
| CVE-2018-8947 EXP | rap2hpoutre Laravel Log Viewer before v0.13.0 relies on Base64 encoding for l, dl, and del requests, which makes it easier for remote attackers to byp… | Patch early | 7.5 high | 11% | 2018-03-25 |
| CVE-2007-1620 EXP | Multiple PHP remote file inclusion vulnerabilities in PHP DB Designer 1.02 and earlier allow remote attackers to execute arbitrary PHP code via a URL… | Patch early | 10.0 high | 11% | 2007-03-23 |
| CVE-2012-4170 EXP | Buffer overflow in Adobe Photoshop CS6 13.x before 13.0.1 allows remote attackers to execute arbitrary code via a crafted file. | Patch early | 9.3 high | 11% | 2012-08-31 |
| CVE-2008-3409 EXP | Buffer overflow in Unreal Tournament 3 1.3beta4 and earlier allows remote attackers to cause a denial of service (memory corruption and daemon crash)… | Patch early | 7.5 high | 11% | 2008-07-31 |
| CVE-2007-4534 EXP | Buffer overflow in the VThinker::BroadcastPrintf function in p_thinker.cpp in Vavoom 1.24 and earlier allows remote attackers to execute arbitrary cod… | Patch early | 7.5 high | 11% | 2007-08-25 |
| CVE-2014-3220 EXP | F5 BIG-IQ Cloud and Security 4.0.0 through 4.1.0 allows remote authenticated users to change the password of arbitrary users via the name parameter in… | Patch early | 9.0 high | 11% | 2014-05-05 |
| CVE-2005-1100 EXP | Format string vulnerability in the ErrorLog function in cnf.c in Greylisting daemon (GLD) 1.3 and 1.4 allows remote attackers to execute arbitrary cod… | Patch early | 7.5 high | 11% | 2005-05-02 |
| CVE-2015-6023 EXP | ping.cgi in NetCommWireless HSPA 3G10WVE wireless routers with firmware before 3G10WVE-L101-S306ETS-C01_R05 allows remote attackers to bypass intended… | Patch early | 7.3 high | 11% | 2017-02-09 |
| CVE-2018-6460 EXP | Hotspot Shield runs a webserver with a static IP address 127.0.0.1 and port 895. The web server uses JSONP and hosts sensitive information including c… | Patch early | 7.5 high | 11% | 2018-01-31 |
| CVE-2013-1868 EXP | Multiple buffer overflows in VideoLAN VLC media player 2.0.4 and earlier allow remote attackers to cause a denial of service (crash) and execute arbit… | Patch early | 9.3 high | 11% | 2013-07-10 |
| CVE-2006-2151 EXP | PHP remote file inclusion vulnerability in toplist.php in phpBB TopList 1.3.8 and earlier, when register_globals is enabled, allows remote attackers t… | Patch early | 7.5 high | 11% | 2006-05-03 |
| CVE-2001-0277 EXP | Buffer overflow in ext.dll in BadBlue 1.02.07 Personal Edition allows remote attackers to cause a denial of service and possibly execute arbitrary com… | Patch early | 10.0 high | 11% | 2001-05-03 |
| CVE-2008-4434 EXP | Stack-based buffer overflow in (1) uTorrent 1.7.7 build 8179 and earlier and (2) BitTorrent 6.0.3 build 8642 and earlier allows remote attackers to ca… | Patch early | 9.3 high | 11% | 2008-10-03 |
| CVE-2020-13144 EXP | Studio in Open edX Ironwood 2.5, when CodeJail is not used, allows a user to go to the "Create New course>New section>New subsection>New unit>Add new… | Patch early | 8.8 high | 11% | 2020-05-18 |
| CVE-2002-0516 EXP | SquirrelMail 1.2.5 and earlier allows authenticated SquirrelMail users to execute arbitrary commands by modifying the THEME variable in a cookie. | Patch early | 10.0 high | 11% | 2002-08-12 |
| CVE-2020-11060 EXP | In GLPI before 9.4.6, an attacker can execute system commands by abusing the backup functionality. Theoretically, this vulnerability can be exploited… | Patch early | 7.4 high | 10.9% | 2020-05-12 |
| CVE-2006-4656 EXP | PHP remote file inclusion vulnerability in admin/editeur/spaw_control.class.php in Web Provence SL_Site 1.0 and earlier allows remote attackers to exe… | Patch early | 7.5 high | 10.9% | 2006-09-09 |
| CVE-2010-3145 EXP | Untrusted search path vulnerability in the BitLocker Drive Encryption API, as used in sdclt.exe in Backup Manager in Microsoft Windows Vista SP1 and S… | Patch early | 9.3 high | 10.9% | 2010-08-27 |
| CVE-2009-0367 EXP | The Python AI module in Wesnoth 1.4.x and 1.5 before 1.5.11 allows remote attackers to escape the sandbox and execute arbitrary code by using a whitel… | Patch early | 9.3 high | 10.9% | 2009-03-05 |
| CVE-2010-0049 EXP | Use-after-free vulnerability in WebKit in Apple Safari before 4.0.5 allows remote attackers to execute arbitrary code or cause a denial of service (ap… | Patch early | 9.3 high | 10.9% | 2010-03-15 |
| CVE-2009-3250 EXP | The saveForwardAttachments procedure in the Compose Mail functionality in vtiger CRM 5.0.4 allows remote authenticated users to execute arbitrary code… | Patch early | 9.0 high | 10.9% | 2009-09-18 |
| CVE-2000-0059 EXP | PHP3 with safe_mode enabled does not properly filter shell metacharacters from commands that are executed by popen, which could allow remote attackers… | Patch early | 10.0 high | 10.9% | 2000-01-04 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt