CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
401,957 CVEs
1,734 on KEV
17,295 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-06
186,766 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2007-1733 EXP | Buffer overflow in InterVations NaviCOPA HTTP Server 2.01 allows remote attackers to execute arbitrary code via a long (1) /cgi-bin/ or (2) /cgi/ path… | Patch early | 10.0 high | 10.8% | 2007-03-28 |
| CVE-2013-1616 EXP | The management console on the Symantec Web Gateway (SWG) appliance before 5.1.1 allows remote attackers to execute arbitrary commands by injecting a c… | Patch early | 8.3 high | 10.7% | 2013-08-01 |
| CVE-2019-16702 EXP | Integard Pro 2.2.0.9026 allows remote attackers to execute arbitrary code via a buffer overflow involving a long NoJs parameter to the /LoginAdmin URI… | Patch early | 9.8 critical | 10.7% | 2019-09-23 |
| CVE-2010-0288 EXP | A typo in the administrator permission check in the ACL Manager plugin (plugins/acl/ajax.php) in DokuWiki before 2009-12-25b allows remote attackers t… | Patch early | 7.5 high | 10.7% | 2010-02-15 |
| CVE-2004-0194 EXP | Stack-based buffer overflow in the OutputDebugString function for Adobe Acrobat Reader 5.1 allows remote attackers to execute arbitrary code via a PDF… | Patch early | 7.5 high | 10.7% | 2004-03-29 |
| CVE-2018-20218 EXP | An issue was discovered on Teracue ENC-400 devices with firmware 2.56 and below. The login form passes user input directly to a shell command without… | Patch early | 9.8 critical | 10.7% | 2019-03-21 |
| CVE-2002-0595 EXP | Buffer overflow in WTRS_UI.EXE (WTX_REMOTE.DLL) for WebTrends Reporting Center 4.0d allows remote attackers to execute arbitrary code via a long HTTP… | Patch early | 7.5 high | 10.7% | 2002-06-18 |
| CVE-2007-6697 EXP | Buffer overflow in the LWZReadByte function in IMG_gif.c in SDL_image before 1.2.7 allows remote attackers to cause a denial of service (application c… | Patch early | 7.5 high | 10.7% | 2008-02-01 |
| CVE-2001-0432 EXP | Buffer overflows in various CGI programs in the remote administration service for Trend Micro Interscan VirusWall 3.01 allow remote attackers to execu… | Patch early | 10.0 high | 10.7% | 2001-07-02 |
| CVE-2002-0665 EXP | Macromedia JRun Administration Server allows remote attackers to bypass authentication on the login form via an extra slash (/) in the URL. | Patch early | 10.0 high | 10.7% | 2002-07-11 |
| CVE-2008-4501 EXP | Directory traversal vulnerability in the FTP server in Serv-U 7.0.0.1 through 7.3, including 7.2.0.1, allows remote authenticated users to overwrite o… | Patch early | 9.0 high | 10.7% | 2008-10-09 |
| CVE-2005-2968 EXP | Firefox 1.0.6 and Mozilla 1.7.10 allows attackers to execute arbitrary commands via shell metacharacters in a URL that is provided to the browser on t… | Patch early | 7.5 high | 10.7% | 2005-09-20 |
| CVE-2004-0953 EXP | Buffer overflow in the C2S module in the open source Jabber 2.x server (Jabberd) allows remote attackers to cause a denial of service (application cra… | Patch early | 10.0 high | 10.7% | 2005-01-10 |
| CVE-2014-9456 EXP | Buffer overflow in NotePad++ 6.6.9 allows remote attackers to have unspecified impact via a long Time attribute in an Event element in an XML file. N… | Patch early | 10.0 high | 10.7% | 2015-01-02 |
| CVE-2008-0248 EXP | Buffer overflow in an ActiveX control in ccpm_0237.dll for StreamAudio ChainCast ProxyManager allows remote attackers to execute arbitrary code via a… | Patch early | 9.3 high | 10.7% | 2008-01-12 |
| CVE-2008-2702 EXP | Directory traversal vulnerability in the FTP client in ALTools ESTsoft ALFTP 4.1 beta 2 and 5.0 allows remote FTP servers to create or overwrite arbit… | Patch early | 9.3 high | 10.7% | 2008-06-13 |
| CVE-2011-4342 EXP | PHP remote file inclusion vulnerability in wp_xml_export.php in the BackWPup plugin before 1.7.2 for WordPress allows remote attackers to execute arbi… | Patch early | 7.5 high | 10.7% | 2012-10-08 |
| CVE-2006-1770 EXP | Multiple PHP remote file inclusion vulnerabilities in Azerbaijan Design & Development Group (AZDG) AzDGVote allow remote attackers to execute arbitrar… | Patch early | 10.0 high | 10.7% | 2006-04-13 |
| CVE-2007-1643 EXP | Multiple PHP remote file inclusion vulnerabilities in LAN Management System (LMS) 1.8.9 Vala and earlier allow remote attackers to execute arbitrary P… | Patch early | 10.0 high | 10.7% | 2007-03-24 |
| CVE-2004-2685 EXP | Buffer overflow in YoungZSoft CCProxy 6.2 and earlier allows remote attackers to execute arbitrary code via a long address in a ping (p) command to th… | Patch early | 7.5 high | 10.7% | 2004-12-31 |
| CVE-2021-27890 EXP | SQL Injection vulnerablity in MyBB before 1.8.26 via theme properties included in theme XML files. | Patch early | 8.8 high | 10.7% | 2021-03-15 |
| CVE-2015-7251 EXP | ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_PE have a hardcoded password of root for the root account, which allows remote attackers to o… | Patch early | 9.8 critical | 10.7% | 2015-12-30 |
| CVE-2008-1965 EXP | Argument injection vulnerability in the cai: URI handler in rcplauncher in IBM Lotus Expeditor Client for Desktop 6.1.1 and 6.1.2, as used by Lotus Sy… | Patch early | 9.3 high | 10.7% | 2008-04-25 |
| CVE-2021-28419 EXP | The "order_col" parameter in archive.php of SEO Panel 4.8.0 is vulnerable to time-based blind SQL injection, which leads to the ability to retrieve al… | Patch early | 7.2 high | 10.7% | 2021-03-18 |
| CVE-2008-5032 EXP | Stack-based buffer overflow in VideoLAN VLC media player 0.5.0 through 0.9.5 might allow user-assisted attackers to execute arbitrary code via the hea… | Patch early | 9.3 high | 10.7% | 2008-11-10 |
| CVE-2022-38841 EXP | Linksys AX3200 1.1.00 is vulnerable to OS command injection by authenticated users via shell metacharacters to the diagnostics traceroute page. | Patch early | 8.8 high | 10.7% | 2023-04-16 |
| CVE-2007-4738 EXP | Multiple PHP remote file inclusion vulnerabilities in SpeedTech PHP Library (STPHPLibrary) 0.8.0 allow remote attackers to execute arbitrary PHP code… | Patch early | 7.5 high | 10.7% | 2007-09-06 |
| CVE-2006-6026 EXP | Heap-based buffer overflow in Real Networks Helix Server and Helix Mobile Server before 11.1.3, and Helix DNA Server 11.0 and 11.1, allows remote atta… | Patch early | 10.0 high | 10.7% | 2006-11-21 |
| CVE-2017-15806 EXP | The send function in the ezcMailMtaTransport class in Zeta Components Mail before 1.8.2 does not properly restrict the set of characters used in the e… | Patch early | 8.1 high | 10.7% | 2017-11-15 |
| CVE-2005-1628 EXP | apage.cgi in WebAPP 0.9.9.2.1, and possibly earlier versions, allows remote attackers to execute arbitrary commands via shell metacharacters in the f… | Patch early | 7.5 high | 10.6% | 2005-05-17 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt