CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
402,593 CVEs
1,734 on KEV
17,294 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-07
320,623 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2017-18195 EXP | An issue was discovered in tools/conversations/view_ajax.php in Concrete5 before 8.3.0. An unauthenticated user can enumerate comments from all blog p… | Patch early | 5.3 medium | 11.1% | 2018-02-26 |
| CVE-2004-2044 EXP | PHP-Nuke 7.3, and other products that use the PHP-Nuke codebase such as the Nuke Cops betaNC PHP-Nuke Bundle, OSCNukeLite 3.1, and OSC2Nuke 7x do not… | Patch early | 7.5 high | 11% | 2004-06-01 |
| CVE-2021-27973 EXP | SQL injection exists in Piwigo before 11.4.0 via the language parameter to admin.php?page=languages. | Patch early | 7.2 high | 11% | 2021-04-02 |
| CVE-2007-0126 EXP | Heap-based buffer overflow in Opera 9.02 allows remote attackers to execute arbitrary code via a JPEG file with an invalid number of index bytes in th… | Patch early | 9.3 high | 11% | 2007-01-09 |
| CVE-2008-3794 EXP | Integer signedness error in the mms_ReceiveCommand function in modules/access/mms/mmstu.c in VLC Media Player 0.8.6i allows remote attackers to execut… | Patch early | 6.8 medium | 11% | 2008-08-26 |
| CVE-2019-8646 EXP | An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 12.4, macOS Mojave 10.14.6, tvOS 12.4, watchOS 5.3. A r… | Patch early | 7.5 high | 11% | 2019-12-18 |
| CVE-2005-0873 EXP | Multiple cross-site scripting (XSS) vulnerabilities in test.jsp in Oracle Reports Server 10g (9.0.4.3.3) allow remote attackers to inject arbitrary we… | Patch early | 4.3 medium | 11% | 2005-05-02 |
| CVE-2019-8672 EXP | Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.4, macOS Mojave 10.14.6, tvOS 12.4, watc… | Patch early | 8.8 high | 11% | 2019-12-18 |
| CVE-2010-2310 EXP | SolarWinds TFTP Server 10.4.0.13 allows remote attackers to cause a denial of service (crash) via a long write request. | Patch early | 5.0 medium | 11% | 2010-06-16 |
| CVE-2002-0749 EXP | CGIscript.net csMailto.cgi allows remote attackers to execute arbitrary commands via shell metacharacters in the form-attachment field. | Patch early | 7.5 high | 11% | 2002-08-12 |
| CVE-2018-8947 EXP | rap2hpoutre Laravel Log Viewer before v0.13.0 relies on Base64 encoding for l, dl, and del requests, which makes it easier for remote attackers to byp… | Patch early | 7.5 high | 11% | 2018-03-25 |
| CVE-2007-1620 EXP | Multiple PHP remote file inclusion vulnerabilities in PHP DB Designer 1.02 and earlier allow remote attackers to execute arbitrary PHP code via a URL… | Patch early | 10.0 high | 11% | 2007-03-23 |
| CVE-2012-4170 EXP | Buffer overflow in Adobe Photoshop CS6 13.x before 13.0.1 allows remote attackers to execute arbitrary code via a crafted file. | Patch early | 9.3 high | 11% | 2012-08-31 |
| CVE-2007-4534 EXP | Buffer overflow in the VThinker::BroadcastPrintf function in p_thinker.cpp in Vavoom 1.24 and earlier allows remote attackers to execute arbitrary cod… | Patch early | 7.5 high | 11% | 2007-08-25 |
| CVE-2008-3409 EXP | Buffer overflow in Unreal Tournament 3 1.3beta4 and earlier allows remote attackers to cause a denial of service (memory corruption and daemon crash)… | Patch early | 7.5 high | 11% | 2008-07-31 |
| CVE-2006-0528 EXP | The cairo library (libcairo), as used in GNOME Evolution and possibly other products, allows remote attackers to cause a denial of service (persistent… | Patch early | 5.0 medium | 11% | 2006-02-02 |
| CVE-2006-6097 EXP | GNU tar 1.16 and 1.15.1, and possibly other versions, allows user-assisted attackers to overwrite arbitrary files via a tar file that contains a GNUTY… | Patch early | 4.0 medium | 11% | 2006-11-24 |
| CVE-2009-2764 EXP | Microsoft Internet Explorer 8.0.7100.0 on Windows 7 RC on the x64 platform allows remote attackers to cause a denial of service (application crash) vi… | Patch early | 5.0 medium | 11% | 2009-08-14 |
| CVE-2014-3220 EXP | F5 BIG-IQ Cloud and Security 4.0.0 through 4.1.0 allows remote authenticated users to change the password of arbitrary users via the name parameter in… | Patch early | 9.0 high | 11% | 2014-05-05 |
| CVE-2005-1100 EXP | Format string vulnerability in the ErrorLog function in cnf.c in Greylisting daemon (GLD) 1.3 and 1.4 allows remote attackers to execute arbitrary cod… | Patch early | 7.5 high | 11% | 2005-05-02 |
| CVE-2015-6023 EXP | ping.cgi in NetCommWireless HSPA 3G10WVE wireless routers with firmware before 3G10WVE-L101-S306ETS-C01_R05 allows remote attackers to bypass intended… | Patch early | 7.3 high | 11% | 2017-02-09 |
| CVE-2018-6460 EXP | Hotspot Shield runs a webserver with a static IP address 127.0.0.1 and port 895. The web server uses JSONP and hosts sensitive information including c… | Patch early | 7.5 high | 11% | 2018-01-31 |
| CVE-2005-3202 EXP | Multiple cross-site scripting (XSS) vulnerabilities in Oracle HTML DB (HTMLDB) 1.3 through 1.3.6 allow remote attackers to inject arbitrary web script… | Patch early | 6.8 medium | 11% | 2005-10-14 |
| CVE-2013-1868 EXP | Multiple buffer overflows in VideoLAN VLC media player 2.0.4 and earlier allow remote attackers to cause a denial of service (crash) and execute arbit… | Patch early | 9.3 high | 11% | 2013-07-10 |
| CVE-2006-2151 EXP | PHP remote file inclusion vulnerability in toplist.php in phpBB TopList 1.3.8 and earlier, when register_globals is enabled, allows remote attackers t… | Patch early | 7.5 high | 11% | 2006-05-03 |
| CVE-2001-0277 EXP | Buffer overflow in ext.dll in BadBlue 1.02.07 Personal Edition allows remote attackers to cause a denial of service and possibly execute arbitrary com… | Patch early | 10.0 high | 11% | 2001-05-03 |
| CVE-2006-3995 EXP | Multiple PHP remote file inclusion vulnerabilities in (1) uhp_config.php, and possibly (2) footer.php, (3) functions.php, (4) install.uhp.php, (5) too… | Patch early | 6.8 medium | 11% | 2006-08-05 |
| CVE-2014-7221 EXP | TeamSpeak Client 3.0.14 and earlier allows remote authenticated users to cause a denial of service (buffer overflow and application crash) by connecti… | Patch early | 6.5 medium | 11% | 2018-01-08 |
| CVE-2014-7222 EXP | Buffer overflow in TeamSpeak Client 3.0.14 and earlier allows remote authenticated users to cause a denial of service (application crash) by connectin… | Patch early | 6.5 medium | 11% | 2018-01-08 |
| CVE-2008-4434 EXP | Stack-based buffer overflow in (1) uTorrent 1.7.7 build 8179 and earlier and (2) BitTorrent 6.0.3 build 8642 and earlier allows remote attackers to ca… | Patch early | 9.3 high | 11% | 2008-10-03 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt