CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
402,593 CVEs
1,734 on KEV
17,294 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-07
320,623 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2020-13144 EXP | Studio in Open edX Ironwood 2.5, when CodeJail is not used, allows a user to go to the "Create New course>New section>New subsection>New unit>Add new… | Patch early | 8.8 high | 11% | 2020-05-18 |
| CVE-2002-0516 EXP | SquirrelMail 1.2.5 and earlier allows authenticated SquirrelMail users to execute arbitrary commands by modifying the THEME variable in a cookie. | Patch early | 10.0 high | 11% | 2002-08-12 |
| CVE-2006-4901 EXP | Computer Associates (CA) eTrust Security Command Center 1.0 and r8 up to SP1 CR2, and eTrust Audit 1.5 and r8, allows remote attackers to spoof alerts… | Patch early | 6.4 medium | 11% | 2006-09-22 |
| CVE-2001-0590 EXP | Apache Software Foundation Tomcat Servlet prior to 3.2.2 allows a remote attacker to read the source code to arbitrary 'jsp' files via a malformed URL… | Patch early | 5.0 medium | 11% | 2001-08-02 |
| CVE-2006-5205 EXP | Directory traversal vulnerability in Invision Gallery 2.0.7 allows remote attackers to read arbitrary files via a .. (dot dot) sequence in the dir par… | Patch early | 5.0 medium | 11% | 2006-10-10 |
| CVE-2020-11060 EXP | In GLPI before 9.4.6, an attacker can execute system commands by abusing the backup functionality. Theoretically, this vulnerability can be exploited… | Patch early | 7.4 high | 10.9% | 2020-05-12 |
| CVE-2006-4656 EXP | PHP remote file inclusion vulnerability in admin/editeur/spaw_control.class.php in Web Provence SL_Site 1.0 and earlier allows remote attackers to exe… | Patch early | 7.5 high | 10.9% | 2006-09-09 |
| CVE-2010-3145 EXP | Untrusted search path vulnerability in the BitLocker Drive Encryption API, as used in sdclt.exe in Backup Manager in Microsoft Windows Vista SP1 and S… | Patch early | 9.3 high | 10.9% | 2010-08-27 |
| CVE-2009-0367 EXP | The Python AI module in Wesnoth 1.4.x and 1.5 before 1.5.11 allows remote attackers to escape the sandbox and execute arbitrary code by using a whitel… | Patch early | 9.3 high | 10.9% | 2009-03-05 |
| CVE-2010-0049 EXP | Use-after-free vulnerability in WebKit in Apple Safari before 4.0.5 allows remote attackers to execute arbitrary code or cause a denial of service (ap… | Patch early | 9.3 high | 10.9% | 2010-03-15 |
| CVE-2009-3250 EXP | The saveForwardAttachments procedure in the Compose Mail functionality in vtiger CRM 5.0.4 allows remote authenticated users to execute arbitrary code… | Patch early | 9.0 high | 10.9% | 2009-09-18 |
| CVE-2009-0347 EXP | Open redirect vulnerability in cs.html in the Autonomy (formerly Verity) Ultraseek search engine allows remote attackers to redirect users to arbitrar… | Patch early | 5.8 medium | 10.9% | 2009-01-29 |
| CVE-2019-1343 EXP | A denial of service vulnerability exists when Windows improperly handles objects in memory, aka 'Windows Denial of Service Vulnerability'. This CVE ID… | Patch early | 6.5 medium | 10.9% | 2019-10-10 |
| CVE-2019-1346 EXP | A denial of service vulnerability exists when Windows improperly handles objects in memory, aka 'Windows Denial of Service Vulnerability'. This CVE ID… | Patch early | 6.5 medium | 10.9% | 2019-10-10 |
| CVE-2012-2385 EXP | The terminal dispatcher in mosh before 1.2.1 allows remote authenticated users to cause a denial of service (long loop and CPU consumption) via an esc… | Patch early | 4.0 medium | 10.9% | 2012-06-29 |
| CVE-2000-0059 EXP | PHP3 with safe_mode enabled does not properly filter shell metacharacters from commands that are executed by popen, which could allow remote attackers… | Patch early | 10.0 high | 10.9% | 2000-01-04 |
| CVE-2012-3792 EXP | Pro-face WinGP PC Runtime 3.1.00 and earlier, and ProServr.exe in Pro-face Pro-Server EX 1.30.000 and earlier, allows remote attackers to cause a deni… | Patch early | 5.0 medium | 10.9% | 2012-06-25 |
| CVE-2012-3795 EXP | Pro-face WinGP PC Runtime 3.1.00 and earlier, and ProServr.exe in Pro-face Pro-Server EX 1.30.000 and earlier, allows remote attackers to cause a deni… | Patch early | 5.0 medium | 10.9% | 2012-06-25 |
| CVE-2007-5709 EXP | Stack-based buffer overflow in Sony SonicStage CONNECT Player (CP) 4.3 allows remote attackers to execute arbitrary code via a long file name in an M3… | Patch early | 9.3 high | 10.9% | 2007-10-30 |
| CVE-2005-0862 EXP | Multiple PHP remote file inclusion vulnerabilities in PHPOpenChat 3.0.1 and earlier allow remote attackers to execute arbitrary PHP code via the phpbb… | Patch early | 7.5 high | 10.9% | 2005-05-02 |
| CVE-2011-4926 EXP | Cross-site scripting (XSS) vulnerability in adminimize/adminimize_page.php in the Adminimize plugin before 1.7.22 for WordPress allows remote attacker… | Patch early | 4.3 medium | 10.9% | 2012-08-29 |
| CVE-2004-0777 EXP | Format string vulnerability in the auth_debug function in Courier-IMAP 1.6.0 through 2.2.1 and 3.x through 3.0.3, when login debugging (DEBUG_LOGIN) i… | Patch early | 7.5 high | 10.9% | 2004-10-20 |
| CVE-2019-14750 EXP | An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. Stored XSS exists in setup/install.php. It was observed that no input sani… | Patch early | 6.1 medium | 10.9% | 2019-08-07 |
| CVE-2009-5018 EXP | Stack-based buffer overflow in gif2png.c in gif2png 2.5.3 and earlier might allow context-dependent attackers to execute arbitrary code via a long com… | Patch early | 6.8 medium | 10.9% | 2011-01-14 |
| CVE-2018-12053 EXP | Arbitrary File Deletion exists in PHP Scripts Mall Schools Alert Management Script via the img parameter in delete_img.php by using directory traversa… | Patch early | 7.5 high | 10.9% | 2018-06-08 |
| CVE-2009-1800 EXP | Stack-based buffer overflow in the Chinagames CGAgent ActiveX control 1.x in CGAgent.dll, as distributed in Chinagames iGame 2009, allows remote attac… | Patch early | 7.5 high | 10.9% | 2009-05-28 |
| CVE-2011-5106 EXP | Cross-site scripting (XSS) vulnerability in edit-post.php in the Flexible Custom Post Type plugin before 0.1.7 for WordPress allows remote attackers t… | Patch early | 4.3 medium | 10.9% | 2012-08-23 |
| CVE-2003-0849 EXP | Buffer overflow in net.c for cfengine 2.x before 2.0.8 allows remote attackers to execute arbitrary code via certain packets with modified length valu… | Patch early | 7.5 high | 10.9% | 2003-11-17 |
| CVE-2007-4897 EXP | pwlib, as used by Ekiga 2.0.5 and possibly other products, allows remote attackers to cause a denial of service (application crash) via a long argumen… | Patch early | 5.0 medium | 10.9% | 2007-09-14 |
| CVE-2007-3406 EXP | Multiple absolute path traversal vulnerabilities in Microsoft Internet Explorer 6 on Windows XP SP2 allow remote attackers to access arbitrary local f… | Patch early | 4.3 medium | 10.9% | 2007-06-26 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt