CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
402,599 CVEs
1,734 on KEV
17,294 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-07
320,628 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2011-4342 EXP | PHP remote file inclusion vulnerability in wp_xml_export.php in the BackWPup plugin before 1.7.2 for WordPress allows remote attackers to execute arbi… | Patch early | 7.5 high | 10.7% | 2012-10-08 |
| CVE-2006-1770 EXP | Multiple PHP remote file inclusion vulnerabilities in Azerbaijan Design & Development Group (AZDG) AzDGVote allow remote attackers to execute arbitrar… | Patch early | 10.0 high | 10.7% | 2006-04-13 |
| CVE-2007-4924 EXP | The Open Phone Abstraction Library (opal), as used by (1) Ekiga before 2.0.10 and (2) OpenH323 before 2.2.4, allows remote attackers to cause a denial… | Patch early | 5.0 medium | 10.7% | 2007-10-08 |
| CVE-2007-1643 EXP | Multiple PHP remote file inclusion vulnerabilities in LAN Management System (LMS) 1.8.9 Vala and earlier allow remote attackers to execute arbitrary P… | Patch early | 10.0 high | 10.7% | 2007-03-24 |
| CVE-2004-2685 EXP | Buffer overflow in YoungZSoft CCProxy 6.2 and earlier allows remote attackers to execute arbitrary code via a long address in a ping (p) command to th… | Patch early | 7.5 high | 10.7% | 2004-12-31 |
| CVE-2017-3133 EXP | A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.6.0 and earlier allows attackers to execute unauthorized code or commands via the… | Patch early | 6.1 medium | 10.7% | 2017-09-12 |
| CVE-2021-27890 EXP | SQL Injection vulnerablity in MyBB before 1.8.26 via theme properties included in theme XML files. | Patch early | 8.8 high | 10.7% | 2021-03-15 |
| CVE-2008-1965 EXP | Argument injection vulnerability in the cai: URI handler in rcplauncher in IBM Lotus Expeditor Client for Desktop 6.1.1 and 6.1.2, as used by Lotus Sy… | Patch early | 9.3 high | 10.7% | 2008-04-25 |
| CVE-2021-28419 EXP | The "order_col" parameter in archive.php of SEO Panel 4.8.0 is vulnerable to time-based blind SQL injection, which leads to the ability to retrieve al… | Patch early | 7.2 high | 10.7% | 2021-03-18 |
| CVE-2008-5032 EXP | Stack-based buffer overflow in VideoLAN VLC media player 0.5.0 through 0.9.5 might allow user-assisted attackers to execute arbitrary code via the hea… | Patch early | 9.3 high | 10.7% | 2008-11-10 |
| CVE-2022-38841 EXP | Linksys AX3200 1.1.00 is vulnerable to OS command injection by authenticated users via shell metacharacters to the diagnostics traceroute page. | Patch early | 8.8 high | 10.7% | 2023-04-16 |
| CVE-2007-4738 EXP | Multiple PHP remote file inclusion vulnerabilities in SpeedTech PHP Library (STPHPLibrary) 0.8.0 allow remote attackers to execute arbitrary PHP code… | Patch early | 7.5 high | 10.7% | 2007-09-06 |
| CVE-2002-1077 EXP | IPSwitch IMail Web Calendaring service (iwebcal) allows remote attackers to cause a denial of service (crash) via an HTTP POST request without a Conte… | Patch early | 5.0 medium | 10.7% | 2002-10-04 |
| CVE-2006-6026 EXP | Heap-based buffer overflow in Real Networks Helix Server and Helix Mobile Server before 11.1.3, and Helix DNA Server 11.0 and 11.1, allows remote atta… | Patch early | 10.0 high | 10.7% | 2006-11-21 |
| CVE-2009-3115 EXP | SolarWinds TFTP Server 9.2.0.111 and earlier allows remote attackers to cause a denial of service (service stop) via a crafted Option Acknowledgement… | Patch early | 5.0 medium | 10.7% | 2009-09-09 |
| CVE-2017-15806 EXP | The send function in the ezcMailMtaTransport class in Zeta Components Mail before 1.8.2 does not properly restrict the set of characters used in the e… | Patch early | 8.1 high | 10.7% | 2017-11-15 |
| CVE-2001-0253 EXP | Directory traversal vulnerability in hsx.cgi program in iWeb Hyperseek 2000 allows remote attackers to read arbitrary files and directories via a .. (… | Patch early | 5.0 medium | 10.6% | 2001-06-02 |
| CVE-2005-1628 EXP | apage.cgi in WebAPP 0.9.9.2.1, and possibly earlier versions, allows remote attackers to execute arbitrary commands via shell metacharacters in the f… | Patch early | 7.5 high | 10.6% | 2005-05-17 |
| CVE-2017-17095 EXP | tools/pal2rgb.c in pal2rgb in LibTIFF 4.0.9 allows remote attackers to cause a denial of service (TIFFSetupStrips heap-based buffer overflow and appli… | Patch early | 8.8 high | 10.6% | 2017-12-02 |
| CVE-2004-2442 EXP | Multiple interpretation error in various F-Secure Anti-Virus products, including Workstation 5.43 and earlier, Windows Servers 5.50 and earlier, MIMEs… | Patch early | 5.0 medium | 10.6% | 2004-12-31 |
| CVE-2008-6080 EXP | Directory traversal vulnerability in download.php in the ionFiles (com_ionfiles) 4.4.2 component for Joomla! allows remote attackers to read arbitrary… | Patch early | 5.0 medium | 10.6% | 2009-02-06 |
| CVE-2019-8937 EXP | HotelDruid 2.3.0 has XSS affecting the nsextt, cambia1, mese_fine, origine, and anno parameters in creaprezzi.php, tabella3.php, personalizza.php, and… | Patch early | 6.1 medium | 10.6% | 2019-05-17 |
| CVE-2004-1986 EXP | Directory traversal vulnerability in modules.php in Coppermine Photo Gallery 1.2.2b and 1.2.0 RC4 allows remote attackers with administrative privileg… | Patch early | 5.0 medium | 10.6% | 2004-04-04 |
| CVE-2014-0683 EXP | The web management interface on the Cisco RV110W firewall with firmware 1.2.0.9 and earlier, RV215W router with firmware 1.1.0.5 and earlier, and CVR1… | Patch early | 10.0 high | 10.6% | 2014-03-06 |
| CVE-2009-0369 EXP | Microsoft Internet Explorer 7 allows remote attackers to trick a user into visiting an arbitrary URL via an onclick action that moves a crafted elemen… | Patch early | 4.3 medium | 10.6% | 2009-01-30 |
| CVE-2000-0287 EXP | The BizDB CGI script bizdb-search.cgi allows remote attackers to execute arbitrary commands via shell metacharacters in the dbname parameter. | Patch early | 10.0 high | 10.6% | 2000-04-12 |
| CVE-2019-10969 EXP | Moxa EDR 810, all versions 5.1 and prior, allows an authenticated attacker to abuse the ping feature to execute unauthorized commands on the router, w… | Patch early | 7.2 high | 10.6% | 2019-10-08 |
| CVE-2015-4117 EXP | Vesta Control Panel before 0.9.8-14 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the backup parameter t… | Patch early | 8.8 high | 10.6% | 2018-02-28 |
| CVE-2002-0606 EXP | Buffer overflow in 3Cdaemon 2.0 FTP server allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via long c… | Patch early | 7.5 high | 10.6% | 2002-06-18 |
| CVE-2001-1112 EXP | Buffer overflow in EFTP 2.0.7.337 allows remote attackers to execute arbitrary code by uploading a .lnk file containing a large number of characters. | Patch early | 7.5 high | 10.6% | 2001-09-12 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt