CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
402,624 CVEs
1,734 on KEV
17,294 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-07
320,683 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2003-0195 EXP | CUPS before 1.1.19 allows remote attackers to cause a denial of service via a partial printing request to the IPP port (631), which does not time out. | Patch early | 5.0 medium | 10.6% | 2003-06-16 |
| CVE-2012-3796 EXP | Pro-face WinGP PC Runtime 3.1.00 and earlier, and ProServr.exe in Pro-face Pro-Server EX 1.30.000 and earlier, allows remote attackers to obtain sensi… | Patch early | 5.0 medium | 10.6% | 2012-06-25 |
| CVE-2010-5301 EXP | Stack-based buffer overflow in Kolibri 2.0 allows remote attackers to execute arbitrary code via a long URI in a HEAD request. | Patch early | 7.5 high | 10.6% | 2014-06-13 |
| CVE-2013-6618 EXP | jsdm/ajax/port.php in J-Web in Juniper Junos before 10.4R13, 11.4 before 11.4R7, 12.1 before 12.1R5, 12.2 before 12.2R3, and 12.3 before 12.3R1 allows… | Patch early | 9.0 high | 10.6% | 2013-11-05 |
| CVE-2014-1889 EXP | The Group creation process in the Buddypress plugin before 1.9.2 for WordPress allows remote authenticated users to gain control of arbitrary groups b… | Patch early | 6.5 medium | 10.6% | 2018-04-10 |
| CVE-2009-4227 EXP | Stack-based buffer overflow in the read_1_3_textobject function in f_readold.c in Xfig 3.2.5b and earlier, and in the read_textobject function in read… | Patch early | 6.8 medium | 10.6% | 2009-12-08 |
| CVE-2018-1756 EXP | IBM Security Identity Governance and Intelligence 5.2.3.2 and 5.2.4 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL… | Patch early | 7.5 high | 10.6% | 2018-09-07 |
| CVE-2002-1489 EXP | Buffer overflow in PlanetDNS PlanetWeb 1.14 and earlier allows remote attackers to execute arbitrary code via (1) an HTTP GET request with a long URL… | Patch early | 7.5 high | 10.6% | 2003-04-02 |
| CVE-2015-3205 EXP | libmimedir allows remote attackers to execute arbitrary code via a VCF file with two NULL bytes at the end of the file, related to "free" function cal… | Patch early | 7.5 high | 10.6% | 2015-06-16 |
| CVE-2013-7204 EXP | Cross-site request forgery (CSRF) vulnerability in set_users.cgi in Conceptronic CIPCAMPTIWL Camera 1.0 with firmware 21.37.2.49 allows remote attacke… | Patch early | 6.8 medium | 10.6% | 2014-01-17 |
| CVE-2013-2131 EXP | Format string vulnerability in the rrdtool module 1.4.7 for Python, as used in Zenoss, allows context-dependent attackers to cause a denial of service… | Patch early | 5.0 medium | 10.6% | 2015-01-04 |
| CVE-2021-24300 EXP | The slider import search feature of the PickPlugins Product Slider for WooCommerce WordPress plugin before 1.13.22 did not properly sanitised the keyw… | Patch early | 6.1 medium | 10.6% | 2021-05-24 |
| CVE-2009-2446 EXP | Multiple format string vulnerabilities in the dispatch_command function in libmysqld/sql_parse.cc in mysqld in MySQL 4.0.0 through 5.0.83 allow remote… | Patch early | 8.5 high | 10.6% | 2009-07-13 |
| CVE-2000-1053 EXP | Allaire JRun 2.3.3 server allows remote attackers to compile and execute JSP code by inserting it via a cross-site scripting (CSS) attack and directly… | Patch early | 10.0 high | 10.6% | 2000-12-11 |
| CVE-2011-1487 EXP | The (1) lc, (2) lcfirst, (3) uc, and (4) ucfirst functions in Perl 5.10.x, 5.11.x, and 5.12.x through 5.12.3, and 5.13.x through 5.13.11, do not apply… | Patch early | 5.0 medium | 10.6% | 2011-04-11 |
| CVE-2007-1699 EXP | Multiple PHP remote file inclusion vulnerabilities in the SWmenu (com_swmenupro and com_swmenufree) 4.0 component for Mambo and Joomla! allow remote a… | Patch early | 10.0 high | 10.6% | 2007-03-27 |
| CVE-2019-9831 EXP | The AirMore application through 1.6.1 for Android allows remote attackers to cause a denial of service (system hang) via many simultaneous /?Key=Phone… | Patch early | 7.5 high | 10.6% | 2019-03-15 |
| CVE-2006-3472 EXP | Microsoft Internet Explorer 6.0 and 6.0 SP1 allows remote attackers to cause a denial of service via an HTML page with an A tag containing a long titl… | Patch early | 5.0 medium | 10.6% | 2006-07-10 |
| CVE-2007-6325 EXP | PHP remote file inclusion vulnerability in adminbereich/designconfig.php in Fastpublish CMS 1.9999 allows remote attackers to execute arbitrary PHP co… | Patch early | 6.8 medium | 10.6% | 2007-12-13 |
| CVE-2006-6811 EXP | KsIRC 1.3.12 allows remote attackers to cause a denial of service (crash) via a long PRIVMSG string when connecting to an Internet Relay Chat (IRC) se… | Patch early | 6.5 medium | 10.6% | 2006-12-29 |
| CVE-2005-4556 EXP | PHP remote file include vulnerability in IceWarp Web Mail 5.5.1, as used by Merak Mail Server 8.3.0r and VisNetic Mail Server version 8.3.0 build 1, w… | Patch early | 7.5 high | 10.6% | 2005-12-28 |
| CVE-2012-6499 EXP | Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows remote attackers to redirect u… | Patch early | 5.8 medium | 10.6% | 2013-01-12 |
| CVE-2010-3573 EXP | Unspecified vulnerability in the Networking component in Oracle Java SE and Java for Business 6 Update 21 and 5.0 Update 25 allows remote attackers to… | Patch early | 5.1 medium | 10.6% | 2010-10-19 |
| CVE-2015-6568 EXP | Wolf CMS before 0.8.3.1 allows unrestricted file rename and PHP Code Execution because admin/plugin/file_manager/browse/ (aka the filemanager) does no… | Patch early | 8.8 high | 10.6% | 2017-04-14 |
| CVE-2011-3575 EXP | Stack-based buffer overflow in the NSFComputeEvaluateExt function in Nnotes.dll in IBM Lotus Domino 8.5.2 allows remote authenticated users to execute… | Patch early | 9.0 high | 10.5% | 2011-09-19 |
| CVE-2018-12520 EXP | An issue was discovered in ntopng 3.4 before 3.4.180617. The PRNG involved in the generation of session IDs is not seeded at program startup. This res… | Patch early | 8.1 high | 10.5% | 2018-07-05 |
| CVE-2006-0720 EXP | Stack-based buffer overflow in Nullsoft Winamp 5.12 and 5.13 allows user-assisted attackers to cause a denial of service (crash) and possibly execute… | Patch early | 7.6 high | 10.5% | 2006-02-23 |
| CVE-2010-2621 EXP | The QSslSocketBackendPrivate::transmit function in src_network_ssl_qsslsocket_openssl.cpp in Qt 4.6.3 and earlier allows remote attackers to cause a d… | Patch early | 5.0 medium | 10.5% | 2010-07-02 |
| CVE-2002-0252 EXP | Buffer overflow in Apple QuickTime Player 5.01 and 5.02 allows remote web servers to execute arbitrary code via a response containing a long Content-T… | Patch early | 7.5 high | 10.5% | 2002-05-29 |
| CVE-2001-0557 EXP | T. Hauck Jana Webserver 1.46 and earlier allows a remote attacker to view arbitrary files via a '..' (dot dot) attack which is URL encoded (%2e%2e). | Patch early | 5.0 medium | 10.5% | 2001-08-14 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt