CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
402,674 CVEs
1,734 on KEV
17,294 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-07
402,674 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2019-0571 EXP | An elevation of privilege vulnerability exists when the Windows Data Sharing Service improperly handles file operations, aka "Windows Data Sharing Ser… | Patch early | 7.8 high | 15.8% | 2019-01-08 |
| CVE-2018-11412 EXP | In the Linux kernel 4.13 through 4.16.11, ext4_read_inline_data() in fs/ext4/inline.c performs a memcpy with an untrusted length value in certain circ… | Patch early | 5.9 medium | 15.8% | 2018-05-24 |
| CVE-2011-0518 EXP | Directory traversal vulnerability in core/lib/router.php in LotusCMS Fraise 3.0, when magic_quotes_gpc is disabled, allows remote attackers to include… | Patch early | 5.1 medium | 15.8% | 2011-01-20 |
| CVE-2006-5768 EXP | Multiple PHP remote file inclusion vulnerabilities in Cyberfolio 2.0 RC1 and earlier, when register_globals is enabled, allow remote attackers to exec… | Patch early | 7.5 high | 15.8% | 2006-11-06 |
| CVE-2010-2128 EXP | Directory traversal vulnerability in the JE Quotation Form (com_jequoteform) component 1.0b1 for Joomla! allows remote attackers to read arbitrary fil… | Patch early | 7.5 high | 15.8% | 2010-06-01 |
| CVE-2007-3855 EXP | Multiple unspecified vulnerabilities in Oracle Database 9.0.1.5+, 9.2.0.8, 9.2.0.8DV, 10.1.0.5, and 10.2.0.3 allows remote authenticated users to have… | Patch early | 6.5 medium | 15.8% | 2007-07-18 |
| CVE-2018-1821 EXP | IBM Operational Decision Management 8.5, 8.6, 8.7, 8.8, and 8.9 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data… | Patch early | 7.1 high | 15.8% | 2018-12-13 |
| CVE-2010-2033 EXP | Directory traversal vulnerability in the Percha Multicategory Article (com_perchacategoriestree) component 0.6 for Joomla! allows remote attackers to… | Patch early | 7.5 high | 15.8% | 2010-05-25 |
| CVE-2020-10230 EXP | CentOS-WebPanel.com (aka CWP) CentOS Web Panel (for CentOS 6 and 7) allows SQL Injection via the /cwp_{SESSION_HASH}/admin/loader_ajax.php term parame… | Patch early | 9.8 critical | 15.8% | 2020-03-16 |
| CVE-2012-5409 EXP | AscoServer.exe in the server in Siemens SiPass integrated MP2.6 and earlier does not properly handle IOCP RPC messages received over an Ethernet netwo… | Patch early | 10.0 high | 15.8% | 2012-11-01 |
| CVE-2016-7866 EXP | Adobe Animate versions 15.2.1.95 and earlier have an exploitable memory corruption vulnerability. Successful exploitation could lead to arbitrary code… | Patch early | 9.8 critical | 15.8% | 2016-12-15 |
| CVE-2017-3549 EXP | Vulnerability in the Oracle Scripting component of Oracle E-Business Suite (subcomponent: Scripting Administration). Supported versions that are affec… | Patch early | 9.1 critical | 15.8% | 2017-04-24 |
| CVE-2010-2035 EXP | Directory traversal vulnerability in the Percha Gallery (com_perchagallery) component 1.6 Beta for Joomla! allows remote attackers to read arbitrary f… | Patch early | 7.5 high | 15.8% | 2010-05-25 |
| CVE-2025-4094 EXP | The DIGITS: WordPress Mobile Number Signup and Login WordPress plugin before 8.4.6.1 does not rate limit OTP validation attempts, making it straightfo… | Patch early | 9.8 critical | 15.8% | 2025-05-21 |
| CVE-2009-0543 EXP | ProFTPD Server 1.3.1, with NLS support enabled, allows remote attackers to bypass SQL injection protection mechanisms via invalid, encoded multibyte c… | Patch early | 6.8 medium | 15.8% | 2009-02-12 |
| CVE-2006-6310 EXP | Microsoft Internet Explorer 6.0 SP1 and earlier allows remote attackers to cause a denial of service (crash) via an invalid src attribute value ("?")… | Patch early | 5.0 medium | 15.8% | 2006-12-06 |
| CVE-2021-46379 EXP | DLink DIR850 ET850-1.08TRb03 is affected by an incorrect access control vulnerability through URL redirection to untrusted site. | Patch early | 6.1 medium | 15.8% | 2022-03-04 |
| CVE-2004-0173 EXP | Directory traversal vulnerability in Apache 1.3.29 and earlier, and Apache 2.0.48 and earlier, when running on Cygwin, allows remote attackers to read… | Patch early | 5.0 medium | 15.8% | 2004-04-15 |
| CVE-2002-0862 EXP | The (1) CertGetCertificateChain, (2) CertVerifyCertificateChainPolicy, and (3) WinVerifyTrust APIs within the CryptoAPI for Microsoft products includi… | Patch early | 6.8 medium | 15.8% | 2002-10-04 |
| CVE-2015-3623 EXP | XML external entity (XXE) vulnerability in QlikTech Qlikview before 11.20 SR12 allows remote attackers to conduct server-side request forgery (SSRF) a… | Patch early | 6.4 medium | 15.8% | 2015-09-16 |
| CVE-2012-6429 EXP | Buffer overflow in the PrepareSync method in the SyncService.dll ActiveX control in Samsung Kies before 2.5.1.12123_2_7 allows remote attackers to exe… | Patch early | 10.0 high | 15.8% | 2014-04-04 |
| CVE-2006-5048 EXP | Multiple PHP remote file inclusion vulnerabilities in Security Images (com_securityimages) component 3.0.5 and earlier for Joomla! allow remote attack… | Patch early | 6.8 medium | 15.8% | 2006-09-27 |
| CVE-2022-2651 EXP | Authentication Bypass by Primary Weakness in GitHub repository bookwyrm-social/bookwyrm prior to 0.4.5. | Patch early | 9.8 critical | 15.8% | 2022-08-04 |
| CVE-2005-0566 EXP | Buffer overflow in Golden FTP Server Pro (goldenftpd) 2.x allows remote attackers to execute arbitrary code via a long RNTO command. | Patch early | 7.5 high | 15.7% | 2005-01-22 |
| CVE-2010-1759 EXP | Use-after-free vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, allows r… | Patch early | 9.3 high | 15.7% | 2010-06-11 |
| CVE-2021-43136 EXP | An authentication bypass issue in FormaLMS <= 2.4.4 allows an attacker to bypass the authentication mechanism and obtain a valid access to the platfor… | Patch early | 9.8 critical | 15.7% | 2021-11-10 |
| CVE-2011-1206 EXP | Stack-based buffer overflow in the server process in ibmslapd.exe in IBM Tivoli Directory Server (TDS) 5.2 before 5.2.0.5-TIV-ITDS-IF0010, 6.0 before… | Patch early | 10.0 high | 15.7% | 2011-04-21 |
| CVE-2010-1306 EXP | Directory traversal vulnerability in the Picasa (com_joomlapicasa2) component 2.0 and 2.0.5 for Joomla! allows remote attackers to read arbitrary loca… | Patch early | 7.5 high | 15.7% | 2010-04-08 |
| CVE-2010-1875 EXP | Directory traversal vulnerability in the Real Estate Property (com_properties) component 3.1.22-03 for Joomla! allows remote attackers to read arbitra… | Patch early | 7.5 high | 15.7% | 2010-05-12 |
| CVE-2018-1218 EXP | In Dell EMC NetWorker versions prior to 9.2.1.1, versions prior to 9.1.1.6, 9.0.x, and versions prior to 8.2.4.11, the 'nsrd' daemon causes a buffer o… | Patch early | 7.5 high | 15.7% | 2018-03-19 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt