CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
402,624 CVEs
1,734 on KEV
17,294 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-07
320,683 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2006-6478 EXP | Multiple SQL injection vulnerabilities in AnnonceScriptHP 2.0 allow remote attackers to execute arbitrary SQL commands via the (1) id parameter in (a)… | Patch early | 7.5 high | 10.5% | 2006-12-12 |
| CVE-2006-2025 EXP | Integer overflow in the TIFFFetchData function in tif_dirread.c for libtiff before 3.8.1 allows context-dependent attackers to cause a denial of servi… | Patch early | 6.5 medium | 10.5% | 2006-04-25 |
| CVE-2006-0468 EXP | CommuniGate Pro Core Server before 5.0.7 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via LDAP mes… | Patch early | 7.5 high | 10.5% | 2006-01-30 |
| CVE-2019-0612 EXP | A security feature bypass vulnerability exists when Click2Play protection in Microsoft Edge improperly handles flash objects. By itself, this bypass v… | Patch early | 5.3 medium | 10.5% | 2019-04-08 |
| CVE-2000-0690 EXP | Auction Weaver CGI script 1.02 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the fromfile parameter. | Patch early | 10.0 high | 10.5% | 2000-10-20 |
| CVE-2021-31682 EXP | The login portal for the Automated Logic WebCTRL/WebCTRL OEM web application contains a vulnerability that allows for reflected XSS attacks due to the… | Patch early | 6.1 medium | 10.5% | 2021-10-22 |
| CVE-2012-0698 EXP | tcsd in TrouSerS before 0.3.10 allows remote attackers to cause a denial of service (daemon crash) via a crafted type_offset value in a TCP packet to… | Patch early | 5.0 medium | 10.5% | 2012-11-26 |
| CVE-2008-4587 EXP | Insecure method vulnerability in the MSVNClientDownloadManager61Lib.DownloadManager.1 ActiveX control (ISDM.exe 6.1.100.61372) in Macrovision FLEXnet… | Patch early | 9.3 high | 10.5% | 2008-10-15 |
| CVE-2006-4438 EXP | Heap-based buffer overflow in SpIDer for Dr.Web Scanner for Linux 4.33, and possibly earlier versions, allows remote attackers to execute arbitrary co… | Patch early | 6.4 medium | 10.5% | 2006-09-20 |
| CVE-2022-46552 EXP | D-Link DIR-846 Firmware FW100A53DBR was discovered to contain a remote command execution (RCE) vulnerability via the lan(0)_dhcps_staticlist parameter… | Patch early | 8.8 high | 10.5% | 2023-02-02 |
| CVE-2015-4616 EXP | Directory traversal vulnerability in includes/MapPinImageSave.php in the Easy2Map plugin before 1.2.5 for WordPress allows remote attackers to create… | Patch early | 5.0 medium | 10.5% | 2015-07-08 |
| CVE-2014-1632 EXP | htdocs/setup/index.php in Eventum before 2.3.5 allows remote attackers to inject and execute arbitrary PHP code via the hostname parameter. | Patch early | 8.1 high | 10.5% | 2018-01-31 |
| CVE-2006-0354 EXP | Cisco IOS before 12.3-7-JA2 on Aironet Wireless Access Points (WAP) allows remote authenticated users to cause a denial of service (termination of pac… | Patch early | 5.5 medium | 10.5% | 2006-01-22 |
| CVE-2006-4899 EXP | The ePPIServlet script in Computer Associates (CA) eTrust Security Command Center 1.0 and r8 up to SP1 CR2, when running on Windows, allows remote att… | Patch early | 5.0 medium | 10.5% | 2006-09-22 |
| CVE-2014-0995 EXP | The Standalone Enqueue Server in SAP Netweaver 7.20, 7.01, and earlier allows remote attackers to cause a denial of service (uncontrolled recursion an… | Patch early | 5.0 medium | 10.5% | 2014-11-06 |
| CVE-1999-0018 EXP | Buffer overflow in statd allows root privileges. | Patch early | 10.0 high | 10.5% | 1997-12-05 |
| CVE-2013-4474 EXP | Format string vulnerability in the extractPages function in utils/pdfseparate.cc in poppler before 0.24.3 allows remote attackers to cause a denial of… | Patch early | 5.0 medium | 10.5% | 2013-11-23 |
| CVE-2003-1096 EXP | The Cisco LEAP challenge/response authentication mechanism uses passwords in a way that is susceptible to dictionary attacks, which makes it easier fo… | Patch early | 10.0 high | 10.5% | 2003-12-31 |
| CVE-2020-25820 EXP | BigBlueButton before 2.2.7 allows remote authenticated users to read local files and conduct SSRF attacks via an uploaded Office document that has a c… | Patch early | 6.5 medium | 10.5% | 2020-10-21 |
| CVE-2017-2536 EXP | An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. Safari before 10.1.1 is affected. tvOS before 10.2.1 is affected. Th… | Patch early | 8.8 high | 10.5% | 2017-05-22 |
| CVE-2010-0167 EXP | The browser engine in Mozilla Firefox 3.0.x before 3.0.18, 3.5.x before 3.5.8, and 3.6.x before 3.6.2; Thunderbird before 3.0.2; and SeaMonkey before… | Patch early | 9.3 high | 10.5% | 2010-03-25 |
| CVE-2010-0317 EXP | Novell Netware 6.5 SP8 allows remote attackers to cause a denial of service (NULL pointer dereference, memory consumption, ABEND, and crash) via a lar… | Patch early | 7.8 high | 10.5% | 2010-01-15 |
| CVE-2009-1019 EXP | Unspecified vulnerability in the Network Authentication component in Oracle Database 9.2.0.8, 9.2.0.8DV, 10.1.0.5, 10.2.0.4, and 11.1.0.7 allows remot… | Patch early | 7.5 high | 10.5% | 2009-07-14 |
| CVE-2008-2719 EXP | Off-by-one error in the ppscan function (preproc.c) in Netwide Assembler (NASM) 2.02 allows context-dependent attackers to cause a denial of service (… | Patch early | 6.8 medium | 10.5% | 2008-06-16 |
| CVE-2019-7272 EXP | Optergy Proton/Enterprise devices allow Username Disclosure. | Patch early | 5.3 medium | 10.5% | 2019-07-01 |
| CVE-2008-4453 EXP | The GdPicture (1) Light Imaging Toolkit 4.7.1 GdPicture4S.Imaging ActiveX control (gdpicture4s.ocx) 4.7.0.1 and (2) Pro Imaging SDK 5.7.1 GdPicturePro… | Patch early | 9.3 high | 10.5% | 2008-10-06 |
| CVE-2007-5019 EXP | Buffer overflow in the Sun Java Web Start ActiveX control in Java Runtime Environment (JRE) 1.6.0_X allows remote attackers to have an unknown impact… | Patch early | 10.0 high | 10.5% | 2007-09-20 |
| CVE-2004-2549 EXP | Nortel Wireless LAN (WLAN) Access Point (AP) 2220, 2221, and 2225 allow remote attackers to cause a denial of service (service crash) via a TCP reques… | Patch early | 5.0 medium | 10.5% | 2004-12-31 |
| CVE-2009-1169 EXP | The txMozillaXSLTProcessor::TransformToDoc function in Mozilla Firefox before 3.0.8 and SeaMonkey before 1.1.16 allows remote attackers to cause a den… | Patch early | 9.3 high | 10.5% | 2009-03-27 |
| CVE-1999-0148 EXP | The handler CGI program in IRIX allows arbitrary command execution. | Patch early | 7.5 high | 10.5% | 1997-09-01 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt