CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
403,041 CVEs
1,734 on KEV
17,293 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-08
150,393 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2016-1848 EXP | QuickTime in Apple OS X before 10.11.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafte… | Patch early | 7.8 high | 5.5% | 2016-05-20 |
| CVE-2005-4270 EXP | Buffer overflow in Watchfire AppScan QA 5.0.609 and 5.0.134 allows remote web servers to execute arbitrary code via an HTTP 401 response with a WWW-Au… | Patch early | 7.5 high | 5.5% | 2005-12-15 |
| CVE-2017-16542 EXP | Zoho ManageEngine Applications Manager 13 before build 13500 allows Post-authentication SQL injection via the name parameter in a manageApplications.d… | Patch early | 8.8 high | 5.5% | 2017-11-05 |
| CVE-2009-4148 EXP | DAZ Studio 2.3.3.161, 2.3.3.163, and 3.0.1.135 allows remote attackers to execute arbitrary JavaScript code via a (1) .ds, (2) .dsa, (3) .dse, or (4)… | Patch early | 9.3 high | 5.5% | 2009-12-04 |
| CVE-2002-1773 EXP | Buffer overflow in ICQ 2.6x for MacOS X 10.0 through 10.1.2 allows remote attackers to cause a denial of service and possibly execute arbitrary code v… | Patch early | 7.5 high | 5.5% | 2002-12-31 |
| CVE-2007-2744 EXP | Stack-based buffer overflow in the PrecisionID Barcode 1.9 ActiveX control in PrecisionID_Barcode.dll allows remote attackers to cause a denial of ser… | Patch early | 7.5 high | 5.5% | 2007-05-17 |
| CVE-2007-2814 EXP | Multiple stack-based buffer overflows in the Pegasus ImagN' ActiveX control (IMW32O40.OCX) 4.00.041 allow remote attackers to execute arbitrary code v… | Patch early | 7.5 high | 5.5% | 2007-05-22 |
| CVE-2007-0911 EXP | Off-by-one error in the str_ireplace function in PHP 5.2.1 might allow context-dependent attackers to cause a denial of service (crash). | Patch early | 7.8 high | 5.5% | 2007-02-13 |
| CVE-2009-3518 EXP | Argument injection vulnerability in the iim: URI handler in IBMIM.exe in IBM Installation Manager 1.3.2 and earlier, as used in IBM Rational Robot and… | Patch early | 9.3 high | 5.5% | 2009-10-01 |
| CVE-2025-31131 EXP | YesWiki is a wiki system written in PHP. The squelette parameter is vulnerable to path traversal attacks, enabling read access to arbitrary files on t… | Patch early | 8.6 high | 5.5% | 2025-04-01 |
| CVE-2015-8285 EXP | The webssx.sys driver in QuickHeal 16.00 allows remote attackers to cause a denial of service. | Patch early | 7.5 high | 5.5% | 2017-04-20 |
| CVE-2002-1930 EXP | Buffer overflow in AN HTTPd 1.38 through 1.4.1c allows remote attackers to execute arbitrary code via a SOCKS4 request with a long username. | Patch early | 7.5 high | 5.5% | 2002-12-31 |
| CVE-2010-5280 EXP | Directory traversal vulnerability in the Community Builder Enhanced (CBE) (com_cbe) component 1.4.8, 1.4.9, and 1.4.10 for Joomla! allows remote attac… | Patch early | 7.5 high | 5.5% | 2012-11-26 |
| CVE-2007-1552 EXP | Unrestricted file upload vulnerability in usercp.php in MetaForum 0.513 Beta restricts file types based on the MIME type in the Content-type HTTP head… | Patch early | 7.5 high | 5.5% | 2007-03-20 |
| CVE-2017-15221 EXP | ASX to MP3 converter 3.1.3.7.2010.11.05 has a buffer overflow via a crafted M3U file, a related issue to CVE-2009-1324. | Patch early | 7.8 high | 5.5% | 2017-10-16 |
| CVE-2016-1743 EXP | The Intel driver in the Graphics Drivers subsystem in Apple OS X before 10.11.4 allows attackers to execute arbitrary code in a privileged context or… | Patch early | 7.8 high | 5.5% | 2016-03-24 |
| CVE-2005-2246 EXP | Multiple PHP remote file inclusion vulnerabilities in iPhotoAlbum 1.1 allow remote attackers to execute arbitrary code via the (1) doc_path parameter… | Patch early | 7.5 high | 5.5% | 2005-07-12 |
| CVE-2009-3364 EXP | Stack-based buffer overflow in FTPShell Client 4.1 RC2 allows remote FTP servers to execute arbitrary code via a long response to a PASV command. | Patch early | 9.3 high | 5.4% | 2009-09-24 |
| CVE-2001-0024 EXP | simplestmail.cgi CGI program by Leif Wright allows remote attackers to execute arbitrary commands via shell metacharacters in the MyEmail parameter. | Patch early | 10.0 high | 5.4% | 2001-02-12 |
| CVE-2003-0514 EXP | Apple Safari allows remote attackers to bypass intended cookie access restrictions on a web application via "%2e%2e" (encoded dot dot) directory trave… | Patch early | 7.5 high | 5.4% | 2004-04-15 |
| CVE-2001-1078 EXP | Format string vulnerability in flog function of eXtremail 1.1.9 and earlier allows remote attackers to gain root privileges via format specifiers in t… | Patch early | 10.0 high | 5.4% | 2001-06-21 |
| CVE-2007-1511 EXP | Buffer overflow in FrontBase Relational Database Server 4.2.7 and earlier allows remote authenticated users, with privileges for creating a stored pro… | Patch early | 7.1 high | 5.4% | 2007-03-20 |
| CVE-2014-8357 EXP | backupsettings.html in the web administrative portal in Zhone zNID GPON 2426A before S3.0.501 places a session key in a URL, which allows remote attac… | Patch early | 8.8 high | 5.4% | 2017-10-17 |
| CVE-2002-1868 EXP | Dispair 0.1 and 0.2 allows remote attackers to execute arbitrary shell commands via certain form fields. | Patch early | 10.0 high | 5.4% | 2002-12-31 |
| CVE-2005-0338 EXP | Buffer overflow in Savant Web Server 3.1 allows remote attackers to execute arbitrary code via a long HTTP request. | Patch early | 7.5 high | 5.4% | 2005-05-02 |
| CVE-2001-1274 EXP | Buffer overflow in MySQL before 3.23.31 allows attackers to cause a denial of service and possibly gain privileges. | Patch early | 7.5 high | 5.4% | 2001-01-23 |
| CVE-2007-0117 EXP | DiskManagementTool in the DiskManagement.framework 92.29 on Mac OS X 10.4.8 does not properly validate Bill of Materials (BOM) files, which allows att… | Patch early | 10.0 high | 5.4% | 2007-01-09 |
| CVE-2007-4381 EXP | Unspecified vulnerability in the font parsing implementation in Sun JDK and JRE 5.0 Update 9 and earlier, and SDK and JRE 1.4.2_14 and earlier, allows… | Patch early | 9.3 high | 5.4% | 2007-08-17 |
| CVE-2019-6213 EXP | A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 12.1.3, macOS Mojave 10.14.3, tvOS 12.1.2, watchOS 5.1.3. An… | Patch early | 7.8 high | 5.4% | 2019-03-05 |
| CVE-2016-7626 EXP | An issue was discovered in certain Apple products. iOS before 10.2 is affected. tvOS before 10.1 is affected. watchOS before 3.1.1 is affected. The is… | Patch early | 8.8 high | 5.4% | 2017-02-20 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt