CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
402,829 CVEs
1,734 on KEV
17,293 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-07
320,901 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2008-3877 EXP | Stack-based buffer overflow in Acoustica Mixcraft 4.1 Build 96 and 4.2 Build 98 allows user-assisted attackers to execute arbitrary code via a crafted… | Patch early | 9.3 high | 9.9% | 2008-09-02 |
| CVE-2008-4686 EXP | Multiple integer overflows in ty.c in the TY demux plugin (aka the TiVo demuxer) in VideoLAN VLC media player, probably 0.9.4, might allow remote atta… | Patch early | 9.3 high | 9.9% | 2008-10-22 |
| CVE-2012-3448 EXP | Unspecified vulnerability in Ganglia Web before 3.5.1 allows remote attackers to execute arbitrary PHP code via unknown attack vectors. | Patch early | 7.5 high | 9.9% | 2012-08-06 |
| CVE-2012-1617 EXP | Directory traversal vulnerability in combine.php in OSClass before 2.3.6 allows remote attackers to read and write arbitrary files via a .. (dot dot)… | Patch early | 6.4 medium | 9.9% | 2012-09-26 |
| CVE-2010-1476 EXP | Directory traversal vulnerability in the AlphaUserPoints (com_alphauserpoints) component 1.5.5 for Joomla! allows remote attackers to read arbitrary f… | Patch early | 6.8 medium | 9.9% | 2010-04-19 |
| CVE-2005-2409 EXP | Format string vulnerability in util.c in nbsmtp 0.99 and earlier, while running in debug mode, allows remote attackers to execute arbitrary code via f… | Patch early | 7.5 high | 9.9% | 2005-08-01 |
| CVE-2019-5009 EXP | Vtiger CRM 7.1.0 before Hotfix2 allows uploading files with the extension "php3" in the logo upload field, if the uploaded file is in PNG format and h… | Patch early | 7.2 high | 9.9% | 2019-01-04 |
| CVE-2016-0862 EXP | General Electric (GE) Industrial Solutions UPS SNMP/Web Adapter devices with firmware before 4.8 allow remote authenticated users to obtain sensitive… | Patch early | 6.5 medium | 9.9% | 2016-02-05 |
| CVE-2010-4717 EXP | Multiple stack-based buffer overflows in the IMAP server component in GroupWise Internet Agent (GWIA) in Novell GroupWise before 8.02HP allow remote a… | Patch early | 6.5 medium | 9.9% | 2011-01-31 |
| CVE-2014-2996 EXP | XCloner Standalone 3.5 and earlier, when enable_db_backup and sql_mem are enabled, allows remote authenticated administrators to execute arbitrary com… | Patch early | 7.1 high | 9.9% | 2014-04-25 |
| CVE-2000-0177 EXP | DNSTools CGI applications allow remote attackers to execute arbitrary commands via shell metacharacters. | Patch early | 10.0 high | 9.9% | 2000-03-02 |
| CVE-2000-0527 EXP | userreg.cgi CGI program in MailStudio 2000 2.0 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters. | Patch early | 10.0 high | 9.9% | 2000-06-09 |
| CVE-2003-1029 EXP | The L2TP protocol parser in tcpdump 3.8.1 and earlier allows remote attackers to cause a denial of service (infinite loop and memory consumption) via… | Patch early | 5.0 medium | 9.9% | 2004-02-17 |
| CVE-2009-5135 EXP | The Java XML parser in Echo before 2.1.1 and 3.x before 3.0.b6 allows remote attackers to read arbitrary files via a request containing an external en… | Patch early | 5.0 medium | 9.9% | 2013-05-02 |
| CVE-2019-12461 EXP | Web Port 1.19.1 allows XSS via the /log type parameter. | Patch early | 6.1 medium | 9.9% | 2019-05-30 |
| CVE-2007-1982 EXP | Multiple PHP remote file inclusion vulnerabilities in Really Simple PHP and Ajax (RSPA) 2007-03-23 and earlier allow remote attackers to execute arbit… | Patch early | 7.5 high | 9.9% | 2007-04-12 |
| CVE-2021-41878 EXP | A reflected cross-site scripting (XSS) vulnerability exists in the i-Panel Administration System Version 2.0 that enables a remote attacker to execute… | Patch early | 6.1 medium | 9.9% | 2021-10-04 |
| CVE-2001-1287 EXP | Buffer overflow in Web Calendar in Ipswitch IMail 7.04 and earlier allows remote attackers to execute arbitrary code via a long HTTP GET request. | Patch early | 7.5 high | 9.9% | 2001-10-12 |
| CVE-2005-0689 EXP | includer.cgi in The Includer allows remote attackers to execute arbitrary commands via shell metacharacters in (1) the URL or (2) the template paramet… | Patch early | 7.5 high | 9.9% | 2005-03-07 |
| CVE-2002-1057 EXP | Buffer overflow in SmartMax MailMax POP3 daemon (popmax) 4.8 allows remote attackers to execute arbitrary code via a long USER command. | Patch early | 7.5 high | 9.9% | 2002-10-04 |
| CVE-2005-0226 EXP | Format string vulnerability in the Log_Resolver function in log.c for ngIRCd 0.8.2 and earlier, when compiled with IDENT, logging to SYSLOG, and with… | Patch early | 7.5 high | 9.9% | 2005-02-03 |
| CVE-2006-4191 EXP | Directory traversal vulnerability in memcp.php in XMB (Extreme Message Board) 1.9.6 and earlier allows remote attackers to include and execute arbitra… | Patch early | 5.1 medium | 9.9% | 2006-08-17 |
| CVE-2004-1666 EXP | Buffer overflow in the MSN module in Trillian 0.74i allows remote MSN servers to execute arbitrary code via a long string that ends in a newline chara… | Patch early | 7.5 high | 9.9% | 2004-12-31 |
| CVE-2006-4870 EXP | Multiple PHP remote file inclusion vulnerabilities in AEDating 4.1, and possibly earlier versions, allow remote attackers to execute arbitrary PHP cod… | Patch early | 7.5 high | 9.9% | 2006-09-19 |
| CVE-2018-20159 EXP | i-doit open 1.11.2 allows Remote Code Execution because ZIP archives are mishandled. It has an upload feature that allows an authenticated user with t… | Patch early | 7.2 high | 9.9% | 2018-12-15 |
| CVE-2000-0012 EXP | Buffer overflow in w3-msql CGI program in miniSQL package allows remote attackers to execute commands. | Patch early | 10.0 high | 9.9% | 1999-12-27 |
| CVE-2013-6231 EXP | SpagoBI before 4.1 has Privilege Escalation via an error in the AdapterHTTP script | Patch early | 8.8 high | 9.9% | 2020-01-10 |
| CVE-2006-0647 EXP | LDAP service in Sun Java System Directory Server 5.2, running on Linux and possibly other platforms, allows remote attackers to cause a denial of serv… | Patch early | 5.0 medium | 9.9% | 2006-02-13 |
| CVE-2022-23626 EXP | m1k1o/blog is a lightweight self-hosted facebook-styled PHP blog. Errors from functions `imagecreatefrom*` and `image*` have not been checked properly… | Patch early | 8.5 high | 9.9% | 2022-02-08 |
| CVE-2004-2347 EXP | blog.cgi in Leif M. Wright Web Blog 1.1 and 1.1.5 allows remote attackers to execute arbitrary commands via shell metacharacters such as '|' in the fi… | Patch early | 7.5 high | 9.9% | 2004-12-31 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt