CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
403,373 CVEs
1,739 on KEV
17,298 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-08
150,513 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2005-1110 EXP | Stack-based buffer overflow in the RespondeHTTPPendiente function in the HTTP server for SUMUS 0.2.2 allows remote attackers to execute arbitrary code… | Patch early | 7.5 high | 4.7% | 2005-05-02 |
| CVE-2000-0128 EXP | The Finger Server 0.82 allows remote attackers to execute commands via shell metacharacters. | Patch early | 10.0 high | 4.7% | 2000-02-04 |
| CVE-2020-13259 EXP | A vulnerability in the web-based management interface of RAD SecFlow-1v os-image SF_0290_2.3.01.26 could allow an unauthenticated, remote attacker to… | Patch early | 8.8 high | 4.7% | 2020-09-16 |
| CVE-2007-0309 EXP | SQL injection vulnerability in blocks/block-Old_Articles.php in Francisco Burzi PHP-Nuke 7.9 and earlier, when register_globals is enabled and magic_q… | Patch early | 7.5 high | 4.7% | 2007-01-18 |
| CVE-2007-5230 EXP | admin/upload_files.php in Zomplog 3.8.1 and earlier does not check for administrative credentials, which allows remote attackers to perform administra… | Patch early | 7.5 high | 4.7% | 2007-10-05 |
| CVE-2016-1793 EXP | AppleGraphicsDeviceControlClient in Apple OS X before 10.11.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of… | Patch early | 7.8 high | 4.7% | 2016-05-20 |
| CVE-2016-1794 EXP | The AppleGraphicsControlClient::checkArguments method in AppleGraphicsControl in Apple OS X before 10.11.5 allows attackers to execute arbitrary code… | Patch early | 7.8 high | 4.7% | 2016-05-20 |
| CVE-2017-15956 EXP | ConverTo Video Downloader & Converter 1.4.1 allows Arbitrary File Download via the token parameter to download.php. | Patch early | 7.5 high | 4.7% | 2017-10-29 |
| CVE-2022-45639 EXP | OS Command injection vulnerability in sleuthkit fls tool 4.11.1 allows attackers to execute arbitrary commands via a crafted value to the m parameter.… | Patch early | 7.8 high | 4.7% | 2023-01-24 |
| CVE-2005-4243 EXP | Multiple SQL injection vulnerabilities in QuickPayPro 3.1 allow remote attackers to execute arbitrary SQL commands via the (1) popupid parameter in po… | Patch early | 7.5 high | 4.7% | 2005-12-15 |
| CVE-2007-2644 EXP | A certain ActiveX control in Morovia Barcode ActiveX Professional 3.3.1304 allows remote attackers to overwrite arbitrary files by calling the Save me… | Patch early | 9.4 high | 4.6% | 2007-05-13 |
| CVE-2008-0634 EXP | Buffer overflow in the NamoInstaller.NamoInstall.1 ActiveX control in NamoInstaller.dll 3.0.0.1, as used in Sejoong Namo ActiveSquare6, allows remote… | Patch early | 7.5 high | 4.6% | 2008-02-06 |
| CVE-2008-3583 EXP | Buffer overflow in the HTML parser in IntelliTamper 2.07 allows remote attackers to execute arbitrary code via a long URL in the SRC attribute of an I… | Patch early | 7.5 high | 4.6% | 2008-08-10 |
| CVE-2013-3530 EXP | SQL injection vulnerability in playlist.php in the Spiffy XSPF Player plugin 0.1 for WordPress allows remote attackers to execute arbitrary SQL comman… | Patch early | 7.5 high | 4.6% | 2013-05-10 |
| CVE-2008-5305 EXP | Eval injection vulnerability in TWiki before 4.2.4 allows remote attackers to execute arbitrary Perl code via the %SEARCH{}% variable. | Patch early | 10.0 high | 4.6% | 2008-12-10 |
| CVE-2007-0182 EXP | Multiple PHP remote file inclusion vulnerabilities in magic photo storage website allow remote attackers to execute arbitrary PHP code via a URL in th… | Patch early | 7.5 high | 4.6% | 2007-01-12 |
| CVE-2001-0440 EXP | Buffer overflow in logging functions of licq before 1.0.3 allows remote attackers to cause a denial of service, and possibly execute arbitrary command… | Patch early | 7.5 high | 4.6% | 2001-07-02 |
| CVE-2014-9178 EXP | Multiple SQL injection vulnerabilities in classes/ajax.php in the Smarty Pants Plugins SP Project & Document Manager plugin (sp-client-document-manage… | Patch early | 7.5 high | 4.6% | 2014-12-02 |
| CVE-2018-5725 EXP | MASTER IPCAMERA01 3.3.4.2103 devices allow Unauthenticated Configuration Change, as demonstrated by the port number of the web server. | Patch early | 7.5 high | 4.6% | 2018-01-16 |
| CVE-2008-5754 EXP | Stack-based buffer overflow in BulletProof FTP Client allows user-assisted attackers to execute arbitrary code via a .bps file (aka Session-File) with… | Patch early | 9.3 high | 4.6% | 2008-12-30 |
| CVE-2004-0524 EXP | Buffer overflow in the chpasswd command in the Change_passwd plugin before 4.0, as used in SquirrelMail, allows local users to gain root privileges vi… | Patch early | 10.0 high | 4.6% | 2004-08-06 |
| CVE-2008-4470 EXP | Stack-based buffer overflow in Numark CUE 5.0 rev2 allows user-assisted attackers to cause a denial of service (application crash) or execute arbitrar… | Patch early | 9.3 high | 4.6% | 2008-10-07 |
| CVE-2019-5796 EXP | Data race in extensions guest view in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to potentially exploit heap corruption via a craft… | Patch early | 7.5 high | 4.6% | 2019-05-23 |
| CVE-2006-0797 EXP | Nokia N70 cell phone allows remote attackers to cause a denial of service (reboot or shutdown) through a wireless Bluetooth connection via a malformed… | Patch early | 7.8 high | 4.6% | 2006-02-19 |
| CVE-2002-2232 EXP | Buffer overflow in Enceladus Server Suite 3.9 allows remote attackers to execute arbitrary code via a long CD (CWD) command. | Patch early | 8.5 high | 4.6% | 2002-12-31 |
| CVE-2008-6826 EXP | dhtml.pl in MHF Media Pro allows remote attackers to execute arbitrary commands via shell metacharacters in the page parameter, as demonstrated using… | Patch early | 10.0 high | 4.6% | 2009-06-08 |
| CVE-2008-5090 EXP | Electron Inc. Advanced Electron Forum before 1.0.7 allows remote attackers to execute arbitrary PHP code via PHP code embedded in bbcode in the email… | Patch early | 10.0 high | 4.6% | 2008-11-14 |
| CVE-2007-6089 EXP | PHP remote file inclusion vulnerability in index.php in meBiblio 0.4.5 allows remote attackers to execute arbitrary PHP code via a URL in the action p… | Patch early | 9.3 high | 4.6% | 2007-11-22 |
| CVE-2017-6552 EXP | Livebox 3 Sagemcom SG30_sip-fr-5.15.8.1 devices have an insufficiently large default value for the maximum IPv6 routing table size: it can be filled w… | Patch early | 7.5 high | 4.6% | 2017-03-09 |
| CVE-2014-9175 EXP | SQL injection vulnerability in wpdatatables.php in the wpDataTables plugin 1.5.3 and earlier for WordPress allows remote attackers to execute arbitrar… | Patch early | 7.5 high | 4.6% | 2014-12-02 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt