CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
402,941 CVEs
1,734 on KEV
17,293 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-08
320,998 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2011-1519 EXP | The remote console in the Server Controller in IBM Lotus Domino 7.x and 8.x verifies credentials against a file located at a UNC share pathname specif… | Patch early | 10.0 high | 9.2% | 2011-03-25 |
| CVE-2006-3372 EXP | Apple Safari 2.0.4/419.3 allows remote attackers to cause a denial of service (application crash) via a DHTML setAttributeNode function call with zero… | Patch early | 5.0 medium | 9.2% | 2006-07-06 |
| CVE-2006-4006 EXP | The do_gameinfo function in BomberClone 0.11.6 and earlier, and possibly other functions, does not reset the packet data size, which causes the send_p… | Patch early | 5.0 medium | 9.2% | 2006-08-07 |
| CVE-2018-6092 EXP | An integer overflow on 32-bit systems in WebAssembly in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code insid… | Patch early | 8.8 high | 9.2% | 2018-12-04 |
| CVE-2022-26982 EXP | SimpleMachinesForum 2.1.1 and earlier allows remote authenticated administrators to execute arbitrary code by inserting a vulnerable php code because… | Patch early | 7.2 high | 9.2% | 2022-04-05 |
| CVE-2014-7226 EXP | The file comment feature in Rejetto HTTP File Server (hfs) 2.3c and earlier allows remote attackers to execute arbitrary code by uploading a file with… | Patch early | 7.5 high | 9.2% | 2014-10-10 |
| CVE-2007-1542 EXP | Unspecified vulnerability in the Cisco IP Phone 7940 and 7960 running firmware before POS8-6-0 allows remote attackers to cause a denial of service vi… | Patch early | 5.0 medium | 9.2% | 2007-03-20 |
| CVE-2021-46360 EXP | Authenticated remote code execution (RCE) in Composr-CMS 10.0.39 and earlier allows remote attackers to execute arbitrary code via uploading a PHP she… | Patch early | 8.8 high | 9.2% | 2022-02-09 |
| CVE-2011-2194 EXP | Integer overflow in the XSPF playlist parser in VideoLAN VLC media player 0.8.5 through 1.1.9 allows remote attackers to cause a denial of service (cr… | Patch early | 9.3 high | 9.2% | 2011-06-24 |
| CVE-2000-0613 EXP | Cisco Secure PIX Firewall does not properly identify forged TCP Reset (RST) packets, which allows remote attackers to force the firewall to close legi… | Patch early | 5.0 medium | 9.2% | 2000-03-20 |
| CVE-2008-6976 EXP | MikroTik RouterOS 3.x through 3.13 and 2.x through 2.9.51 allows remote attackers to modify Network Management System (NMS) settings via a crafted SNM… | Patch early | 6.4 medium | 9.2% | 2009-08-19 |
| CVE-2005-0828 EXP | highlight.php in (1) RUNCMS 1.1A, (2) CIAMOS 0.9.2 RC1, (3) e-Xoops 1.05 Rev3, and possibly other products based on e-Xoops (exoops), allows remote at… | Patch early | 5.0 medium | 9.2% | 2005-05-02 |
| CVE-2014-5112 EXP | maint/modules/home/index.php in Fonality trixbox allows remote attackers to execute arbitrary commands via shell metacharacters in the lang parameter. | Patch early | 7.5 high | 9.2% | 2014-07-28 |
| CVE-2007-6318 EXP | SQL injection vulnerability in wp-includes/query.php in WordPress 2.3.1 and earlier allows remote attackers to execute arbitrary SQL commands via the… | Patch early | 6.8 medium | 9.2% | 2007-12-12 |
| CVE-2011-5219 EXP | Directory traversal vulnerability in examples/show_code.php in mPDF 5.3 and earlier allows remote attackers to read arbitrary files via a .. (dot dot)… | Patch early | 5.0 medium | 9.2% | 2012-10-25 |
| CVE-2007-4816 EXP | Multiple buffer overflows in the BaoFeng2 storm ActiveX control in Mps.dll allow remote attackers to have an unknown impact via a long (1) URL, (2) ba… | Patch early | 7.5 high | 9.2% | 2007-09-11 |
| CVE-2004-2496 EXP | The HTTP daemon in OpenText FirstClass 7.1 and 8.0 allows remote attackers to cause a denial of service (service availability loss) via a large number… | Patch early | 7.8 high | 9.2% | 2004-12-31 |
| CVE-2008-0623 EXP | Stack-based buffer overflow in the YMP Datagrid ActiveX control (datagrid.dll) in Yahoo! Music Jukebox 2.2.2.056 allows remote attackers to execute ar… | Patch early | 4.3 medium | 9.2% | 2008-02-06 |
| CVE-2014-3848 EXP | The iMember360 plugin before 3.9.001 for WordPress does not properly restrict access, which allows remote attackers to obtain database credentials via… | Patch early | 5.0 medium | 9.1% | 2014-05-23 |
| CVE-2002-0652 EXP | xfsmd for IRIX 6.5 through 6.5.16 allows remote attackers to execute arbitrary code via shell metacharacters that are not properly filtered from sever… | Patch early | 7.5 high | 9.1% | 2002-07-03 |
| CVE-2007-6276 EXP | The accept_connections function in the virtual private network daemon (vpnd) in Apple Mac OS X 10.5 before 10.5.4 allows remote attackers to cause a d… | Patch early | 7.8 high | 9.1% | 2007-12-07 |
| CVE-2006-1999 EXP | The multiplayer menu in OpenTTD 0.4.7 allows remote attackers to cause a denial of service via a UDP packet with an incorrect size, which causes the c… | Patch early | 5.0 medium | 9.1% | 2006-04-25 |
| CVE-2015-1561 EXP | The escape_command function in include/Administration/corePerformance/getStats.php in Centreon (formerly Merethis Centreon) 2.5.4 and earlier (fixed i… | Patch early | 6.5 medium | 9.1% | 2015-07-14 |
| CVE-2017-15662 EXP | In Flexense VX Search Enterprise v10.1.12, the Control Protocol suffers from a denial of service vulnerability. The attack vector is a crafted SERVER_… | Patch early | 7.5 high | 9.1% | 2018-01-10 |
| CVE-2017-15664 EXP | In Flexense Sync Breeze Enterprise v10.1.16, the Control Protocol suffers from a denial of service vulnerability. The attack vector is a crafted SERVE… | Patch early | 7.5 high | 9.1% | 2018-01-10 |
| CVE-2017-15665 EXP | In Flexense DiskBoss Enterprise 8.5.12, the Control Protocol suffers from a denial of service vulnerability. The attack vector is a crafted SERVER_GET… | Patch early | 7.5 high | 9.1% | 2018-01-10 |
| CVE-2014-8997 EXP | Unrestricted file upload vulnerability in the Photo functionality in DigitalVidhya Digi Online Examination System 2.0 allows remote attackers to execu… | Patch early | 7.5 high | 9.1% | 2014-11-20 |
| CVE-2010-3804 EXP | The JavaScript implementation in WebKit in Apple Safari before 5.0.3 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.3 on Mac OS X 10.4, use… | Patch early | 5.0 medium | 9.1% | 2010-11-22 |
| CVE-2008-5660 EXP | Format string vulnerability in the vinagre_utils_show_error function (src/vinagre-utils.c) in Vinagre 0.5.x before 0.5.2 and 2.x before 2.24.2 might a… | Patch early | 6.8 medium | 9.1% | 2008-12-17 |
| CVE-1999-0669 EXP | The Eyedog ActiveX control is marked as "safe for scripting" for Internet Explorer, which allows a remote attacker to execute arbitrary commands as de… | Patch early | 4.0 medium | 9.1% | 1999-09-01 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt