CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
403,413 CVEs
1,739 on KEV
17,298 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-09
403,413 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2019-8929 EXP | An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2. XSS exists in the Administration zone /netflow/jspui/selectDevice.… | Patch early | 6.1 medium | 11.2% | 2019-05-17 |
| CVE-2012-2738 EXP | The VteTerminal in gnome-terminal (vte) before 0.32.2 allows remote authenticated users to cause a denial of service (long loop and CPU consumption) v… | Patch early | 4.0 medium | 11.2% | 2012-07-22 |
| CVE-2010-1979 EXP | Directory traversal vulnerability in the Affiliate Datafeeds (com_datafeeds) component build 880 for Joomla! allows remote attackers to read arbitrary… | Patch early | 6.8 medium | 11.2% | 2010-05-19 |
| CVE-2017-1002001 EXP | Vulnerability in wordpress plugin mobile-app-builder-by-wappress v1.05, The plugin includes unlicensed vulnerable CMS software from http://www.invedio… | Patch early | 9.8 critical | 11.1% | 2017-09-14 |
| CVE-2006-4656 EXP | PHP remote file inclusion vulnerability in admin/editeur/spaw_control.class.php in Web Provence SL_Site 1.0 and earlier allows remote attackers to exe… | Patch early | 7.5 high | 11.1% | 2006-09-09 |
| CVE-2014-1907 EXP | Multiple directory traversal vulnerabilities in the VideoWhisper Live Streaming Integration plugin before 4.29.5 for WordPress allow remote attackers… | Patch early | 6.4 medium | 11.1% | 2014-03-06 |
| CVE-2016-8655 EXP | Race condition in net/packet/af_packet.c in the Linux kernel through 4.8.12 allows local users to gain privileges or cause a denial of service (use-af… | Patch early | 7.8 high | 11.1% | 2016-12-08 |
| CVE-2002-1660 EXP | calendar.php in vBulletin before 2.2.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the command parameter. | Patch early | 7.5 high | 11.1% | 2002-12-31 |
| CVE-2015-4667 EXP | Multiple hardcoded credentials in Xsuite 2.x. | Patch early | 9.8 critical | 11.1% | 2017-09-25 |
| CVE-2007-6262 EXP | A certain ActiveX control in axvlc.dll in VideoLAN VLC 0.8.6 before 0.8.6d allows remote attackers to execute arbitrary code via crafted arguments to… | Patch early | 6.8 medium | 11.1% | 2007-12-06 |
| CVE-2006-2743 EXP | Drupal 4.6.x before 4.6.7 and 4.7.0, when running on Apache with mod_mime, does not properly handle files with multiple extensions, which allows remot… | Patch early | 5.1 medium | 11.1% | 2006-06-01 |
| CVE-2007-1687 EXP | Multiple buffer overflows in the Internet Pictures Corporation iPIX Image Well ActiveX control (iPIX-ImageWell-ipix.dll) allow remote attackers to exe… | Patch early | 10.0 high | 11.1% | 2007-04-10 |
| CVE-2008-5409 EXP | Unspecified vulnerability in the pdf.xmd module in (1) BitDefender Free Edition 10 and Antivirus Standard 10, (2) BullGuard Internet Security 8.5, and… | Patch early | 9.3 high | 11.1% | 2008-12-10 |
| CVE-2017-2619 EXP | Samba before versions 4.6.1, 4.5.7 and 4.4.11 are vulnerable to a malicious client using a symlink race to allow access to areas of the server file sy… | Patch early | 7.5 high | 11.1% | 2018-03-12 |
| CVE-2009-3707 EXP | VMware Authentication Daemon 1.0 in vmware-authd.exe in the VMware Authorization Service in VMware Workstation 7.0 before 7.0.1 build 227600 and 6.5.x… | Patch early | 5.0 medium | 11.1% | 2009-10-16 |
| CVE-2015-0059 EXP | win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2008 R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2,… | Patch early | 6.9 medium | 11.1% | 2015-02-11 |
| CVE-2019-8518 EXP | Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, watchOS 5.2, Safari 12.1,… | Patch early | 8.8 high | 11.1% | 2019-12-18 |
| CVE-2022-25090 EXP | Printix Secure Cloud Print Management through 1.3.1106.0 creates a temporary temp.ini file in a directory with insecure permissions, leading to privil… | Patch early | 8.1 high | 11.1% | 2022-03-10 |
| CVE-2016-8020 EXP | Improper control of generation of code vulnerability in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) allows remote authenticat… | Patch early | 8.0 high | 11.1% | 2017-03-14 |
| CVE-2007-1085 EXP | Cross-site scripting (XSS) vulnerability in Google Desktop allows remote attackers to bypass protection schemes and inject arbitrary web script or HTM… | Patch early | 7.6 high | 11.1% | 2007-02-23 |
| CVE-2011-4878 EXP | Directory traversal vulnerability in miniweb.exe in the HMI web server in Siemens WinCC flexible 2004, 2005, 2007, and 2008 before SP3; WinCC V11 (aka… | Patch early | 7.8 high | 11.1% | 2012-02-03 |
| CVE-2003-0853 EXP | An integer overflow in ls in the fileutils or coreutils packages may allow local users to cause a denial of service or execute arbitrary code via a la… | Patch early | 5.0 medium | 11.1% | 2003-11-17 |
| CVE-2003-1123 EXP | Sun Java Runtime Environment (JRE) and SDK 1.4.0_01 and earlier allows untrusted applets to access certain information within trusted applets, which a… | Patch early | 7.5 high | 11.1% | 2003-12-31 |
| CVE-2006-2802 EXP | Buffer overflow in the HTTP Plugin (xineplug_inp_http.so) for xine-lib 1.1.1 allows remote attackers to cause a denial of service (application crash)… | Patch early | 5.0 medium | 11.1% | 2006-06-03 |
| CVE-2006-0396 EXP | Buffer overflow in Mail in Apple Mac OS X 10.4 up to 10.4.5, when patched with Security Update 2006-001, allows remote attackers to execute arbitrary… | Patch early | 5.1 medium | 11.1% | 2006-03-14 |
| CVE-2006-2852 EXP | PHP remote file inclusion vulnerability in dotWidget CMS 1.0.6 and earlier, when register_globals is enabled, allows remote attackers to execute arbit… | Patch early | 6.8 medium | 11.1% | 2006-06-06 |
| CVE-2011-1761 EXP | Multiple stack-based buffer overflows in the (1) abc_new_macro and (2) abc_new_umacro functions in src/load_abc.cpp in libmodplug before 0.8.8.3 allow… | Patch early | 6.8 medium | 11.1% | 2012-06-07 |
| CVE-2017-6320 EXP | A remote command injection vulnerability exists in the Barracuda Load Balancer product line (confirmed on v5.4.0.004 (2015-11-26) and v6.0.1.006 (2016… | Patch early | 8.8 high | 11.1% | 2017-07-18 |
| CVE-2003-0770 EXP | FUNC.pm in IkonBoard 3.1.2a and earlier, including 3.1.1, does not properly cleanse the "lang" cookie when it contains illegal characters, which allow… | Patch early | 7.5 high | 11.1% | 2003-09-22 |
| CVE-2010-2034 EXP | Directory traversal vulnerability in the Percha Image Attach (com_perchaimageattach) component 1.1 for Joomla! allows remote attackers to read arbitra… | Patch early | 7.5 high | 11.1% | 2010-05-25 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt