CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
403,413 CVEs
1,739 on KEV
17,298 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-09
403,413 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2010-2037 EXP | Directory traversal vulnerability in the Percha Downloads Attach (com_perchadownloadsattach) component 1.1 for Joomla! allows remote attackers to read… | Patch early | 7.5 high | 11.1% | 2010-05-25 |
| CVE-2017-17867 EXP | Inteno iopsys 2.0-3.14 and 4.0 devices allow remote authenticated users to execute arbitrary OS commands by modifying the leasetrigger field in the od… | Patch early | 8.8 high | 11.1% | 2018-01-04 |
| CVE-2000-0010 EXP | WebWho+ whois.cgi program allows remote attackers to execute commands via shell metacharacters in the TLD parameter. | Patch early | 10.0 high | 11.1% | 1999-12-26 |
| CVE-2017-7397 EXP | BackBox Linux 4.6 allows remote attackers to cause a denial of service (ksoftirqd CPU consumption) via a flood of packets with Martian source IP addre… | Patch early | 7.5 high | 11.1% | 2017-04-03 |
| CVE-2006-0996 EXP | Cross-site scripting (XSS) vulnerability in phpinfo (info.c) in PHP 5.1.2 and 4.4.2 allows remote attackers to inject arbitrary web script or HTML via… | Patch early | 4.3 medium | 11.1% | 2006-04-10 |
| CVE-2013-4625 EXP | Cross-site scripting (XSS) vulnerability in files/installer.cleanup.php in the Duplicator plugin before 0.4.5 for WordPress allows remote attackers to… | Patch early | 4.3 medium | 11.1% | 2013-08-09 |
| CVE-2006-2868 EXP | Multiple PHP remote file inclusion vulnerabilities in Claroline 1.7.6 allow remote attackers to execute arbitrary PHP code via a URL in the includePat… | Patch early | 5.1 medium | 11.1% | 2006-06-06 |
| CVE-2014-9260 EXP | The basic_settings function in the download manager plugin for WordPress before 2.7.3 allows remote authenticated users to update every WordPress opti… | Patch early | 8.8 high | 11.1% | 2017-08-07 |
| CVE-2009-0039 EXP | Multiple cross-site request forgery (CSRF) vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 a… | Patch early | 6.8 medium | 11.1% | 2009-04-17 |
| CVE-2004-0179 EXP | Multiple format string vulnerabilities in (1) neon 0.24.4 and earlier, and other products that use neon including (2) Cadaver, (3) Subversion, and (4)… | Patch early | 6.8 medium | 11.1% | 2004-06-01 |
| CVE-2014-2030 EXP | Stack-based buffer overflow in the WritePSDImage function in coders/psd.c in ImageMagick, possibly 6.8.8-5, allows remote attackers to cause a denial… | Patch early | 8.8 high | 11.1% | 2020-02-06 |
| CVE-2008-0295 EXP | Heap-based buffer overflow in modules/access/rtsp/real_sdpplin.c in the Xine library, as used in VideoLAN VLC Media Player 0.8.6d and earlier, allows… | Patch early | 8.5 high | 11.1% | 2008-01-16 |
| CVE-2011-3596 EXP | Polipo before 1.0.4.1 suffers from a DoD vulnerability via specially-crafted HTTP POST / PUT request. | Patch early | 7.5 high | 11.1% | 2019-11-26 |
| CVE-2017-18195 EXP | An issue was discovered in tools/conversations/view_ajax.php in Concrete5 before 8.3.0. An unauthenticated user can enumerate comments from all blog p… | Patch early | 5.3 medium | 11.1% | 2018-02-26 |
| CVE-2004-0445 EXP | The SYMDNS.SYS driver in Symantec Norton Internet Security and Professional 2002 through 2004, Norton Personal Firewall 2002 through 2004, Norton Anti… | Patch early | 2.6 low | 11% | 2004-07-07 |
| CVE-2004-2044 EXP | PHP-Nuke 7.3, and other products that use the PHP-Nuke codebase such as the Nuke Cops betaNC PHP-Nuke Bundle, OSCNukeLite 3.1, and OSC2Nuke 7x do not… | Patch early | 7.5 high | 11% | 2004-06-01 |
| CVE-2021-27973 EXP | SQL injection exists in Piwigo before 11.4.0 via the language parameter to admin.php?page=languages. | Patch early | 7.2 high | 11% | 2021-04-02 |
| CVE-2008-3794 EXP | Integer signedness error in the mms_ReceiveCommand function in modules/access/mms/mmstu.c in VLC Media Player 0.8.6i allows remote attackers to execut… | Patch early | 6.8 medium | 11% | 2008-08-26 |
| CVE-2006-4144 EXP | Integer overflow in the ReadSGIImage function in sgi.c in ImageMagick before 6.2.9 allows user-assisted attackers to cause a denial of service (crash)… | Patch early | 2.6 low | 11% | 2006-08-15 |
| CVE-2019-8646 EXP | An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 12.4, macOS Mojave 10.14.6, tvOS 12.4, watchOS 5.3. A r… | Patch early | 7.5 high | 11% | 2019-12-18 |
| CVE-2005-0873 EXP | Multiple cross-site scripting (XSS) vulnerabilities in test.jsp in Oracle Reports Server 10g (9.0.4.3.3) allow remote attackers to inject arbitrary we… | Patch early | 4.3 medium | 11% | 2005-05-02 |
| CVE-2019-8672 EXP | Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.4, macOS Mojave 10.14.6, tvOS 12.4, watc… | Patch early | 8.8 high | 11% | 2019-12-18 |
| CVE-2010-2310 EXP | SolarWinds TFTP Server 10.4.0.13 allows remote attackers to cause a denial of service (crash) via a long write request. | Patch early | 5.0 medium | 11% | 2010-06-16 |
| CVE-2002-0749 EXP | CGIscript.net csMailto.cgi allows remote attackers to execute arbitrary commands via shell metacharacters in the form-attachment field. | Patch early | 7.5 high | 11% | 2002-08-12 |
| CVE-2018-8947 EXP | rap2hpoutre Laravel Log Viewer before v0.13.0 relies on Base64 encoding for l, dl, and del requests, which makes it easier for remote attackers to byp… | Patch early | 7.5 high | 11% | 2018-03-25 |
| CVE-2007-1620 EXP | Multiple PHP remote file inclusion vulnerabilities in PHP DB Designer 1.02 and earlier allow remote attackers to execute arbitrary PHP code via a URL… | Patch early | 10.0 high | 11% | 2007-03-23 |
| CVE-2012-4170 EXP | Buffer overflow in Adobe Photoshop CS6 13.x before 13.0.1 allows remote attackers to execute arbitrary code via a crafted file. | Patch early | 9.3 high | 11% | 2012-08-31 |
| CVE-2007-4534 EXP | Buffer overflow in the VThinker::BroadcastPrintf function in p_thinker.cpp in Vavoom 1.24 and earlier allows remote attackers to execute arbitrary cod… | Patch early | 7.5 high | 11% | 2007-08-25 |
| CVE-2008-3409 EXP | Buffer overflow in Unreal Tournament 3 1.3beta4 and earlier allows remote attackers to cause a denial of service (memory corruption and daemon crash)… | Patch early | 7.5 high | 11% | 2008-07-31 |
| CVE-2006-0528 EXP | The cairo library (libcairo), as used in GNOME Evolution and possibly other products, allows remote attackers to cause a denial of service (persistent… | Patch early | 5.0 medium | 11% | 2006-02-02 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt