CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
403,415 CVEs
1,739 on KEV
17,298 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-09
403,415 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2006-6097 EXP | GNU tar 1.16 and 1.15.1, and possibly other versions, allows user-assisted attackers to overwrite arbitrary files via a tar file that contains a GNUTY… | Patch early | 4.0 medium | 11% | 2006-11-24 |
| CVE-2009-2764 EXP | Microsoft Internet Explorer 8.0.7100.0 on Windows 7 RC on the x64 platform allows remote attackers to cause a denial of service (application crash) vi… | Patch early | 5.0 medium | 11% | 2009-08-14 |
| CVE-2014-3220 EXP | F5 BIG-IQ Cloud and Security 4.0.0 through 4.1.0 allows remote authenticated users to change the password of arbitrary users via the name parameter in… | Patch early | 9.0 high | 11% | 2014-05-05 |
| CVE-2005-1100 EXP | Format string vulnerability in the ErrorLog function in cnf.c in Greylisting daemon (GLD) 1.3 and 1.4 allows remote attackers to execute arbitrary cod… | Patch early | 7.5 high | 11% | 2005-05-02 |
| CVE-2015-6023 EXP | ping.cgi in NetCommWireless HSPA 3G10WVE wireless routers with firmware before 3G10WVE-L101-S306ETS-C01_R05 allows remote attackers to bypass intended… | Patch early | 7.3 high | 11% | 2017-02-09 |
| CVE-2018-6460 EXP | Hotspot Shield runs a webserver with a static IP address 127.0.0.1 and port 895. The web server uses JSONP and hosts sensitive information including c… | Patch early | 7.5 high | 11% | 2018-01-31 |
| CVE-2005-3202 EXP | Multiple cross-site scripting (XSS) vulnerabilities in Oracle HTML DB (HTMLDB) 1.3 through 1.3.6 allow remote attackers to inject arbitrary web script… | Patch early | 6.8 medium | 11% | 2005-10-14 |
| CVE-2013-1868 EXP | Multiple buffer overflows in VideoLAN VLC media player 2.0.4 and earlier allow remote attackers to cause a denial of service (crash) and execute arbit… | Patch early | 9.3 high | 11% | 2013-07-10 |
| CVE-2006-2151 EXP | PHP remote file inclusion vulnerability in toplist.php in phpBB TopList 1.3.8 and earlier, when register_globals is enabled, allows remote attackers t… | Patch early | 7.5 high | 11% | 2006-05-03 |
| CVE-2001-0277 EXP | Buffer overflow in ext.dll in BadBlue 1.02.07 Personal Edition allows remote attackers to cause a denial of service and possibly execute arbitrary com… | Patch early | 10.0 high | 11% | 2001-05-03 |
| CVE-2006-3995 EXP | Multiple PHP remote file inclusion vulnerabilities in (1) uhp_config.php, and possibly (2) footer.php, (3) functions.php, (4) install.uhp.php, (5) too… | Patch early | 6.8 medium | 11% | 2006-08-05 |
| CVE-2014-7221 EXP | TeamSpeak Client 3.0.14 and earlier allows remote authenticated users to cause a denial of service (buffer overflow and application crash) by connecti… | Patch early | 6.5 medium | 11% | 2018-01-08 |
| CVE-2014-7222 EXP | Buffer overflow in TeamSpeak Client 3.0.14 and earlier allows remote authenticated users to cause a denial of service (application crash) by connectin… | Patch early | 6.5 medium | 11% | 2018-01-08 |
| CVE-2008-4434 EXP | Stack-based buffer overflow in (1) uTorrent 1.7.7 build 8179 and earlier and (2) BitTorrent 6.0.3 build 8642 and earlier allows remote attackers to ca… | Patch early | 9.3 high | 11% | 2008-10-03 |
| CVE-2020-13144 EXP | Studio in Open edX Ironwood 2.5, when CodeJail is not used, allows a user to go to the "Create New course>New section>New subsection>New unit>Add new… | Patch early | 8.8 high | 11% | 2020-05-18 |
| CVE-2002-0516 EXP | SquirrelMail 1.2.5 and earlier allows authenticated SquirrelMail users to execute arbitrary commands by modifying the THEME variable in a cookie. | Patch early | 10.0 high | 11% | 2002-08-12 |
| CVE-2006-4901 EXP | Computer Associates (CA) eTrust Security Command Center 1.0 and r8 up to SP1 CR2, and eTrust Audit 1.5 and r8, allows remote attackers to spoof alerts… | Patch early | 6.4 medium | 11% | 2006-09-22 |
| CVE-2001-0590 EXP | Apache Software Foundation Tomcat Servlet prior to 3.2.2 allows a remote attacker to read the source code to arbitrary 'jsp' files via a malformed URL… | Patch early | 5.0 medium | 11% | 2001-08-02 |
| CVE-2006-5205 EXP | Directory traversal vulnerability in Invision Gallery 2.0.7 allows remote attackers to read arbitrary files via a .. (dot dot) sequence in the dir par… | Patch early | 5.0 medium | 11% | 2006-10-10 |
| CVE-2020-11060 EXP | In GLPI before 9.4.6, an attacker can execute system commands by abusing the backup functionality. Theoretically, this vulnerability can be exploited… | Patch early | 7.4 high | 10.9% | 2020-05-12 |
| CVE-2010-3145 EXP | Untrusted search path vulnerability in the BitLocker Drive Encryption API, as used in sdclt.exe in Backup Manager in Microsoft Windows Vista SP1 and S… | Patch early | 9.3 high | 10.9% | 2010-08-27 |
| CVE-2010-0049 EXP | Use-after-free vulnerability in WebKit in Apple Safari before 4.0.5 allows remote attackers to execute arbitrary code or cause a denial of service (ap… | Patch early | 9.3 high | 10.9% | 2010-03-15 |
| CVE-2009-0367 EXP | The Python AI module in Wesnoth 1.4.x and 1.5 before 1.5.11 allows remote attackers to escape the sandbox and execute arbitrary code by using a whitel… | Patch early | 9.3 high | 10.9% | 2009-03-05 |
| CVE-2009-3250 EXP | The saveForwardAttachments procedure in the Compose Mail functionality in vtiger CRM 5.0.4 allows remote authenticated users to execute arbitrary code… | Patch early | 9.0 high | 10.9% | 2009-09-18 |
| CVE-2009-0347 EXP | Open redirect vulnerability in cs.html in the Autonomy (formerly Verity) Ultraseek search engine allows remote attackers to redirect users to arbitrar… | Patch early | 5.8 medium | 10.9% | 2009-01-29 |
| CVE-2019-1343 EXP | A denial of service vulnerability exists when Windows improperly handles objects in memory, aka 'Windows Denial of Service Vulnerability'. This CVE ID… | Patch early | 6.5 medium | 10.9% | 2019-10-10 |
| CVE-2019-1346 EXP | A denial of service vulnerability exists when Windows improperly handles objects in memory, aka 'Windows Denial of Service Vulnerability'. This CVE ID… | Patch early | 6.5 medium | 10.9% | 2019-10-10 |
| CVE-2012-2385 EXP | The terminal dispatcher in mosh before 1.2.1 allows remote authenticated users to cause a denial of service (long loop and CPU consumption) via an esc… | Patch early | 4.0 medium | 10.9% | 2012-06-29 |
| CVE-2000-0059 EXP | PHP3 with safe_mode enabled does not properly filter shell metacharacters from commands that are executed by popen, which could allow remote attackers… | Patch early | 10.0 high | 10.9% | 2000-01-04 |
| CVE-2025-46811 EXP | A Missing Authorization vulnerability in SUSE Linux Manager allows anyone with the ability to connect to port 443 of SUSE Manager is able to run any c… | Patch early | 9.8 critical | 10.9% | 2025-07-30 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt