CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
403,696 CVEs
1,739 on KEV
17,300 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-09
403,696 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2003-0100 EXP | Buffer overflow in Cisco IOS 11.2.x to 12.0.x allows remote attackers to cause a denial of service and possibly execute commands via a large number of… | Patch early | 7.5 high | 9.6% | 2003-03-03 |
| CVE-2009-1586 EXP | Stack-based buffer overflow in the NZB importer feature in GrabIt 1.7.2 Beta 3 and earlier allows remote attackers to execute arbitrary code via a cra… | Patch early | 9.3 high | 9.6% | 2009-05-07 |
| CVE-2007-5036 EXP | Multiple buffer overflows in the AirDefense Airsensor M520 with firmware 4.3.1.1 and 4.4.1.4 allow remote authenticated users to cause a denial of ser… | Patch early | 5.0 medium | 9.6% | 2007-09-24 |
| CVE-2007-4155 EXP | Absolute path traversal vulnerability in a certain ActiveX control in vielib.dll in EMC VMware 6.0.0 allows remote attackers to execute arbitrary loca… | Patch early | 9.3 high | 9.6% | 2007-08-03 |
| CVE-2002-1320 EXP | Pine 4.44 and earlier allows remote attackers to cause a denial of service (core dump and failed restart) via an email message with a From header that… | Patch early | 5.0 medium | 9.6% | 2002-12-11 |
| CVE-2006-1371 EXP | Laurentiu Matei eXpandable Home Page (XHP) CMS 0.5 and earlier allows remote authenticated users to use the HTMLArea FileManager plugin to upload and… | Patch early | 9.0 high | 9.6% | 2006-03-23 |
| CVE-2019-14749 EXP | An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. CSV (aka Formula) injection exists in the export spreadsheets functionalit… | Patch early | 8.8 high | 9.6% | 2019-08-07 |
| CVE-2018-9021 EXP | An authentication bypass vulnerability in CA Privileged Access Manager 2.8.2 and earlier allows remote attackers to execute arbitrary commands with sp… | Patch early | 9.8 critical | 9.6% | 2018-06-18 |
| CVE-2005-1950 EXP | hints.pl in Webhints 1.03 allows remote attackers to execute arbitrary commands via shell metacharacters in the argument. | Patch early | 7.5 high | 9.6% | 2005-06-09 |
| CVE-2018-4323 EXP | Multiple memory corruption issues were addressed with improved memory handling. This issue affected versions prior to iOS 12, tvOS 12, Safari 12, iTun… | Patch early | 8.8 high | 9.6% | 2019-04-03 |
| CVE-2005-2330 EXP | Directory traversal vulnerability in extras/update.php in osCommerce 2.2 allows remote attackers to read arbitrary files via (1) .. sequences or (2) a… | Patch early | 5.0 medium | 9.6% | 2005-07-20 |
| CVE-2002-1220 EXP | BIND 8.3.x through 8.3.3 allows remote attackers to cause a denial of service (termination due to assertion failure) via a request for a subdomain tha… | Patch early | 5.0 medium | 9.6% | 2002-11-29 |
| CVE-2026-0926 EXP | The Prodigy Commerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.3.0 via the 'parameters[templa… | Patch early | 9.8 critical | 9.6% | 2026-02-19 |
| CVE-2012-1189 EXP | Stack-based buffer overflow in modules/graphic/ssgraph/grsound.cpp in The Open Racing Car Simulator (TORCS) before 1.3.3 and Speed Dreams allows user-… | Patch early | 9.3 high | 9.6% | 2012-10-08 |
| CVE-2010-4281 EXP | Incomplete blacklist vulnerability in the safe_url_extraclean function in ajax.php in Pandora FMS before 3.1.1 allows remote attackers to execute arbi… | Patch early | 7.5 high | 9.6% | 2010-12-02 |
| CVE-2009-3249 EXP | Multiple directory traversal vulnerabilities in vtiger CRM 5.0.4 allow remote attackers to include and execute arbitrary local files via a .. (dot dot… | Patch early | 7.5 high | 9.6% | 2009-09-18 |
| CVE-2011-4906 EXP | Tiny browser in TinyMCE 3.0 editor in Joomla! before 1.5.13 allows file upload and arbitrary PHP code execution. | Patch early | 9.8 critical | 9.6% | 2020-02-12 |
| CVE-2002-0229 EXP | Safe Mode feature (safe_mode) in PHP 3.0 through 4.1.0 allows attackers with access to the MySQL database to bypass Safe Mode access restrictions and… | Patch early | 7.5 high | 9.6% | 2002-05-16 |
| CVE-2020-8866 EXP | This vulnerability allows remote attackers to create arbitrary files on affected installations of Horde Groupware Webmail Edition 5.2.22. Authenticati… | Patch early | 6.5 medium | 9.6% | 2020-03-23 |
| CVE-2001-0042 EXP | PHP 3.x (PHP3) on Apache 1.3.6 allows remote attackers to read arbitrary files via a modified .. (dot dot) attack containing "%5c" (encoded backslash)… | Patch early | 5.0 medium | 9.6% | 2001-02-16 |
| CVE-2001-0476 EXP | Multiple buffer overflows in s.cgi program in Aspseek search engine 1.03 and earlier allow remote attackers to execute arbitrary commands via (1) a lo… | Patch early | 7.5 high | 9.6% | 2001-06-27 |
| CVE-2009-3099 EXP | Unspecified vulnerability in HP OpenView Operations Manager 8.1 on Windows Server 2003 SP2 allows remote attackers to have an unknown impact, related… | Patch early | 10.0 high | 9.6% | 2009-09-08 |
| CVE-2013-7282 EXP | The management web interface on the Nisuta NS-WIR150NE router with firmware 5.07.41 and Nisuta NS-WIR300N router with firmware 5.07.36_NIS01 allows re… | Patch early | 10.0 high | 9.6% | 2014-01-10 |
| CVE-2007-2935 EXP | core/spellcheck/spellcheck.php in Fundanemt before 2.2.0.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the dict… | Patch early | 7.5 high | 9.6% | 2007-05-31 |
| CVE-2002-2315 EXP | Cisco IOS 11.2.x and 12.0.x does not limit the size of its redirect table, which allows remote attackers to cause a denial of service (memory consumpt… | Patch early | 7.8 high | 9.6% | 2002-12-31 |
| CVE-2021-43339 EXP | In Ericsson Network Location before 2021-07-31, it is possible for an authenticated attacker to inject commands via file_name in the export functional… | Patch early | 8.8 high | 9.6% | 2021-11-03 |
| CVE-2002-0231 EXP | Buffer overflow in mIRC 5.91 and earlier allows a remote server to execute arbitrary code on the client via a long nickname. | Patch early | 7.5 high | 9.6% | 2002-05-16 |
| CVE-2022-32272 EXP | OPSWAT MetaDefender Core before 5.1.2, MetaDefender ICAP before 4.12.1, and MetaDefender Email Gateway Security before 5.6.1 have incorrect access con… | Patch early | 9.8 critical | 9.6% | 2022-06-09 |
| CVE-2015-4071 EXP | The Helpdesk Pro Plugin before 1.4.0 for Joomla! allows remote attackers to read the support tickets of arbitrary users via obtaining the target ticke… | Patch early | 5.3 medium | 9.6% | 2017-08-18 |
| CVE-2006-2863 EXP | PHP remote file inclusion vulnerability in class.cs_phpmailer.php in CS-Cart 1.3.3 allows remote attackers to execute arbitrary PHP code via a URL in… | Patch early | 5.1 medium | 9.6% | 2006-06-06 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt