CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
404,146 CVEs
1,739 on KEV
17,300 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-11
321,918 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2009-2362 EXP | Stack-based buffer overflow in KUDRSOFT AudioPLUS 2.0.0.215 allows remote attackers to execute arbitrary code via a long string in a (1) .lst or (2) .… | Patch early | 9.3 high | 7.2% | 2009-07-08 |
| CVE-2022-41333 EXP | An uncontrolled resource consumption vulnerability [CWE-400] in FortiRecorder version 6.4.3 and below, 6.0.11 and below login authentication mechanism… | Patch early | 7.5 high | 7.2% | 2023-03-07 |
| CVE-2012-1774 EXP | Unspecified vulnerability in the Open URL feature in Gretech GOM Media Player before 2.1.39.5101 has unknown impact and attack vectors, a different vu… | Patch early | 10.0 high | 7.2% | 2012-03-18 |
| CVE-2003-1518 EXP | Adiscon WinSyslog 4.21 SP1 allows remote attackers to cause a denial of service (CPU consumption) via a long syslog message. | Patch early | 7.8 high | 7.2% | 2003-12-31 |
| CVE-2018-10253 EXP | Paessler PRTG Network Monitor before 18.1.39.1648 mishandles stack memory during unspecified API calls. | Patch early | 7.5 high | 7.2% | 2018-04-21 |
| CVE-2001-0703 EXP | tradecli.dll in Arcadia Internet Store 1.0 allows a remote attacker to cause a denial of service via a URL request with an MS-DOS device name in the t… | Patch early | 5.0 medium | 7.2% | 2001-09-20 |
| CVE-2007-2563 EXP | Buffer overflow in the AddFile function in VersalSoft HTTP File Upload ActiveX control (UFileUploaderD.dll) allows remote attackers to execute arbitra… | Patch early | 9.3 high | 7.2% | 2007-05-09 |
| CVE-2004-1400 EXP | The control panel in ASP Calendar does not require authentication to access, which allows remote attackers to gain unauthorized access via a direct re… | Patch early | 7.5 high | 7.2% | 2004-12-31 |
| CVE-2017-15879 EXP | CSV Injection (aka Excel Macro Injection or Formula Injection) exists in admin/server/api/download.js and lib/list/getCSVData.js in KeystoneJS before… | Patch early | 8.8 high | 7.2% | 2017-10-24 |
| CVE-2009-1634 EXP | The WebAccess component in Novell GroupWise 7.x before 7.03 HP3 and 8.x before 8.0 HP2 does not properly implement session management mechanisms, whic… | Patch early | 7.5 high | 7.2% | 2009-05-26 |
| CVE-2013-4885 EXP | The http-domino-enum-passwords.nse script in NMap before 6.40, when domino-enum-passwords.idpath is set, allows remote servers to upload "arbitrarily… | Patch early | 6.8 medium | 7.2% | 2013-10-26 |
| CVE-1999-1018 EXP | IPChains in Linux kernels 2.2.10 and earlier does not reassemble IP fragments before checking the header information, which allows a remote attacker t… | Patch early | 7.5 high | 7.2% | 1999-07-27 |
| CVE-2006-3746 EXP | Integer overflow in parse_comment in GnuPG (gpg) 1.4.4 allows remote attackers to cause a denial of service (segmentation fault) via a crafted message… | Patch early | 5.0 medium | 7.2% | 2006-07-28 |
| CVE-2007-4748 EXP | Buffer overflow in the PowerPlayer.dll ActiveX control in PPStream 2.0.1.3829 allows remote attackers to execute arbitrary code via a long Logo parame… | Patch early | 6.8 medium | 7.2% | 2007-09-06 |
| CVE-2008-0539 EXP | Cross-site scripting (XSS) vulnerability in dms/policy/rep_request.php in F5 BIG-IP Application Security Manager (ASM) 9.4.3 allows remote attackers t… | Patch early | 4.3 medium | 7.2% | 2008-02-01 |
| CVE-2007-1649 EXP | PHP 5.2.1 allows context-dependent attackers to read portions of heap memory by executing certain scripts with a serialized data input string beginnin… | Patch early | 7.8 high | 7.2% | 2007-03-24 |
| CVE-2012-2396 EXP | VideoLAN VLC media player 2.0.1 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted MP4 fi… | Patch early | 4.3 medium | 7.2% | 2012-04-19 |
| CVE-2017-7046 EXP | An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. iCloud before 6.2.2 on Windows is… | Patch early | 8.8 high | 7.2% | 2017-07-20 |
| CVE-2005-2850 EXP | SlimFTPd 3.17 allows remote attackers to cause a denial of service (crash) via certain (1) USER and (2) PASS commands, possibly due to a buffer overfl… | Patch early | 5.0 medium | 7.2% | 2005-09-08 |
| CVE-2015-1578 EXP | Multiple open redirect vulnerabilities in u5CMS before 3.9.4 allow remote attackers to redirect users to arbitrary web sites and conduct phishing atta… | Patch early | 5.8 medium | 7.2% | 2015-02-11 |
| CVE-2018-5333 EXP | In the Linux kernel through 4.14.13, the rds_cmsg_atomic function in net/rds/rdma.c mishandles cases where page pinning fails or an invalid address is… | Patch early | 5.5 medium | 7.2% | 2018-01-11 |
| CVE-2010-1177 EXP | Safari on Apple iPhone OS 3.1.3 for iPod touch allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary… | Patch early | 9.3 high | 7.2% | 2010-03-29 |
| CVE-2007-6314 EXP | BarracudaDrive Web Server before 3.8 allows remote attackers to read the source code for web scripts by appending a (1) + (plus), (2) . (dot), or (3)… | Patch early | 5.0 medium | 7.2% | 2007-12-12 |
| CVE-2000-0640 EXP | Guild FTPd allows remote attackers to determine the existence of files outside the FTP root via a .. (dot dot) attack, which provides different error… | Patch early | 7.5 high | 7.2% | 2000-07-08 |
| CVE-2009-1227 EXP | NOTE: this issue has been disputed by the vendor. Buffer overflow in the PKI Web Service in Check Point Firewall-1 PKI Web Service allows remote atta… | Patch early | 10.0 high | 7.2% | 2009-04-02 |
| CVE-2007-5110 EXP | Absolute path traversal vulnerability in the EbCrypt.eb_c_PRNGenerator.1 ActiveX control in EBCRYPT.DLL 2.0.0.2087 and earlier in EB Design ebCrypt al… | Patch early | 7.5 high | 7.2% | 2007-09-26 |
| CVE-2022-40319 EXP | The LISTSERV 17 web interface allows remote attackers to conduct Insecure Direct Object References (IDOR) attacks via a modified email address in a wa… | Patch early | 7.5 high | 7.2% | 2023-01-17 |
| CVE-2006-2481 EXP | VMware ESX Server 2.0.x before 2.0.2 and 2.x before 2.5.2 patch 4 stores authentication credentials in base 64 encoded format in the vmware.mui.kid an… | Patch early | 5.0 medium | 7.2% | 2006-07-31 |
| CVE-2007-2192 EXP | Buffer overflow in Photofiltre Studio 8.1.1 allows user-assisted remote attackers to execute arbitrary code via a crafted .tif file. | Patch early | 9.3 high | 7.2% | 2007-04-24 |
| CVE-2008-0071 EXP | The Web UI interface in (1) BitTorrent before 6.0.3 build 8642 and (2) uTorrent before 1.8beta build 10524 allows remote attackers to cause a denial o… | Patch early | 4.3 medium | 7.2% | 2008-06-16 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt