CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
403,734 CVEs
1,739 on KEV
17,300 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-10
403,734 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2007-1700 EXP | The session extension in PHP 4 before 4.4.5, and PHP 5 before 5.2.1, calculates the reference count for the session variables without considering the… | Patch early | 7.5 high | 9% | 2007-03-27 |
| CVE-2014-0007 EXP | The Smart-Proxy in Foreman before 1.4.5 and 1.5.x before 1.5.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the p… | Patch early | 7.5 high | 9% | 2014-06-20 |
| CVE-2007-1156 EXP | JBrowser allows remote attackers to bypass authentication and access certain administrative capabilities via a direct request for _admin/. | Patch early | 7.5 high | 9% | 2007-03-02 |
| CVE-2000-0656 EXP | Buffer overflow in AnalogX proxy server 4.04 and earlier allows remote attackers to cause a denial of service via a long USER command in the FTP proto… | Patch early | 5.0 medium | 9% | 2000-07-25 |
| CVE-2016-10043 EXP | An issue was discovered in Radisys MRF Web Panel (SWMS) 9.0.1. The MSM_MACRO_NAME POST parameter in /swms/ms.cgi was discovered to be vulnerable to OS… | Patch early | 10.0 critical | 9% | 2017-01-31 |
| CVE-2019-10849 EXP | Computrols CBAS 18.0.0 allows unprotected Subversion (SVN) directory / source code disclosure. | Patch early | 7.5 high | 9% | 2019-05-23 |
| CVE-2010-2008 EXP | MySQL before 5.1.48 allows remote authenticated users with alter database privileges to cause a denial of service (server crash and database loss) via… | Patch early | 3.5 low | 9% | 2010-07-13 |
| CVE-2009-1220 EXP | Cross-site scripting (XSS) vulnerability in +webvpn+/index.html in WebVPN on the Cisco Adaptive Security Appliances (ASA) 5520 with software 7.2(4)30… | Patch early | 4.3 medium | 9% | 2009-04-01 |
| CVE-2013-0742 EXP | Stack-based buffer overflow in Corel PDF Fusion 1.11 allows remote attackers to execute arbitrary code or cause a denial of service (application crash… | Patch early | 9.3 high | 9% | 2013-10-03 |
| CVE-2006-3175 EXP | Multiple PHP remote file inclusion vulnerabilities in mcGuestbook 1.3 allow remote attackers to execute arbitrary PHP code via a URL in the lang param… | Patch early | 7.5 high | 9% | 2006-06-23 |
| CVE-2008-0132 EXP | Pragma FortressSSH 5.0 Build 4 Revision 293 and earlier handles long input to sshd.exe by creating an error-message window and waiting for the adminis… | Patch early | 5.0 medium | 9% | 2008-01-08 |
| CVE-2001-0461 EXP | template.cgi in Free On-Line Dictionary of Computing (FOLDOC) allows remote attackers to read files and execute commands via shell metacharacters in t… | Patch early | 7.5 high | 9% | 2001-06-27 |
| CVE-2005-0892 EXP | Buffer overflow in smail 3.2.0.120 allows remote attackers or local users to execute arbitrary code via a long string in the MAIL FROM command and pos… | Patch early | 10.0 high | 9% | 2005-03-28 |
| CVE-2004-1965 EXP | Multiple cross-site scripting (XSS) vulnerabilities in Open Bulletin Board (OpenBB) 1.0.6 and earlier allows remote attackers to inject arbitrary web… | Patch early | 4.3 medium | 9% | 2004-04-25 |
| CVE-2006-4126 EXP | The dc_chat function in cmd.dc.c in DConnect Daemon 0.7.0 and earlier allows remote attackers to cause a denial of service (application crash) by send… | Patch early | 5.0 medium | 9% | 2006-08-14 |
| CVE-2006-4192 EXP | Multiple buffer overflows in MODPlug Tracker (OpenMPT) 1.17.02.43 and earlier and libmodplug 0.8 and earlier, as used in GStreamer and possibly other… | Patch early | 5.1 medium | 9% | 2006-08-17 |
| CVE-2018-5359 EXP | The server in Flexense SysGauge 3.6.18 operating on port 9221 can be exploited remotely with the attacker gaining system-level access because of a Buf… | Patch early | 8.1 high | 9% | 2018-01-23 |
| CVE-2014-2846 EXP | Directory traversal vulnerability in opt/arkeia/wui/htdocs/index.php in the WD Arkeia virtual appliance (AVA) with firmware before 10.2.9 allows remot… | Patch early | 7.5 high | 9% | 2014-04-28 |
| CVE-2007-3297 EXP | Multiple PHP remote file inclusion vulnerabilities in Musoo 0.21 allow remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[ini_arr… | Patch early | 7.5 high | 9% | 2007-06-20 |
| CVE-2007-2947 EXP | Multiple PHP remote file inclusion vulnerabilities in OpenBASE Alpha 0.6 allow remote attackers to execute arbitrary PHP code via a URL in the root_pr… | Patch early | 7.5 high | 9% | 2007-05-31 |
| CVE-2006-3144 EXP | PHP remote file inclusion vulnerability in micro_cms_files/microcms-include.php in Implied By Design (IBD) Micro CMS 3.5 (aka 0.3.5) and earlier allow… | Patch early | 7.5 high | 9% | 2006-06-22 |
| CVE-2013-1436 EXP | The XMonad.Hooks.DynamicLog module in xmonad-contrib before 0.11.2 allows remote attackers to execute arbitrary commands via a web page title, which a… | Patch early | 7.5 high | 9% | 2014-10-06 |
| CVE-2013-2118 EXP | SPIP 3.0.x before 3.0.9, 2.1.x before 2.1.22, and 2.0.x before 2.0.23 allows remote attackers to gain privileges and "take editorial control" via vect… | Patch early | 7.5 high | 9% | 2013-07-09 |
| CVE-2020-25495 EXP | A reflected Cross-site scripting (XSS) vulnerability in Xinuo (formerly SCO) Openserver version 5 and 6 allows remote attackers to inject arbitrary we… | Patch early | 6.1 medium | 9% | 2020-12-18 |
| CVE-2019-9184 EXP | SQL injection vulnerability in the J2Store plugin 3.x before 3.3.7 for Joomla! allows remote attackers to execute arbitrary SQL commands via the produ… | Patch early | 9.8 critical | 9% | 2019-02-26 |
| CVE-2016-9315 EXP | Privilege Escalation Vulnerability in com.trend.iwss.gui.servlet.updateaccountadministration in Trend Micro InterScan Web Security Virtual Appliance (… | Patch early | 8.8 high | 9% | 2017-02-21 |
| CVE-2008-4769 EXP | Directory traversal vulnerability in the get_category_template function in wp-includes/theme.php in WordPress 2.3.3 and earlier, and 2.5, allows remot… | Patch early | 9.3 high | 9% | 2008-10-28 |
| CVE-2012-2276 EXP | The IRM Server in EMC Documentum Information Rights Management 4.x before 4.7.0100 and 5.x before 5.0.1030 allows remote attackers to cause a denial o… | Patch early | 7.8 high | 9% | 2012-05-14 |
| CVE-2019-6224 EXP | A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 12.1.3, macOS Mojave 10.14.3, tvOS 12.1.2, watchOS 5.1… | Patch early | 8.8 high | 9% | 2019-03-05 |
| CVE-2013-4985 EXP | Multiple Vivotek IP Cameras remote authentication bypass that could allow access to the video stream | Patch early | 7.5 high | 9% | 2019-12-27 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt