CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
403,734 CVEs
1,739 on KEV
17,300 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-10
403,734 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2018-4218 EXP | An issue was discovered in certain Apple products. iOS before 11.4 is affected. Safari before 11.1.1 is affected. iCloud before 7.5 on Windows is affe… | Patch early | 8.8 high | 9% | 2018-06-08 |
| CVE-2007-4802 EXP | Multiple heap-based buffer overflows in GlobalLink 2.7.0.8 allow remote attackers to execute arbitrary code via (1) a long eighth argument to the SetI… | Patch early | 6.8 medium | 9% | 2007-09-11 |
| CVE-2018-14418 EXP | In Msvod Cms v10, SQL Injection exists via an images/lists?cid= URI. | Patch early | 9.8 critical | 9% | 2018-07-20 |
| CVE-2021-44673 EXP | A Remote Code Execution (RCE) vulnerability exists in Croogo 3.0.2via admin/file-manager/attachments, which lets a malicoius user upload a web shell s… | Patch early | 8.8 high | 9% | 2022-03-10 |
| CVE-2025-27533 EXP | Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ. During unmarshalling of OpenWire commands the size value of buffers was… | Patch early | 7.5 high | 9% | 2025-05-07 |
| CVE-2004-0409 EXP | Stack-based buffer overflow in the Socks-5 proxy code for XChat 1.8.0 to 2.0.8, with socks5 traversal enabled, allows remote attackers to execute arbi… | Patch early | 7.5 high | 9% | 2004-06-01 |
| CVE-2011-2744 EXP | Directory traversal vulnerability in Chyrp 2.1 and earlier allows remote attackers to include and execute arbitrary local files via a ..%2F (encoded d… | Patch early | 6.8 medium | 9% | 2011-07-19 |
| CVE-2007-3336 EXP | Multiple "pointer overwrite" vulnerabilities in Ingres database server 2006 9.0.4, r3, 2.6, and 2.5, as used in multiple CA (formerly Computer Associa… | Patch early | 10.0 high | 9% | 2007-06-22 |
| CVE-2010-1840 EXP | Stack-based buffer overflow in the password-validation functionality in Directory Services in Apple Mac OS X 10.5.8 and 10.6.x before 10.6.5 allows re… | Patch early | 7.5 high | 9% | 2010-11-15 |
| CVE-2004-1269 EXP | lppasswd in CUPS 1.1.22 does not remove the passwd.new file if it encounters a file-size resource limit while writing to passwd.new, which causes subs… | Patch early | 5.0 medium | 9% | 2005-01-10 |
| CVE-2009-4495 EXP | Yaws 1.85 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or pos… | Patch early | 5.0 medium | 9% | 2010-01-13 |
| CVE-2002-1816 EXP | Off-by-one buffer overflow in the sock_gets function in sockhelp.c for ATPhttpd 0.4b and earlier allows remote attackers to execute arbitrary code via… | Patch early | 9.8 critical | 9% | 2002-12-31 |
| CVE-2022-31056 EXP | GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. In affect… | Patch early | 9.8 critical | 9% | 2022-06-28 |
| CVE-2019-3474 EXP | A path traversal vulnerability in the web application component of Micro Focus Filr 3.x allows a remote attacker authenticated as a low privilege user… | Patch early | 6.5 medium | 9% | 2019-02-20 |
| CVE-2009-2285 EXP | Buffer underflow in the LZWDecodeCompat function in libtiff 3.8.2 allows context-dependent attackers to cause a denial of service (crash) via a crafte… | Patch early | 4.3 medium | 9% | 2009-07-01 |
| CVE-2009-2817 EXP | Buffer overflow in Apple iTunes before 9.0.1 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a… | Patch early | 9.3 high | 8.9% | 2009-09-24 |
| CVE-2008-3286 EXP | SWAT 4 1.1 and earlier allows remote attackers to cause a denial of service (daemon crash) via a (1) VERIFYCONTENT or (2) GAMECONFIG command sent to t… | Patch early | 5.0 medium | 8.9% | 2008-07-24 |
| CVE-2012-1835 EXP | Multiple cross-site scripting (XSS) vulnerabilities in the All-in-One Event Calendar plugin 1.4 and 1.5 for WordPress allow remote attackers to inject… | Patch early | 4.3 medium | 8.9% | 2012-08-14 |
| CVE-2001-0080 EXP | Cisco Catalyst 6000, 5000, or 4000 switches allow remote attackers to cause a denial of service by connecting to the SSH service with a non-SSH client… | Patch early | 5.0 medium | 8.9% | 2001-02-12 |
| CVE-2016-4004 EXP | Directory traversal vulnerability in Dell OpenManage Server Administrator (OMSA) 8.2 allows remote authenticated administrators to read arbitrary file… | Patch early | 4.9 medium | 8.9% | 2016-04-12 |
| CVE-2009-4494 EXP | AOLserver 4.5.1 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title,… | Patch early | 5.0 medium | 8.9% | 2010-01-13 |
| CVE-1999-0985 EXP | CC Whois program whois.cgi allows remote attackers to execute commands via shell metacharacters in the domain entry. | Patch early | 7.5 high | 8.9% | 1999-11-09 |
| CVE-2008-1561 EXP | Multiple unspecified vulnerabilities in Wireshark (formerly Ethereal) 0.99.5 through 0.99.8 allow remote attackers to cause a denial of service (appli… | Patch early | 5.0 medium | 8.9% | 2008-03-31 |
| CVE-2012-1010 EXP | Unrestricted file upload vulnerability in actions.php in the AllWebMenus plugin before 1.1.8 for WordPress allows remote attackers to execute arbitrar… | Patch early | 7.5 high | 8.9% | 2012-02-07 |
| CVE-2021-41382 EXP | Plastic SCM before 10.0.16.5622 mishandles the WebAdmin server management interface. | Patch early | 7.5 high | 8.9% | 2021-09-22 |
| CVE-2003-0211 EXP | Memory leak in xinetd 2.3.10 allows remote attackers to cause a denial of service (memory consumption) via a large number of rejected connections. | Patch early | 5.0 medium | 8.9% | 2003-05-05 |
| CVE-2000-0017 EXP | Buffer overflow in Linux linuxconf package allows remote attackers to gain root privileges via a long parameter. | Patch early | 10.0 high | 8.9% | 1999-12-21 |
| CVE-2007-2363 EXP | Buffer overflow in IrfanView 4.00 and earlier allows user-assisted remote attackers to execute arbitrary code via a crafted .IFF file. | Patch early | 8.5 high | 8.9% | 2007-04-30 |
| CVE-2008-5642 EXP | Directory traversal vulnerability in admin/login.php in CMS Made Simple 1.4.1 allows remote attackers to read arbitrary files via a .. (dot dot) in a… | Patch early | 5.0 medium | 8.9% | 2008-12-17 |
| CVE-2013-3541 EXP | Directory traversal vulnerability in cgi-bin/admin/fileread in AirLive WL2600CAM and possibly other camera models allows remote attackers to read arbi… | Patch early | 7.8 high | 8.9% | 2013-10-04 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt