CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
404,381 CVEs
1,739 on KEV
17,299 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-12
322,122 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2012-2315 EXP | admin/Auth in OpenKM 5.1.7 and other versions before 5.1.8-2 does not properly enforce privileges for changing user roles, which allows remote authent… | Patch early | 4.0 medium | 6.2% | 2012-09-09 |
| CVE-2017-7049 EXP | An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. iCloud before 6.2.2 on Windows is… | Patch early | 8.8 high | 6.2% | 2017-07-20 |
| CVE-2007-5642 EXP | Multiple directory traversal vulnerabilities in PHP Project Management 0.8.10 and earlier allow remote attackers to include and execute arbitrary loca… | Patch early | 6.8 medium | 6.2% | 2007-10-23 |
| CVE-2015-2824 EXP | Multiple SQL injection vulnerabilities in the Simple Ads Manager plugin before 2.7.97 for WordPress allow remote attackers to execute arbitrary SQL co… | Patch early | 7.5 high | 6.2% | 2015-04-06 |
| CVE-2007-5837 EXP | GUI.pm in yarssr 0.2.2, when Gnome default URL handling is disabled, allows remote attackers to execute arbitrary commands via shell metacharacters in… | Patch early | 6.8 medium | 6.2% | 2007-11-05 |
| CVE-2009-4051 EXP | Home FTP Server 1.10.1.139 allows remote attackers to cause a denial of service (daemon outage) via multiple invalid SITE INDEX commands. | Patch early | 5.0 medium | 6.2% | 2009-11-23 |
| CVE-2009-3838 EXP | Stack-based buffer overflow in Pegasus Mail (PMail) 4.41 and possibly 4.51 allows remote POP3 servers to cause a denial of service (application crash)… | Patch early | 9.3 high | 6.2% | 2009-11-02 |
| CVE-2009-1724 EXP | Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 4.0.2, as used on iPhone OS before 3.1, iPhone OS before 3.1.1 for iPod touc… | Patch early | 4.3 medium | 6.2% | 2009-07-09 |
| CVE-2007-4174 EXP | Tor before 0.1.2.16, when ControlPort is enabled, does not properly restrict commands to localhost port 9051, which allows remote attackers to modify… | Patch early | 5.8 medium | 6.2% | 2007-08-07 |
| CVE-2008-1480 EXP | rpc.metad in Sun Solaris 10 allows remote attackers to cause a denial of service (daemon crash) via a malformed RPC request. | Patch early | 4.3 medium | 6.2% | 2008-03-24 |
| CVE-2001-0421 EXP | FTP server in Solaris 8 and earlier allows local and remote attackers to cause a core dump in the root directory, possibly with world-readable permiss… | Patch early | 6.4 medium | 6.2% | 2001-07-02 |
| CVE-2020-20969 EXP | File Upload vulnerability in PluckCMS v.4.7.10 allows a remote attacker to execute arbitrary code via the trashcan_restoreitem.php file. | Patch early | 7.2 high | 6.2% | 2023-06-20 |
| CVE-2000-0626 EXP | Buffer overflow in Alibaba web server allows remote attackers to cause a denial of service via a long GET request. | Patch early | 5.0 medium | 6.2% | 2000-07-18 |
| CVE-2008-5932 EXP | CodeAvalanche FreeForum stores sensitive information under the web root with insufficient access control, which allows remote attackers to download th… | Patch early | 5.0 medium | 6.2% | 2009-01-21 |
| CVE-2008-6869 EXP | Oramon Oracle Database Monitoring Tool 2.0.1 stores sensitive information under the web root with insufficient access control, which allows remote att… | Patch early | 5.0 medium | 6.2% | 2009-07-23 |
| CVE-2000-0001 EXP | RealMedia server allows remote attackers to cause a denial of service via a long ramgen request. | Patch early | 5.0 medium | 6.2% | 1999-12-23 |
| CVE-2006-4731 EXP | Multiple directory traversal vulnerabilities in (1) login.pl and (2) admin.pl in (a) SQL-Ledger before 2.6.19 and (b) LedgerSMB before 1.0.0p1 allow r… | Patch early | 5.0 medium | 6.2% | 2006-09-13 |
| CVE-2008-4907 EXP | The message parsing feature in Dovecot 1.1.4 and 1.1.5, when using the FETCH ENVELOPE command in the IMAP client, allows remote attackers to cause a d… | Patch early | 4.3 medium | 6.2% | 2008-11-04 |
| CVE-2004-1303 EXP | Buffer overflow in the get function in get.c for Yanf 0.4 allows remote malicious web servers to execute arbitrary code via crafted HTTP responses. | Patch early | 10.0 high | 6.2% | 2005-01-10 |
| CVE-2009-0422 EXP | Dynamic variable evaluation vulnerability in lists/admin.php in phpList 2.10.8 and earlier, when register_globals is disabled, allows remote attackers… | Patch early | 7.5 high | 6.2% | 2009-02-05 |
| CVE-2007-6273 EXP | Multiple format string vulnerabilities in the configuration file in SonicWALL GLobal VPN Client 3.1.556 and 4.0.0.810 allow user-assisted remote attac… | Patch early | 9.3 high | 6.2% | 2007-12-07 |
| CVE-2002-0942 EXP | Buffer overflows in Lugiment Log Explorer before 3.02 allow attackers with database permissions to execute arbitrary code via long arguments to the ex… | Patch early | 7.5 high | 6.2% | 2002-10-04 |
| CVE-2014-8603 EXP | cloner.functions.php in the XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! allows remote administrators to execute arbitrary code via shell… | Patch early | 6.5 medium | 6.2% | 2015-06-10 |
| CVE-2008-1357 EXP | Format string vulnerability in the logDetail function of applib.dll in McAfee Common Management Agent (CMA) 3.6.0.574 (Patch 3) and earlier, as used i… | Patch early | 5.4 medium | 6.2% | 2008-03-17 |
| CVE-2003-1354 EXP | Multiple GameSpy 3D 2.62 compatible gaming servers generate very large UDP responses to small requests, which allows remote attackers to use the serve… | Patch early | 5.0 medium | 6.2% | 2003-12-31 |
| CVE-2007-0466 EXP | Telestream Flip4Mac Windows Media Components for Quicktime 2.1.0.33 allows remote attackers to execute arbitrary code via a crafted ASF_File_Propertie… | Patch early | 10.0 high | 6.2% | 2007-01-31 |
| CVE-2024-24409 EXP | Zohocorp ManageEngine ADManager Plus versions 7203 and prior are vulnerable to Privilege Escalation in the Modify Computers option. | Patch early | 8.8 high | 6.2% | 2024-11-08 |
| CVE-2009-0262 EXP | Stack-based buffer overflow in Triologic Media Player 7 and 8.0.0.0 allows user-assisted remote attackers to execute arbitrary code via a long string… | Patch early | 9.3 high | 6.2% | 2009-01-23 |
| CVE-2018-10018 EXP | The GDASPAMLib.AntiSpam ActiveX control ASK\GDASpam.dll in G DATA Total Security 25.4.0.3 has a buffer overflow via a long IsBlackListed argument. | Patch early | 8.8 high | 6.2% | 2018-07-13 |
| CVE-2003-1469 EXP | The default configuration of ColdFusion MX has the "Enable Robust Exception Information" option selected, which allows remote attackers to obtain the… | Patch early | 5.0 medium | 6.2% | 2003-12-31 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt