CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
404,394 CVEs
1,739 on KEV
17,299 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-12
322,134 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2009-2180 EXP | Multiple directory traversal vulnerabilities in upfiles/index.php in Pc4 Uploader 10.0 and earlier allow remote attackers to read arbitrary files via… | Patch early | 5.0 medium | 6.1% | 2009-06-23 |
| CVE-2007-5812 EXP | Directory traversal vulnerability in modules/Builder/DownloadModule.php in ModuleBuilder 1.0 allows remote attackers to read arbitrary files via a ..… | Patch early | 5.0 medium | 6.1% | 2007-11-05 |
| CVE-2018-15740 EXP | Zoho ManageEngine ADManager Plus 6.5.7 has XSS on the "Workflow Delegation" "Requester Roles" screen. | Patch early | 6.1 medium | 6.1% | 2018-08-28 |
| CVE-2005-4809 EXP | Mozilla Firefox 1.0.1 and possibly other versions, including Mozilla and Thunderbird, allows remote attackers to spoof the URL in the Status Bar via a… | Patch early | 5.0 medium | 6.1% | 2005-12-31 |
| CVE-2015-1366 EXP | Cross-site scripting (XSS) vulnerability in pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress allows remote attackers to inject… | Patch early | 4.3 medium | 6.1% | 2015-01-27 |
| CVE-2016-3219 EXP | The kernel-mode driver in Microsoft Windows 10 Gold and 1511 allows local users to gain privileges via a crafted application, aka "Win32k Elevation of… | Patch early | 7.8 high | 6.1% | 2016-06-16 |
| CVE-2007-6614 EXP | PHP remote file inclusion vulnerability in admin/frontpage_right.php in Agares Media phpAutoVideo 2.21 allows remote attackers to execute arbitrary PH… | Patch early | 6.8 medium | 6.1% | 2008-01-03 |
| CVE-2017-9259 EXP | The TDStretch::acceptNewOverlapLength function in source/SoundTouch/TDStretch.cpp in SoundTouch 1.9.2 allows remote attackers to cause a denial of ser… | Patch early | 5.5 medium | 6.1% | 2017-07-27 |
| CVE-2003-1397 EXP | The PluginContext object of Opera 6.05 and 7.0 allows remote attackers to cause a denial of service (crash) via an HTTP request containing a long stri… | Patch early | 4.3 medium | 6.1% | 2003-12-31 |
| CVE-2018-7466 EXP | install/installNewDB.php in TestLink through 1.9.16 allows remote attackers to conduct injection attacks by leveraging control over DB LOGIN NAMES dat… | Patch early | 7.5 high | 6.1% | 2018-02-25 |
| CVE-2007-1331 EXP | Multiple cross-site scripting (XSS) vulnerabilities in TKS Banking Solutions ePortfolio 1.0 Java allow remote attackers to inject arbitrary web script… | Patch early | 4.3 medium | 6.1% | 2007-03-07 |
| CVE-2007-3167 EXP | Stack-based buffer overflow in the Vivotek Motion Jpeg ActiveX control (aka MjpegControl) in MjpegDecoder.dll 2.0.0.13 allows remote attackers to exec… | Patch early | 7.6 high | 6.1% | 2007-06-11 |
| CVE-2007-2761 EXP | Stack-based buffer overflow in MagicISO 5.4 build 239 and earlier allows remote attackers to execute arbitrary code via a long filename in a .cue file… | Patch early | 7.5 high | 6.1% | 2007-05-18 |
| CVE-2008-6143 EXP | OwenPoll 1.0 allows remote attackers to bypass authentication and obtain administrative access via a modified account name in the username cookie. | Patch early | 7.5 high | 6.1% | 2009-02-16 |
| CVE-2009-3306 EXP | PHP remote file inclusion vulnerability in include/header.php in ClearSite 4.50 allows remote attackers to execute arbitrary PHP code via a URL in the… | Patch early | 7.5 high | 6.1% | 2009-09-23 |
| CVE-1999-0238 EXP | php.cgi allows attackers to read any file on the system. | Patch early | 10.0 high | 6.1% | 1997-08-01 |
| CVE-2005-3133 EXP | Multiple directory traversal vulnerabilities in MERAK Mail Server 8.2.4r with Icewarp Web Mail 5.5.1, and possibly earlier versions, allows remote att… | Patch early | 5.0 medium | 6.1% | 2005-10-04 |
| CVE-2009-1610 EXP | admin/changepassword.php in Job Script Job Board Software 2.0 allows remote attackers to change the administrator password and gain administrator priv… | Patch early | 7.5 high | 6.1% | 2009-05-11 |
| CVE-2006-3277 EXP | The SMTP service of MailEnable Standard 1.92 and earlier, Professional 2.0 and earlier, and Enterprise 2.0 and earlier before the MESMTPC hotfix, allo… | Patch early | 5.0 medium | 6.1% | 2006-06-28 |
| CVE-2002-0855 EXP | Cross-site scripting vulnerability in Mailman before 2.0.12 allows remote attackers to execute script as other users via a subscriber's list subscript… | Patch early | 7.5 high | 6.1% | 2002-09-05 |
| CVE-2009-0457 EXP | Multiple directory traversal vulnerabilities in AJA Portal 1.2 allow remote attackers to include and execute arbitrary local files via directory trave… | Patch early | 7.5 high | 6.1% | 2009-02-10 |
| CVE-2000-1046 EXP | Multiple buffer overflows in the ESMTP service of Lotus Domino 5.0.2c and earlier allow remote attackers to cause a denial of service and possibly exe… | Patch early | 10.0 high | 6.1% | 2000-12-11 |
| CVE-2007-1882 EXP | qcbin/servlet/tdservlet/TDAPI_GeneralWebTreatment in HP Mercury Quality Center 9.0 build 9.1.0.4352 allows remote authenticated users to execute arbit… | Patch early | 6.5 medium | 6.1% | 2007-04-06 |
| CVE-2005-2540 EXP | CRLF injection vulnerability in FlatNuke 2.5.5 and possibly earlier versions allows remote attackers to execute arbitrary PHP commands via an ASCII ch… | Patch early | 5.0 medium | 6.1% | 2005-08-10 |
| CVE-2009-2363 EXP | Stack-based buffer overflow in KUDRSOFT AudioPLUS 2.00.215 allows remote attackers to execute arbitrary code via a .pls playlist file with a playlist… | Patch early | 9.3 high | 6.1% | 2009-07-08 |
| CVE-2009-1652 EXP | admin/adminaddeditdetails.php in Business Community Script does not properly restrict access, which allows remote attackers to gain privileges and add… | Patch early | 7.5 high | 6.1% | 2009-05-16 |
| CVE-2006-7068 EXP | PHP remote file inclusion vulnerability in CliServ Web Community 0.65 and earlier allows remote attackers to execute arbitrary PHP code via a URL in t… | Patch early | 7.5 high | 6.1% | 2007-03-02 |
| CVE-2001-0029 EXP | Buffer overflow in oops WWW proxy server 1.4.6 (and possibly other versions) allows remote attackers to execute arbitrary commands via a long host or… | Patch early | 10.0 high | 6.1% | 2001-02-12 |
| CVE-2018-6221 EXP | An unvalidated software update vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow a man-in-the-middle attacker to tamper with an up… | Patch early | 8.1 high | 6.1% | 2018-03-15 |
| CVE-2014-5345 EXP | Cross-site scripting (XSS) vulnerability in upgrade.php in the Disqus Comment System plugin before 2.76 for WordPress allows remote attackers to injec… | Patch early | 4.3 medium | 6.1% | 2014-08-19 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt