CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
404,806 CVEs
1,739 on KEV
17,301 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-12
322,433 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2003-0380 EXP | Buffer overflow in atftp daemon (atftpd) 0.6.1 and earlier, and possibly later versions, allows remote attackers to cause a denial of service (crash)… | Patch early | 7.5 high | 5.8% | 2003-07-02 |
| CVE-2009-0753 EXP | Absolute path traversal vulnerability in MLDonkey 2.8.4 through 2.9.7 allows remote attackers to read arbitrary files via a leading "//" (double slash… | Patch early | 5.0 medium | 5.8% | 2009-03-03 |
| CVE-2008-1920 EXP | Heap-based buffer overflow in the boxelyRenderer module in the Personal Status Manager feature in ICQ 6.0 build 6043 allows remote attackers to cause… | Patch early | 7.5 high | 5.8% | 2008-04-23 |
| CVE-2019-11429 EXP | CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.793 (Free/Open Source Version), 0.9.8.753 (Pro) and 0.9.8.807 (Pro) is vulnerable to Reflected XS… | Patch early | 4.8 medium | 5.8% | 2019-05-13 |
| CVE-2007-2820 EXP | Multiple stack-based buffer overflows in the KSign KSignSWAT ActiveX Control (AxKSignSWAT.dll) 2.0.3.3 allow remote attackers to execute arbitrary cod… | Patch early | 7.5 high | 5.8% | 2007-05-22 |
| CVE-2002-0900 EXP | Buffer overflow in pks PGP public key web server before 0.9.5 allows remote attackers to cause a denial of service (crash) and possibly execute arbitr… | Patch early | 7.5 high | 5.8% | 2002-10-04 |
| CVE-2007-1141 EXP | PHP remote file inclusion vulnerability in preview.php in Magic News Plus 1.0.2 allows remote attackers to execute arbitrary PHP code via a URL in the… | Patch early | 7.5 high | 5.8% | 2007-03-02 |
| CVE-2007-4186 EXP | PHP remote file inclusion vulnerability in admin.tour_toto.php in the Tour de France Pool (com_tour_toto) 1.0.1 module for Joomla! allows remote attac… | Patch early | 6.8 medium | 5.8% | 2007-08-08 |
| CVE-2000-0166 EXP | Buffer overflow in the InterAccess telnet server TelnetD allows remote attackers to execute commands via a long login name. | Patch early | 10.0 high | 5.8% | 2000-02-21 |
| CVE-2000-0425 EXP | Buffer overflow in the Web Archives component of L-Soft LISTSERV 1.8 allows remote attackers to execute arbitrary commands. | Patch early | 10.0 high | 5.8% | 2000-05-03 |
| CVE-2021-3394 EXP | Millennium Millewin (also known as "Cartella clinica") 13.39.028, 13.39.28.3342, and 13.39.146.1 has insecure folder permissions allowing a malicious… | Patch early | 8.8 high | 5.8% | 2021-02-09 |
| CVE-2018-9115 EXP | Systematic SitaWare 6.4 SP2 does not validate input from other sources sufficiently. e.g., information utilizing the NVG interface. An attacker can fr… | Patch early | 5.3 medium | 5.8% | 2018-04-04 |
| CVE-2005-1413 EXP | Multiple SQL injection vulnerabilities in enVivo!CMS allow remote attackers to execute arbitrary SQL commands and gain privileges via the (1) username… | Patch early | 7.5 high | 5.8% | 2005-05-03 |
| CVE-2012-4751 EXP | Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) Help Desk 2.4.x before 2.4.15, 3.0.x before 3.0.17, and 3.1.x before 3.1… | Patch early | 4.3 medium | 5.8% | 2012-10-22 |
| CVE-2013-5692 EXP | Directory traversal vulnerability in X2Engine X2CRM before 3.5 allows remote authenticated administrators to include and execute arbitrary local files… | Patch early | 8.5 high | 5.8% | 2013-09-30 |
| CVE-2007-5446 EXP | Absolute path traversal vulnerability in a certain ActiveX control in PBEmail7Ax.dll in PBEmail 7 ActiveX Edition allows remote attackers to create or… | Patch early | 6.4 medium | 5.8% | 2007-10-14 |
| CVE-2009-4964 EXP | Stack-based buffer overflow in KSP 2006 FINAL allows remote attackers to execute arbitrary code via a long string in a .M3U playlist file. | Patch early | 9.3 high | 5.8% | 2010-07-28 |
| CVE-2009-3338 EXP | Stack-based buffer overflow in EffectMatrix (E.M.) Magic Morph 1.95b allows remote attackers to execute arbitrary code via a long string in a .mor fil… | Patch early | 9.3 high | 5.8% | 2009-09-24 |
| CVE-2009-3670 EXP | Stack-based buffer overflow in KSP Sound Player 2009 R2 and R2.1 allows remote attackers to execute arbitrary code via a long string in a .m3u playlis… | Patch early | 9.3 high | 5.8% | 2009-10-11 |
| CVE-2008-6897 EXP | Multiple buffer overflows in Getleft.exe in Andres Garcia Getleft 1.2 allow remote attackers to cause a denial of service (crash) and possibly execute… | Patch early | 9.3 high | 5.8% | 2009-08-05 |
| CVE-2017-13784 EXP | An issue was discovered in certain Apple products. iOS before 11.1 is affected. Safari before 11.0.1 is affected. iCloud before 7.1 on Windows is affe… | Patch early | 8.8 high | 5.8% | 2017-11-13 |
| CVE-2017-13785 EXP | An issue was discovered in certain Apple products. iOS before 11.1 is affected. Safari before 11.0.1 is affected. iCloud before 7.1 on Windows is affe… | Patch early | 8.8 high | 5.8% | 2017-11-13 |
| CVE-2017-13792 EXP | An issue was discovered in certain Apple products. iOS before 11.1 is affected. Safari before 11.0.1 is affected. iCloud before 7.1 on Windows is affe… | Patch early | 8.8 high | 5.8% | 2017-11-13 |
| CVE-2017-13795 EXP | An issue was discovered in certain Apple products. iOS before 11.1 is affected. Safari before 11.0.1 is affected. iCloud before 7.1 on Windows is affe… | Patch early | 8.8 high | 5.8% | 2017-11-13 |
| CVE-2017-13802 EXP | An issue was discovered in certain Apple products. iOS before 11.1 is affected. Safari before 11.0.1 is affected. iCloud before 7.1 on Windows is affe… | Patch early | 8.8 high | 5.8% | 2017-11-13 |
| CVE-2006-1839 EXP | PHP remote file inclusion vulnerability in language.php in PHP Album 0.3.2.3, when register_globals is enabled, allows remote attackers to execute arb… | Patch early | 7.5 high | 5.8% | 2006-04-19 |
| CVE-2005-3558 EXP | PHP file inclusion vulnerability in index.php in OSTE 1.0 allows remote attackers to execute arbitrary code via the (1) page and (2) site parameters. | Patch early | 7.5 high | 5.8% | 2005-11-16 |
| CVE-2008-6983 EXP | modules/tool/hitcounter.php in devalcms 1.4a allows remote attackers to execute arbitrary PHP code via the HTTP Referer header with a target file spec… | Patch early | 7.5 high | 5.8% | 2009-08-19 |
| CVE-2008-0148 EXP | TUTOS 1.3 does not restrict access to php/admin/cmd.php, which allows remote attackers to execute arbitrary shell commands via the cmd parameter in a… | Patch early | 10.0 high | 5.8% | 2008-01-09 |
| CVE-2007-6057 EXP | PHP remote file inclusion vulnerability in index.php in datecomm Social Networking Script (aka Myspace Clone Script) allows remote attackers to execut… | Patch early | 6.8 medium | 5.8% | 2007-11-20 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt