CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
404,852 CVEs
1,739 on KEV
17,301 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-12
322,465 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2007-5309 EXP | PHP remote file inclusion vulnerability in admin.wmtgallery.php in the webmaster-tips.net Flash Image Gallery (com_wmtgallery) 1.0 component for Jooml… | Patch early | 6.8 medium | 5.8% | 2007-10-09 |
| CVE-2015-2292 EXP | Multiple SQL injection vulnerabilities in admin/class-bulk-editor-list-table.php in the WordPress SEO by Yoast plugin before 1.5.7, 1.6.x before 1.6.4… | Patch early | 6.5 medium | 5.8% | 2015-03-17 |
| CVE-2008-4321 EXP | Buffer overflow in FlashGet (formerly JetCar) FTP 1.9 allows remote FTP servers to execute arbitrary code via a long response to the PWD command. | Patch early | 9.3 high | 5.8% | 2008-09-29 |
| CVE-2014-4311 EXP | Epicor Enterprise 7.4 before FS74SP6_HotfixTL054181 allows attackers to obtain the (1) Database Connection and (2) E-mail Connection passwords by read… | Patch early | 5.0 medium | 5.8% | 2014-11-04 |
| CVE-2008-6982 EXP | Cross-site scripting (XSS) vulnerability in index.php in devalcms 1.4a allows remote attackers to inject arbitrary web script or HTML via the currentp… | Patch early | 4.3 medium | 5.8% | 2009-08-19 |
| CVE-2009-2820 EXP | The web interface in CUPS before 1.4.2, as used on Apple Mac OS X before 10.6.2 and other platforms, does not properly handle (1) HTTP headers and (2)… | Patch early | 4.3 medium | 5.8% | 2009-11-10 |
| CVE-2007-1622 EXP | Cross-site scripting (XSS) vulnerability in wp-admin/vars.php in WordPress before 2.0.10 RC2, and before 2.1.3 RC2 in the 2.1 series, allows remote au… | Patch early | 4.3 medium | 5.8% | 2007-03-23 |
| CVE-2003-1142 EXP | Help in NIPrint LPD-LPR Print Server 4.10 and earlier executes Windows Explorer with SYSTEM privileges, which allows local users to gain privileges. | Patch early | 10.0 high | 5.8% | 2003-11-03 |
| CVE-2008-3234 EXP | sshd in OpenSSH 4 on Debian GNU/Linux, and the 20070303 OpenSSH snapshot, allows remote authenticated users to obtain access to arbitrary SELinux role… | Patch early | 6.5 medium | 5.8% | 2008-07-18 |
| CVE-2016-1828 EXP | The kernel in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1 allows attackers to execute arbitrary code in a… | Patch early | 7.8 high | 5.8% | 2016-05-20 |
| CVE-2008-6958 EXP | wap/index.php in Crossday Discuz! Board 6.x and 7.x allows remote authenticated users to execute arbitrary PHP code via the creditsformula parameter. | Patch early | 6.5 medium | 5.8% | 2009-08-12 |
| CVE-2013-7280 EXP | Buffer overflow in HansoTools Hanso Player 2.1.0, 2.5.0, and earlier allows remote attackers to cause a denial of service (crash) via a long string in… | Patch early | 4.3 medium | 5.8% | 2014-01-08 |
| CVE-2004-1745 EXP | Buffer overflow in Painkiller 1.3.1 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a… | Patch early | 5.0 medium | 5.8% | 2004-08-24 |
| CVE-2021-28142 EXP | CITSmart before 9.1.2.28 mishandles the "filtro de autocomplete." | Patch early | 8.8 high | 5.8% | 2021-04-06 |
| CVE-1999-0887 EXP | FTGate web interface server allows remote attackers to read files via a .. (dot dot) attack. | Patch early | 5.0 medium | 5.8% | 1999-11-04 |
| CVE-1999-0927 EXP | NTMail allows remote attackers to read arbitrary files via a .. (dot dot) attack. | Patch early | 5.0 medium | 5.8% | 1999-05-26 |
| CVE-1999-0933 EXP | TeamTrack web server allows remote attackers to read arbitrary files via a .. (dot dot) attack. | Patch early | 5.0 medium | 5.8% | 1999-10-01 |
| CVE-2017-2371 EXP | An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. The issue involves the "WebKit" component, which allows remote attac… | Patch early | 6.5 medium | 5.8% | 2017-02-20 |
| CVE-2006-4198 EXP | PHP remote file inclusion vulnerability in includes/session.php in Wheatblog (wB) 1.1 and earlier, when register_globals is enabled, allows remote att… | Patch early | 5.1 medium | 5.8% | 2006-08-17 |
| CVE-2017-17738 EXP | The BrightSign Digital Signage (4k242) device (Firmware 6.2.63 and below) allows renaming and modifying files via /tools.html. | Patch early | 7.5 high | 5.8% | 2017-12-18 |
| CVE-2004-0527 EXP | KDE Konqueror 2.1.1 and 2.2.2 allows remote attackers to spoof a legitimate URL in the status bar via A HREF tags with modified "alt" values that poin… | Patch early | 5.0 medium | 5.8% | 2004-08-06 |
| CVE-2002-1351 EXP | Buffer overflow in Melange Chat System 1.10 allows remote attackers to cause a denial of service (chat server crash) and possibly execute arbitrary co… | Patch early | 5.0 medium | 5.8% | 2002-12-24 |
| CVE-2007-5487 EXP | Stack-based buffer overflow in COWON America jetAudio Basic 7.0.3 allows user-assisted remote attackers to execute arbitrary code via a long URL in an… | Patch early | 9.3 high | 5.8% | 2007-10-16 |
| CVE-2007-2062 EXP | Stack-based buffer overflow in VCDGear 3.55 and 3.56 BETA allows user-assisted remote attackers to execute arbitrary code via a long FILE argument in… | Patch early | 9.3 high | 5.8% | 2007-04-18 |
| CVE-2008-7079 EXP | Buffer overflow in Nero ShowTime 5.0.15.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long… | Patch early | 9.3 high | 5.8% | 2009-08-25 |
| CVE-2009-3811 EXP | Stack-based buffer overflow in Music Tag Editor 1.61 build 212 allows remote attackers to execute arbitrary code via an MP3 file with a long ID3 tag.… | Patch early | 9.3 high | 5.8% | 2009-10-27 |
| CVE-2009-4097 EXP | Stack-based buffer overflow in the MplayInputFile function in Serenity Audio Player 3.2.3 and earlier allows remote attackers to execute arbitrary cod… | Patch early | 9.3 high | 5.8% | 2009-11-29 |
| CVE-2009-4863 EXP | Stack-based buffer overflow in UltraPlayer Media Player 2.112 allows remote attackers to execute arbitrary code via a long string in a .usk file. | Patch early | 9.3 high | 5.8% | 2010-05-11 |
| CVE-2009-1040 EXP | Buffer overflow in WinAsm Studio 5.1.5.0 allows user-assisted remote attackers to execute arbitrary code via a crafted project (.wap) file. | Patch early | 9.3 high | 5.8% | 2009-03-20 |
| CVE-2008-1973 EXP | Heap-based buffer overflow in SubEdit Player build 4056 and 4066 allows remote attackers to cause a denial of service (crash) or execute arbitrary cod… | Patch early | 9.3 high | 5.8% | 2008-04-27 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt