CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
404,941 CVEs
1,739 on KEV
17,301 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-12
322,537 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2007-0059 EXP | Cross-zone scripting vulnerability in Apple Quicktime 3 to 7.1.3 allows remote user-assisted attackers to execute arbitrary code and list filesystem c… | Patch early | 6.8 medium | 5.7% | 2007-01-05 |
| CVE-2008-4508 EXP | Stack-based buffer overflow in the file parsing function in Tonec Internet Download Manager, possibly 5.14 and earlier, allows remote attackers to cau… | Patch early | 7.8 high | 5.7% | 2008-10-09 |
| CVE-2021-24245 EXP | The Stop Spammers WordPress plugin before 2021.9 did not escape user input when blocking requests (such as matching a spam word), outputting it in an… | Patch early | 6.1 medium | 5.7% | 2021-05-06 |
| CVE-2009-3573 EXP | Multiple insecure method vulnerabilities in the PDIControl.PDI.1 ActiveX control (PDIControl.dll) 2.2.3160.0 in EMC Captiva PixTools Distributed Imagi… | Patch early | 9.3 high | 5.7% | 2009-10-06 |
| CVE-2023-33131 EXP | Microsoft Outlook Remote Code Execution Vulnerability | Patch early | 8.8 high | 5.7% | 2023-06-14 |
| CVE-2008-1702 EXP | Absolute path traversal vulnerability in dload.php in the my_gallery 2.3 plugin for e107 allows remote attackers to obtain sensitive information via a… | Patch early | 4.3 medium | 5.7% | 2008-04-08 |
| CVE-2011-4684 EXP | Opera before 11.60 does not properly handle certificate revocation, which has unspecified impact and remote attack vectors related to "corner cases." | Patch early | 10.0 high | 5.7% | 2011-12-07 |
| CVE-2000-1176 EXP | Directory traversal vulnerability in YaBB search.pl CGI script allows remote attackers to read arbitrary files via a .. (dot dot) attack in the "catse… | Patch early | 7.5 high | 5.7% | 2001-01-09 |
| CVE-2020-12352 EXP | Improper access control in BlueZ may allow an unauthenticated user to potentially enable information disclosure via adjacent access. | Patch early | 6.5 medium | 5.7% | 2020-11-23 |
| CVE-2007-4031 EXP | Directory traversal vulnerability in a certain ActiveX control in Nessus Vulnerability Scanner 3.0.6 allows remote attackers to delete arbitrary files… | Patch early | 7.8 high | 5.7% | 2007-07-27 |
| CVE-2014-1854 EXP | SQL injection vulnerability in library/clicktracker.php in the AdRotate Pro plugin 3.9 through 3.9.5 and AdRotate Free plugin 3.9 through 3.9.4 for Wo… | Patch early | 7.5 high | 5.7% | 2014-02-27 |
| CVE-2016-8366 EXP | Webvisit in Phoenix Contact ILC PLCs offers a password macro to protect HMI pages on the PLC against casual or coincidental opening of HMI pages by th… | Patch early | 7.3 high | 5.7% | 2018-04-05 |
| CVE-2000-1100 EXP | The default configuration for PostACI webmail system installs the /includes/global.inc configuration file within the web root, which allows remote att… | Patch early | 7.5 high | 5.7% | 2001-01-09 |
| CVE-2008-3296 EXP | Directory traversal vulnerability in modules/system/admin.php in XOOPS 2.0.18 1 allows remote attackers to include and execute arbitrary local files v… | Patch early | 7.5 high | 5.7% | 2008-07-25 |
| CVE-2006-5418 EXP | PHP remote file inclusion vulnerability in archive/archive_topic.php in pbpbb archive for search engines (SearchIndexer) (aka phpBBSEI) for phpBB allo… | Patch early | 6.8 medium | 5.7% | 2006-10-20 |
| CVE-2010-4647 EXP | Multiple cross-site scripting (XSS) vulnerabilities in the Help Contents web application (aka the Help Server) in Eclipse IDE before 3.6.2 allow remot… | Patch early | 4.3 medium | 5.7% | 2011-01-13 |
| CVE-2011-0502 EXP | Music Animation Machine MIDI Player 2006aug19 Release 035 and possibly other versions allows user-assisted remote attackers to cause a denial of servi… | Patch early | 9.3 high | 5.7% | 2011-01-20 |
| CVE-2001-0491 EXP | Directory traversal vulnerability in RaidenFTPD Server 2.1 before build 952 allows attackers to access files outside the ftp root via dot dot attacks,… | Patch early | 5.0 medium | 5.7% | 2001-06-27 |
| CVE-2007-3845 EXP | Mozilla Firefox before 2.0.0.6, Thunderbird before 1.5.0.13 and 2.x before 2.0.0.6, and SeaMonkey before 1.1.4 allow remote attackers to execute arbit… | Patch early | 9.3 high | 5.7% | 2007-08-08 |
| CVE-2008-0239 EXP | Multiple cross-site scripting (XSS) vulnerabilities in Sun Java System Identity Manager 6.0 SP1 through SP3, 7.0, and 7.1 allow remote attackers to in… | Patch early | 4.3 medium | 5.7% | 2008-01-11 |
| CVE-2006-4074 EXP | PHP remote file inclusion vulnerability in lib/tpl/default/main.php in the JD-Wiki Component (com_jd-wiki) 1.0.2 and earlier for Joomla!, when registe… | Patch early | 6.8 medium | 5.7% | 2006-08-11 |
| CVE-2009-2112 EXP | Directory traversal vulnerability in include/page_bottom.php in phpFK 7.03 allows remote attackers to include and execute arbitrary local files via di… | Patch early | 7.5 high | 5.7% | 2009-06-18 |
| CVE-2009-2183 EXP | Directory traversal vulnerability in admin-files/ad.php in Campsite 3.3.0 RC1 allows remote attackers to read and possibly execute arbitrary local fil… | Patch early | 7.5 high | 5.7% | 2009-06-23 |
| CVE-2007-6558 EXP | TotalPlayer 3.0 allows user-assisted remote attackers to cause a denial of service (application crash) via a large .m3u file. NOTE: this might be a d… | Patch early | 4.3 medium | 5.7% | 2007-12-28 |
| CVE-2008-1353 EXP | zabbix_agentd in ZABBIX 1.4.4 allows remote attackers to cause a denial of service (CPU and connection consumption) via multiple vfs.file.cksum comman… | Patch early | 4.3 medium | 5.7% | 2008-03-17 |
| CVE-2006-0663 EXP | Multiple cross-site scripting (XSS) vulnerabilities in Lotus Domino iNotes Client 6.5.4 and 7.0 allow remote attackers to inject arbitrary web script… | Patch early | 4.3 medium | 5.7% | 2006-02-13 |
| CVE-2014-0871 EXP | RICOS in IBM Algo Credit Limits (aka ACLM) 4.5.0 through 4.7.0 before 4.7.0.03 FP5 in IBM Algorithmics allows remote attackers to obtain potentially s… | Patch early | 4.3 medium | 5.7% | 2014-07-07 |
| CVE-2022-37706 EXP | enlightenment_sys in Enlightenment before 0.25.4 allows local users to gain privileges because it is setuid root, and the system library function mish… | Patch early | 7.8 high | 5.7% | 2022-12-25 |
| CVE-2005-3489 EXP | Buffer overflow in Asus Video Security 3.5.0.0 and earlier, when using authorization, allows remote attackers to execute arbitrary code via a long use… | Patch early | 7.5 high | 5.7% | 2005-11-04 |
| CVE-2010-2920 EXP | Directory traversal vulnerability in the Foobla Suggestions (com_foobla_suggestions) component 1.5.1.2 for Joomla! allows remote attackers to read arb… | Patch early | 6.8 medium | 5.7% | 2010-07-30 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt