CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
405,070 CVEs
1,739 on KEV
17,301 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-13
322,659 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2006-7127 EXP | Multiple PHP remote file inclusion vulnerabilities in JAF CMS 4.0 and 4.0 RC2 allow remote attackers to execute arbitrary PHP code via a URL in the ma… | Patch early | 6.8 medium | 5.7% | 2007-03-06 |
| CVE-2004-2449 EXP | Roger Wilco 1.4.1.6 and earlier or Roger Wilco Base Station 0.30a and earlier allows remote attackers to cause a denial of service (application crash)… | Patch early | 5.0 medium | 5.7% | 2004-12-31 |
| CVE-2006-2814 EXP | Multiple buffer overflows in the (1) vGetPost and (2) main functions in easy-scart.c through easy-scart6.c in iShopCart allow remote attackers to exec… | Patch early | 7.5 high | 5.7% | 2006-06-05 |
| CVE-2014-6047 EXP | phpMyFAQ before 2.8.13 allows remote authenticated users with certain permissions to read arbitrary attachments by leveraging incorrect "download an a… | Patch early | 5.3 medium | 5.7% | 2018-08-28 |
| CVE-2014-6048 EXP | phpMyFAQ before 2.8.13 allows remote attackers to read arbitrary attachments via a direct request. | Patch early | 5.3 medium | 5.7% | 2018-08-28 |
| CVE-2016-4997 EXP | The compat IPT_SO_SET_REPLACE and IP6T_SO_SET_REPLACE setsockopt implementations in the netfilter subsystem in the Linux kernel before 4.6.3 allow loc… | Patch early | 7.8 high | 5.7% | 2016-07-03 |
| CVE-2008-2304 EXP | Buffer overflow in Apple Core Image Fun House 2.0 and earlier in CoreImage Examples in Xcode tools before 3.1 allows user-assisted attackers to execut… | Patch early | 6.8 medium | 5.7% | 2008-07-14 |
| CVE-2001-0187 EXP | Format string vulnerability in wu-ftp 2.6.1 and earlier, when running with debug mode enabled, allows remote attackers to execute arbitrary commands v… | Patch early | 10.0 high | 5.7% | 2001-03-26 |
| CVE-2003-0153 EXP | bonsai Mozilla CVS query tool leaks the absolute pathname of the tool in certain error messages generated by (1) cvslog.cgi, (2) cvsview2.cgi, or (3)… | Patch early | 5.0 medium | 5.7% | 2003-04-02 |
| CVE-2002-0926 EXP | Directory traversal vulnerability in Wolfram Research webMathematica 1.0.0 and 1.0.0.1 allows remote attackers to read arbitrary files via a .. (dot d… | Patch early | 5.0 medium | 5.7% | 2002-10-04 |
| CVE-2013-3528 EXP | Unspecified vulnerability in the update check in Vanilla Forums before 2.0.18.8 has unspecified impact and remote attack vectors, related to "object i… | Patch early | 7.5 high | 5.7% | 2013-05-10 |
| CVE-2019-9213 EXP | In the Linux kernel before 4.20.14, expand_downwards in mm/mmap.c lacks a check for the mmap minimum address, which makes it easier for attackers to e… | Patch early | 5.5 medium | 5.7% | 2019-03-05 |
| CVE-2001-0830 EXP | 6tunnel 0.08 and earlier does not properly close sockets that were initiated by a client, which allows remote attackers to cause a denial of service (… | Patch early | 7.5 high | 5.7% | 2001-12-06 |
| CVE-2019-8924 EXP | XAMPP through 5.6.8 allows XSS via the cds-fpdf.php interpret or titel parameter. NOTE: This product is discontinued. | Patch early | 6.1 medium | 5.7% | 2019-05-17 |
| CVE-2002-1570 EXP | Heap-based buffer overflow in snmpnetstat for ucd-snmp 4.2.3 and earlier, and net-snmp, allows remote attackers to execute arbitrary code via multiple… | Patch early | 7.5 high | 5.7% | 2003-11-03 |
| CVE-2006-1794 EXP | SQL injection vulnerability in Mambo 4.5.3, 4.5.3h, and possibly earlier versions allows remote attackers to execute arbitrary SQL commands via (1) th… | Patch early | 7.6 high | 5.7% | 2006-04-17 |
| CVE-2007-6478 EXP | Stack-based buffer overflow in Rosoft Media Player 4.1.7, 4.1.8, and possibly earlier versions allows remote attackers to execute arbitrary code or ca… | Patch early | 6.8 medium | 5.7% | 2007-12-20 |
| CVE-2005-0409 EXP | CitrusDB 0.3.6 and earlier does not verify authorization for the (1) importcc.php and (2) uploadcc.php, which allows remote attackers to upload credit… | Patch early | 6.4 medium | 5.7% | 2005-02-14 |
| CVE-2018-17441 EXP | An issue was discovered on D-Link Central WiFi Manager before v 1.03r0100-Beta1. The 'username' parameter of the addUser endpoint is vulnerable to sto… | Patch early | 6.1 medium | 5.7% | 2018-10-08 |
| CVE-2018-17443 EXP | An issue was discovered on D-Link Central WiFi Manager before v 1.03r0100-Beta1. The 'sitename' parameter of the UpdateSite endpoint is vulnerable to… | Patch early | 6.1 medium | 5.7% | 2018-10-08 |
| CVE-2017-14085 EXP | Information disclosure vulnerabilities in Trend Micro OfficeScan 11.0 and XG may allow unauthenticated users who can access the OfficeScan server to q… | Patch early | 5.3 medium | 5.7% | 2017-10-06 |
| CVE-2008-4157 EXP | SQL injection vulnerability in groups.php in Vastal I-Tech phpVID 1.1 allows remote attackers to execute arbitrary SQL commands via the cat parameter,… | Patch early | 7.5 high | 5.6% | 2008-09-22 |
| CVE-2008-7168 EXP | Insecure method vulnerability in the UUSee UUUpgrade ActiveX control (UUUpgrade.ocx 3.0.2.12) allows remote attackers to force the download and overwr… | Patch early | 9.3 high | 5.6% | 2009-09-08 |
| CVE-2005-1370 EXP | Unknown vulnerability in Radia Management Agent (RMA) in HP OpenView Radia Management Portal (RMP) 1.x and 2.x allows remote attackers to execute arbi… | Patch early | 7.5 high | 5.6% | 2005-05-03 |
| CVE-2001-1188 EXP | mailto.exe in Brian Dorricott MAILTO 1.0.9 and earlier allows remote attackers to send SPAM e-mail through remote servers by modifying the sendto, ema… | Patch early | 7.5 high | 5.6% | 2001-12-11 |
| CVE-2014-3961 EXP | SQL injection vulnerability in the Export CSV page in the Participants Database plugin before 1.5.4.9 for WordPress allows remote attackers to execute… | Patch early | 7.5 high | 5.6% | 2014-06-04 |
| CVE-2009-2564 EXP | NOS Microsystems getPlus Download Manager, as used in Adobe Reader 1.6.2.36 and possibly other versions, Corel getPlus Download Manager before 1.5.0.4… | Patch early | 7.2 high | 5.6% | 2009-07-21 |
| CVE-2008-4437 EXP | Directory traversal vulnerability in importxml.pl in Bugzilla before 2.22.5, and 3.x before 3.0.5, when --attach_path is enabled, allows remote attack… | Patch early | 7.1 high | 5.6% | 2008-10-03 |
| CVE-2016-1825 EXP | IOHIDFamily in Apple OS X before 10.11.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corru… | Patch early | 7.8 high | 5.6% | 2016-05-20 |
| CVE-2017-2483 EXP | An issue was discovered in certain Apple products. iOS before 10.3 is affected. macOS before 10.12.4 is affected. tvOS before 10.2 is affected. watchO… | Patch early | 7.8 high | 5.6% | 2017-04-02 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt