CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
405,505 CVEs
1,740 on KEV
17,302 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-13
322,968 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2017-11319 EXP | Perspective ICM Investigation & Case 5.1.1.16 allows remote authenticated users to modify access level permissions and consequently gain privileges by… | Patch early | 8.8 high | 5.6% | 2017-12-11 |
| CVE-2009-2379 EXP | Directory traversal vulnerability in public/index.php in BIGACE Web CMS 2.6 allows remote attackers to include and execute arbitrary local files via a… | Patch early | 6.8 medium | 5.6% | 2009-07-08 |
| CVE-2000-0670 EXP | The cvsweb CGI script in CVSWeb 1.80 allows remote attackers with write access to a CVS repository to execute arbitrary commands via shell metacharact… | Patch early | 7.2 high | 5.6% | 2000-07-12 |
| CVE-2010-4399 EXP | Directory traversal vulnerability in languages.inc.php in DynPG CMS 4.1.1 and 4.2.0, when magic_quotes_gpc is disabled, allows remote attackers to rea… | Patch early | 4.3 medium | 5.6% | 2010-12-06 |
| CVE-2019-7400 EXP | Rukovoditel before 2.4.1 allows XSS. | Patch early | 6.1 medium | 5.6% | 2019-02-05 |
| CVE-2020-15716 EXP | RosarioSIS 6.7.2 is vulnerable to XSS, caused by improper validation of user-supplied input by the Preferences.php script. A remote attacker could exp… | Patch early | 6.1 medium | 5.6% | 2020-07-15 |
| CVE-2007-4725 EXP | Stack consumption vulnerability in AkkyWareHOUSE 7-zip32.dll before 4.42.00.04, as derived from Igor Pavlov 7-Zip before 4.53 beta, allows user-assist… | Patch early | 6.8 medium | 5.6% | 2007-09-05 |
| CVE-2009-0251 EXP | Static code injection vulnerability in admin.php in Ryneezy phoSheezy 0.2 allows remote authenticated administrators to inject arbitrary PHP code into… | Patch early | 6.5 medium | 5.6% | 2009-01-22 |
| CVE-2012-6307 EXP | A vulnerability exists in JPEGsnoop 1.5.2 due to an unspecified issue in JPEG file handling, which could let a malicious user execute arbitrary code | Patch early | 8.8 high | 5.6% | 2020-02-06 |
| CVE-2013-4034 EXP | IBM Cognos Business Intelligence 8.4.1 before IF3, 10.1.0 before IF4, 10.1.1 before IF4, 10.2.0 before IF4, 10.2.1 before IF2, and 10.2.1.1 before IF1… | Patch early | 4.0 medium | 5.6% | 2013-11-18 |
| CVE-2009-0175 EXP | Heap-based buffer overflow in Heathco Software MP3 TrackMaker 1.5 allows remote attackers to cause a denial of service (application crash) and possibl… | Patch early | 9.3 high | 5.6% | 2009-01-20 |
| CVE-2009-1351 EXP | Heap-based buffer overflow in Apollo 37zz allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code… | Patch early | 9.3 high | 5.6% | 2009-04-21 |
| CVE-2009-1352 EXP | Stack-based buffer overflow in Dawningsoft PowerCHM 5.7 allows remote attackers to cause a denial of service (application crash) and possibly execute… | Patch early | 9.3 high | 5.6% | 2009-04-21 |
| CVE-2009-1817 EXP | Multiple buffer overflows in DigiMode Maya 1.0.2 allow remote attackers to execute arbitrary code via a long string in a malformed (1) .m3u or (2) .m3… | Patch early | 9.3 high | 5.6% | 2009-05-29 |
| CVE-2008-4750 EXP | Stack-based buffer overflow in the VImpX.VImpAX ActiveX control (VImpX.ocx) 4.8.8.0 in DB Software Laboratory VImp X, possibly 4.7.7, allows remote at… | Patch early | 9.3 high | 5.6% | 2008-10-27 |
| CVE-2008-3430 EXP | Buffer overflow in the CoVideoWindow.ocx ActiveX control 5.0.907.1 in Eyeball MessengerSDK, as used in products such as SiOL Komunikator 1.3, allows r… | Patch early | 9.3 high | 5.6% | 2008-07-31 |
| CVE-2010-4230 EXP | Stack-based buffer overflow in a certain ActiveX control for the Camtron CMNC-200 Full HD IP Camera and TecVoz CMNC-200 Megapixel IP Camera with firmw… | Patch early | 9.3 high | 5.6% | 2010-11-17 |
| CVE-2009-4758 EXP | Stack-based buffer overflow in dicas Mpegable Player 2.12 allows remote attackers to cause a denial of service (application crash) or possibly execute… | Patch early | 9.3 high | 5.6% | 2010-03-29 |
| CVE-2007-6654 EXP | Buffer overflow in a certain ActiveX control in Macrovision InstallShield Update Service Web Agent 5.1.100.47363 allows remote attackers to execute ar… | Patch early | 9.3 high | 5.6% | 2008-01-04 |
| CVE-2008-3116 EXP | Format string vulnerability in dx8render.dll in Snail Game (aka Suzhou Snail Electronic Company) 5th street (aka Hot Step or High Street 5) allows rem… | Patch early | 10.0 high | 5.6% | 2008-07-10 |
| CVE-2008-0491 EXP | SQL injection vulnerability in fim_rss.php in the fGallery 2.4.1 plugin for WordPress allows remote attackers to execute arbitrary SQL commands via th… | Patch early | 7.5 high | 5.5% | 2008-01-30 |
| CVE-2000-0057 EXP | Cold Fusion CFCACHE tag places temporary cache files within the web document root, allowing remote attackers to obtain sensitive system information. | Patch early | 7.5 high | 5.5% | 2000-01-04 |
| CVE-2000-0125 EXP | wwwthreads does not properly cleanse numeric data or table names that are passed to SQL queries, which allows remote attackers to gain privileges for… | Patch early | 7.5 high | 5.5% | 2000-02-03 |
| CVE-2000-0916 EXP | FreeBSD 4.1.1 and earlier, and possibly other BSD-based OSes, uses an insufficient random number generator to generate initial TCP sequence numbers (I… | Patch early | 7.5 high | 5.5% | 2000-12-19 |
| CVE-2005-2041 EXP | Buffer overflow in addschup in HAURI ViRobot 2.0, and possibly other products, allows remote attackers to execute arbitrary code via a long ViRobot_ID… | Patch early | 5.0 medium | 5.5% | 2005-06-15 |
| CVE-2014-5094 EXP | Status2k allows remote attackers to obtain configuration information via a phpinfo action in a request to status/index.php, which calls the phpinfo fu… | Patch early | 5.0 medium | 5.5% | 2014-10-20 |
| CVE-2017-0167 EXP | An information disclosure vulnerability exists in Windows 8.1, Windows RT 8.1, Windows Server 2012 R2, Windows 10, and Windows Server 2016 when the Wi… | Patch early | 5.5 medium | 5.5% | 2017-04-12 |
| CVE-2007-6648 EXP | Directory traversal vulnerability in index.php in SanyBee Gallery 0.1.0 and 0.1.1 allows remote attackers to include and execute arbitrary local files… | Patch early | 5.0 medium | 5.5% | 2008-01-04 |
| CVE-2009-0811 EXP | Insecure method vulnerability in the SopCast SopCore ActiveX control in sopocx.ocx 3.0.3.501 allows remote attackers to execute arbitrary programs via… | Patch early | 9.3 high | 5.5% | 2009-03-04 |
| CVE-2009-0865 EXP | Directory traversal vulnerability in the SnapShotToFile method in the GeoVision LiveX (aka LiveX_v8200) ActiveX control 8.1.2 and 8.2.0 in LIVEX_~1.OC… | Patch early | 8.8 high | 5.5% | 2009-03-10 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt