CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
405,610 CVEs
1,740 on KEV
17,302 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-13
323,066 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2015-7249 EXP | ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_PE allow remote authenticated users to bypass intended access restrictions via a modified req… | Patch early | 4.9 medium | 5.5% | 2015-12-30 |
| CVE-2007-1974 EXP | SQL injection vulnerability in the getArticle function in class/wfsarticle.php in WF-Section (aka WF-Sections) 1.0.1, as used in Xoops modules such as… | Patch early | 7.5 high | 5.5% | 2007-04-12 |
| CVE-2018-10260 EXP | A Local File Inclusion vulnerability was found in HRSALE The Ultimate HRM v1.0.2, exploitable by a low privileged user. | Patch early | 8.8 high | 5.5% | 2018-05-01 |
| CVE-2007-4010 EXP | The win32std extension in PHP 5.2.3 does not follow safe_mode and disable_functions restrictions, which allows remote attackers to execute arbitrary c… | Patch early | 6.8 medium | 5.5% | 2007-07-26 |
| CVE-2017-15235 EXP | The File Manager (gollem) module 3.0.11 in Horde Groupware 5.2.21 allows remote attackers to bypass Horde authentication for file downloads via a craf… | Patch early | 7.5 high | 5.5% | 2017-10-11 |
| CVE-2008-0952 EXP | The AppendStringToFile function in the HPISDataManagerLib.Datamgr ActiveX control in HPISDataManager.dll in HP Instant Support before 1.0.0.24 allows… | Patch early | 9.3 high | 5.5% | 2008-06-04 |
| CVE-2005-3135 EXP | Buffer overflow in Virtools Web Player 3.0.0.100 and earlier allows remote attackers to execute arbitrary code via a long filename. | Patch early | 7.5 high | 5.5% | 2005-10-04 |
| CVE-2006-5301 EXP | PHP remote file inclusion vulnerability in includes/antispam.php in the SpamBlockerMODv 1.0.2 and earlier module for phpBB allows remote attackers to… | Patch early | 6.8 medium | 5.5% | 2006-10-17 |
| CVE-2007-1263 EXP | GnuPG 1.4.6 and earlier and GPGME before 1.1.4, when run from the command line, does not visually distinguish signed and unsigned portions of OpenPGP… | Patch early | 5.0 medium | 5.5% | 2007-03-06 |
| CVE-2011-4814 EXP | Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr 3.1.0 RC and probably earlier allow remote attackers to inject arbitrary web script or… | Patch early | 4.3 medium | 5.5% | 2011-12-14 |
| CVE-2003-0274 EXP | Buffer overflow in catmail for ListProc 8.2.09 and earlier allows remote attackers to execute arbitrary code via a long ULISTPROC_UMASK value. | Patch early | 10.0 high | 5.5% | 2003-05-27 |
| CVE-2002-0770 EXP | Quake 2 (Q2) server 3.20 and 3.21 allows remote attackers to obtain sensitive server cvar variables, obtain directory listings, and execute Q2 server… | Patch early | 5.0 medium | 5.5% | 2002-08-12 |
| CVE-2007-5821 EXP | Multiple directory traversal vulnerabilities in DM Guestbook 0.4.1 and earlier allow remote attackers to include and execute arbitrary local files via… | Patch early | 6.8 medium | 5.5% | 2007-11-05 |
| CVE-2023-30198 EXP | Prestashop winbizpayment <= 1.0.2 is vulnerable to Incorrect Access Control via modules/winbizpayment/downloads/download.php. | Patch early | 7.5 high | 5.5% | 2023-06-12 |
| CVE-2004-1728 EXP | Buffer overflow in British National Corpus SARA (sarad) allows remote attackers to execute arbitrary code by calling the client with a long string. | Patch early | 7.5 high | 5.5% | 2004-08-20 |
| CVE-1999-0441 EXP | Remote attackers can perform a denial of service in WinGate machines using a buffer overflow in the Winsock Redirector Service. | Patch early | 5.0 medium | 5.5% | 1999-02-22 |
| CVE-1999-1113 EXP | Buffer overflow in Eudora Internet Mail Server (EIMS) 2.01 and earlier on MacOS systems allows remote attackers to cause a denial of service via a lon… | Patch early | 5.0 medium | 5.5% | 1998-04-14 |
| CVE-2008-7162 EXP | Buffer overflow in Hero Super Player 3000 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long… | Patch early | 9.3 high | 5.5% | 2009-09-04 |
| CVE-2008-4932 EXP | webmail/modules/filesystem/edit.php in U-Mail Webmail server 4.91 allows remote attackers to overwrite arbitrary files via an absolute pathname in the… | Patch early | 9.0 high | 5.5% | 2008-11-05 |
| CVE-2020-5191 EXP | PHPGurukul Hospital Management System in PHP v4.0 suffers from multiple Persistent XSS vulnerabilities. | Patch early | 6.1 medium | 5.5% | 2020-01-06 |
| CVE-2012-5991 EXP | screens/base/web_auth_custom.html on Cisco Wireless LAN Controller (WLC) devices with software 7.2.110.0 allows remote authenticated users to cause a… | Patch early | 6.3 medium | 5.5% | 2012-12-19 |
| CVE-2010-3007 EXP | Unspecified vulnerability in HP Data Protector Express, and Data Protector Express Single Server Edition (SSE), 3.x before build 56936 and 4.x before… | Patch early | 7.2 high | 5.5% | 2010-09-09 |
| CVE-2011-4614 EXP | PHP remote file inclusion vulnerability in Classes/Controller/AbstractController.php in the workspaces system extension in TYPO3 4.5.x before 4.5.9, 4… | Patch early | 6.8 medium | 5.5% | 2012-02-18 |
| CVE-2002-1428 EXP | index.php in dotProject 0.2.1.5 allows remote attackers to bypass authentication via a cookie or URL with the user_cookie parameter set to 1. | Patch early | 10.0 high | 5.5% | 2003-04-11 |
| CVE-2017-11663 EXP | The _WM_SetupMidiEvent function in internal_midi.c:2315 in WildMIDI 0.4.2 can cause a denial of service (invalid memory read and application crash) vi… | Patch early | 6.5 medium | 5.5% | 2017-08-17 |
| CVE-2017-15950 EXP | Flexense SyncBreeze Enterprise version 10.1.16 is vulnerable to a buffer overflow that can be exploited for arbitrary code execution. The flaw is trig… | Patch early | 7.8 high | 5.5% | 2017-10-31 |
| CVE-2020-16171 EXP | An issue was discovered in Acronis Cyber Backup before 12.5 Build 16342. Some API endpoints on port 9877 under /api/ams/ accept an additional custom S… | Patch early | 6.5 medium | 5.5% | 2020-09-21 |
| CVE-2015-2841 EXP | Citrix NetScaler AppFirewall, as used in NetScaler 10.5, allows remote attackers to bypass intended firewall restrictions via a crafted Content-Type h… | Patch early | 5.0 medium | 5.5% | 2015-04-03 |
| CVE-2010-4401 EXP | languages.inc.php in DynPG CMS 4.2.0 allows remote attackers to obtain sensitive information via a direct request, which reveals the installation path… | Patch early | 5.0 medium | 5.5% | 2010-12-06 |
| CVE-2017-14083 EXP | A vulnerability in Trend Micro OfficeScan 11.0 and XG allows remote unauthenticated users who can access the system to download the OfficeScan encrypt… | Patch early | 7.5 high | 5.5% | 2017-10-06 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt