CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
407,162 CVEs
1,740 on KEV
17,302 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-13
324,524 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2006-0841 EXP | Multiple cross-site scripting (XSS) vulnerabilities in Mantis 1.00rc4 and earlier allow remote attackers to inject arbitrary web script or HTML via th… | Patch early | 4.3 medium | 5.5% | 2006-02-22 |
| CVE-2014-1564 EXP | Mozilla Firefox before 32.0, Firefox ESR 31.x before 31.1, and Thunderbird 31.x before 31.1 do not properly initialize memory for GIF rendering, which… | Patch early | 4.3 medium | 5.5% | 2014-09-03 |
| CVE-2002-1930 EXP | Buffer overflow in AN HTTPd 1.38 through 1.4.1c allows remote attackers to execute arbitrary code via a SOCKS4 request with a long username. | Patch early | 7.5 high | 5.5% | 2002-12-31 |
| CVE-2011-4802 EXP | Multiple SQL injection vulnerabilities in Dolibarr 3.1.0 RC and probably earlier allow remote authenticated users to execute arbitrary SQL commands vi… | Patch early | 6.5 medium | 5.5% | 2011-12-14 |
| CVE-2010-5280 EXP | Directory traversal vulnerability in the Community Builder Enhanced (CBE) (com_cbe) component 1.4.8, 1.4.9, and 1.4.10 for Joomla! allows remote attac… | Patch early | 7.5 high | 5.5% | 2012-11-26 |
| CVE-2007-1552 EXP | Unrestricted file upload vulnerability in usercp.php in MetaForum 0.513 Beta restricts file types based on the MIME type in the Content-type HTTP head… | Patch early | 7.5 high | 5.5% | 2007-03-20 |
| CVE-2017-15221 EXP | ASX to MP3 converter 3.1.3.7.2010.11.05 has a buffer overflow via a crafted M3U file, a related issue to CVE-2009-1324. | Patch early | 7.8 high | 5.5% | 2017-10-16 |
| CVE-2013-4949 EXP | Unrestricted file upload vulnerability in view.php in Machform 2 allows remote attackers to execute arbitrary PHP code by uploading a PHP file, then a… | Patch early | 6.8 medium | 5.5% | 2013-07-29 |
| CVE-2013-5961 EXP | Unrestricted file upload vulnerability in lazyseo.php in the Lazy SEO plugin 1.1.9 for WordPress allows remote attackers to execute arbitrary PHP code… | Patch early | 6.8 medium | 5.5% | 2013-09-30 |
| CVE-2005-2246 EXP | Multiple PHP remote file inclusion vulnerabilities in iPhotoAlbum 1.1 allow remote attackers to execute arbitrary code via the (1) doc_path parameter… | Patch early | 7.5 high | 5.5% | 2005-07-12 |
| CVE-2007-1452 EXP | The FDF support (ext/fdf) in PHP 5.2.0 and earlier does not implement the input filtering hooks for ext/filter, which allows remote attackers to bypas… | Patch early | 5.0 medium | 5.5% | 2007-03-14 |
| CVE-2002-1089 EXP | rwcgi60 CGI program in Oracle Reports Server, by design, provides sensitive information such as the full pathname, which could enable remote attackers… | Patch early | 5.0 medium | 5.4% | 2002-10-04 |
| CVE-2008-3821 EXP | Multiple cross-site scripting (XSS) vulnerabilities in the HTTP server in Cisco IOS 11.0 through 12.4 allow remote attackers to inject arbitrary web s… | Patch early | 4.3 medium | 5.4% | 2009-01-16 |
| CVE-2009-3364 EXP | Stack-based buffer overflow in FTPShell Client 4.1 RC2 allows remote FTP servers to execute arbitrary code via a long response to a PASV command. | Patch early | 9.3 high | 5.4% | 2009-09-24 |
| CVE-2007-3844 EXP | Mozilla Firefox 2.0.0.5, Thunderbird 2.0.0.5 and before 1.5.0.13, and SeaMonkey 1.1.3 allows remote attackers to conduct cross-site scripting (XSS) at… | Patch early | 4.3 medium | 5.4% | 2007-08-08 |
| CVE-2001-0024 EXP | simplestmail.cgi CGI program by Leif Wright allows remote attackers to execute arbitrary commands via shell metacharacters in the MyEmail parameter. | Patch early | 10.0 high | 5.4% | 2001-02-12 |
| CVE-2003-0514 EXP | Apple Safari allows remote attackers to bypass intended cookie access restrictions on a web application via "%2e%2e" (encoded dot dot) directory trave… | Patch early | 7.5 high | 5.4% | 2004-04-15 |
| CVE-2011-2641 EXP | Opera 11.11 allows remote attackers to cause a denial of service (application crash) by setting the FACE attribute of a FONT element within an IFRAME… | Patch early | 5.0 medium | 5.4% | 2011-07-01 |
| CVE-2001-1078 EXP | Format string vulnerability in flog function of eXtremail 1.1.9 and earlier allows remote attackers to gain root privileges via format specifiers in t… | Patch early | 10.0 high | 5.4% | 2001-06-21 |
| CVE-2007-1511 EXP | Buffer overflow in FrontBase Relational Database Server 4.2.7 and earlier allows remote authenticated users, with privileges for creating a stored pro… | Patch early | 7.1 high | 5.4% | 2007-03-20 |
| CVE-2014-8357 EXP | backupsettings.html in the web administrative portal in Zhone zNID GPON 2426A before S3.0.501 places a session key in a URL, which allows remote attac… | Patch early | 8.8 high | 5.4% | 2017-10-17 |
| CVE-2002-1868 EXP | Dispair 0.1 and 0.2 allows remote attackers to execute arbitrary shell commands via certain form fields. | Patch early | 10.0 high | 5.4% | 2002-12-31 |
| CVE-2003-1138 EXP | The default configuration of Apache 2.0.40, as shipped with Red Hat Linux 9.0, allows remote attackers to list directory contents, even if auto indexi… | Patch early | 5.0 medium | 5.4% | 2003-10-27 |
| CVE-2007-6321 EXP | Cross-site scripting (XSS) vulnerability in RoundCube webmail 0.1rc2, 2007-12-09, and earlier versions, when using Internet Explorer, allows remote at… | Patch early | 4.3 medium | 5.4% | 2007-12-12 |
| CVE-2005-0338 EXP | Buffer overflow in Savant Web Server 3.1 allows remote attackers to execute arbitrary code via a long HTTP request. | Patch early | 7.5 high | 5.4% | 2005-05-02 |
| CVE-2007-5914 EXP | Direct static code injection vulnerability in dirsys/modules/config/post.php in JBC Explorer 7.20 RC1 and earlier allows remote authenticated administ… | Patch early | 6.8 medium | 5.4% | 2007-11-10 |
| CVE-2021-24610 EXP | The TranslatePress WordPress plugin before 2.0.9 does not implement a proper sanitisation on the translated strings. The 'trp_sanitize_string' functio… | Patch early | 4.8 medium | 5.4% | 2021-09-27 |
| CVE-2001-1274 EXP | Buffer overflow in MySQL before 3.23.31 allows attackers to cause a denial of service and possibly gain privileges. | Patch early | 7.5 high | 5.4% | 2001-01-23 |
| CVE-2015-1059 EXP | Unrestricted file upload vulnerability in admin/files/add in AdaptCMS 3.0.3 allows remote authenticated users to execute arbitrary PHP code by uploadi… | Patch early | 6.5 medium | 5.4% | 2015-01-16 |
| CVE-2007-0117 EXP | DiskManagementTool in the DiskManagement.framework 92.29 on Mac OS X 10.4.8 does not properly validate Bill of Materials (BOM) files, which allows att… | Patch early | 10.0 high | 5.4% | 2007-01-09 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt