CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
407,357 CVEs
1,740 on KEV
17,302 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-13
324,662 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2007-4381 EXP | Unspecified vulnerability in the font parsing implementation in Sun JDK and JRE 5.0 Update 9 and earlier, and SDK and JRE 1.4.2_14 and earlier, allows… | Patch early | 9.3 high | 5.4% | 2007-08-17 |
| CVE-2019-6213 EXP | A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 12.1.3, macOS Mojave 10.14.3, tvOS 12.1.2, watchOS 5.1.3. An… | Patch early | 7.8 high | 5.4% | 2019-03-05 |
| CVE-2016-7626 EXP | An issue was discovered in certain Apple products. iOS before 10.2 is affected. tvOS before 10.1 is affected. watchOS before 3.1.1 is affected. The is… | Patch early | 8.8 high | 5.4% | 2017-02-20 |
| CVE-2014-8391 EXP | The Web interface in Sendio before 7.2.4 does not properly handle sessions, which allows remote authenticated users to obtain sensitive information fr… | Patch early | 4.0 medium | 5.4% | 2015-06-02 |
| CVE-2008-5705 EXP | The cTrigger::DoIt function in src/ctrigger.cpp in the trigger mechanism in the daemon in Verlihub 0.9.8d-RC2 and earlier, when user triggers are enab… | Patch early | 9.3 high | 5.4% | 2008-12-22 |
| CVE-2000-0985 EXP | Buffer overflow in All-Mail 1.1 allows remote attackers to execute arbitrary commands via a long "MAIL FROM" or "RCPT TO" command. | Patch early | 10.0 high | 5.4% | 2000-12-19 |
| CVE-2013-1852 EXP | SQL injection vulnerability in leaguemanager.php in the LeagueManager plugin before 3.8.1 for WordPress allows remote attackers to execute arbitrary S… | Patch early | 7.5 high | 5.4% | 2014-02-05 |
| CVE-2012-0200 EXP | The server in IBM solidDB 6.5 before Interim Fix 6 does not properly initialize data structures, which allows remote authenticated users to cause a de… | Patch early | 4.0 medium | 5.4% | 2012-02-21 |
| CVE-2017-4915 EXP | VMware Workstation Pro/Player contains an insecure library loading vulnerability via ALSA sound driver configuration files. Successful exploitation of… | Patch early | 7.8 high | 5.4% | 2017-05-22 |
| CVE-2007-2895 EXP | Buffer overflow in a certain ActiveX control in LTRDF14e.DLL 14.5.0.44 in LeadTools Raster Dialog File Object allows remote attackers to execute arbit… | Patch early | 7.5 high | 5.4% | 2007-05-30 |
| CVE-2008-4452 EXP | Buffer overflow in Cambridge Computer Corporation vxFtpSrv 2.0.3 allows remote attackers to cause a denial of service (crash and hang) and possibly ex… | Patch early | 9.0 high | 5.4% | 2008-10-06 |
| CVE-2001-0288 EXP | Cisco switches and routers running IOS 12.1 and earlier produce predictable TCP Initial Sequence Numbers (ISNs), which allows remote attackers to spoo… | Patch early | 7.5 high | 5.4% | 2001-05-03 |
| CVE-2002-0328 EXP | Cross-site scripting vulnerability in Ikonboard 3.0.1 allows remote attackers to execute arbitrary script as other Ikonboard users and steal cookies v… | Patch early | 7.5 high | 5.4% | 2002-06-25 |
| CVE-2013-5573 EXP | Cross-site scripting (XSS) vulnerability in the default markup formatter in Jenkins 1.523 allows remote attackers to inject arbitrary web script or HT… | Patch early | 4.3 medium | 5.4% | 2013-12-31 |
| CVE-2005-3315 EXP | Multiple SQL injection vulnerabilities in Novell ZENworks Patch Management 6.x before 6.2.2.181 allow remote attackers to execute arbitrary SQL comman… | Patch early | 7.5 high | 5.4% | 2005-10-30 |
| CVE-2004-2523 EXP | Format string vulnerability in the msg command (cat_message function in msg.c) in OpenFTPD 0.30.2 and earlier allows remote authenticated users to exe… | Patch early | 6.5 medium | 5.4% | 2004-12-31 |
| CVE-2007-1260 EXP | Stack-based buffer overflow in the connectHandle function in server.cpp in WebMod 0.48 allows remote attackers to execute arbitrary code via a long st… | Patch early | 7.5 high | 5.4% | 2007-03-03 |
| CVE-2008-3303 EXP | admin/login.php in BilboBlog 0.2.1, when register_globals is enabled, allows remote attackers to bypass authentication and obtain administrative acces… | Patch early | 6.8 medium | 5.4% | 2008-07-25 |
| CVE-2013-3532 EXP | SQL injection vulnerability in settings.php in the Web Dorado Spider Video Player plugin 2.1 for WordPress allows remote attackers to execute arbitrar… | Patch early | 7.5 high | 5.4% | 2013-05-10 |
| CVE-2019-14339 EXP | The ContentProvider in the Canon PRINT jp.co.canon.bsd.ad.pixmaprint 2.5.5 application for Android does not properly restrict canon.ij.printer.capabil… | Patch early | 5.5 medium | 5.4% | 2019-09-05 |
| CVE-2008-2111 EXP | The ActiveX Control (yNotifier.dll) in Yahoo! Assistant 3.6 and earlier allows remote attackers to execute arbitrary code via unspecified vectors in t… | Patch early | 9.3 high | 5.4% | 2008-05-07 |
| CVE-2007-2487 EXP | Stack-based buffer overflow in AtomixMP3 allows remote attackers to execute arbitrary code via a long filename in an MP3 file, a different vector than… | Patch early | 7.5 high | 5.4% | 2007-05-03 |
| CVE-2006-2465 EXP | Buffer overflow in MP3Info 0.8.4 allows attackers to execute arbitrary code via a long command line argument. NOTE: if mp3info is not installed setui… | Patch early | 5.1 medium | 5.4% | 2006-05-19 |
| CVE-2011-4880 EXP | Directory traversal vulnerability in the web server in Certec atvise webMI2ADS (aka webMI) before 2.0.2 allows remote attackers to read arbitrary file… | Patch early | 5.0 medium | 5.4% | 2012-04-13 |
| CVE-2011-4074 EXP | Cross-site scripting (XSS) vulnerability in cmd.php in phpLDAPadmin 1.2.x before 1.2.2 allows remote attackers to inject arbitrary web script or HTML… | Patch early | 4.3 medium | 5.4% | 2011-11-02 |
| CVE-2007-4517 EXP | Buffer overflow in the XDB.XDB_PITRIG_PKG.PITRIG_DROPMETADATA procedure in Oracle 10g R2 allows remote authenticated users to execute arbitrary code v… | Patch early | 6.0 medium | 5.4% | 2007-11-08 |
| CVE-2007-4060 EXP | Multiple buffer overflows in the HttpSprockMake function in http.c in Frank Yaul corehttp 0.5.3alpha allow remote attackers to execute arbitrary code… | Patch early | 9.0 high | 5.4% | 2007-07-30 |
| CVE-2008-6935 EXP | Argument injection vulnerability in Exodus 0.10 allows remote attackers to inject arbitrary command line arguments, overwrite arbitrary files, and cau… | Patch early | 10.0 high | 5.4% | 2009-08-11 |
| CVE-2007-6623 EXP | Absolute path traversal vulnerability in ZeusCMS 0.3 and earlier might allow remote attackers to list arbitrary directories via a full pathname in the… | Patch early | 5.0 medium | 5.4% | 2008-01-04 |
| CVE-2004-1717 EXP | Multiple buffer overflows in the psscan function in ps.c for gv (ghostview) allow remote attackers to execute arbitrary code via a Postscript file wit… | Patch early | 7.5 high | 5.4% | 2004-08-16 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt