CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
407,357 CVEs
1,740 on KEV
17,302 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-13
324,662 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2008-5266 EXP | Cross-site scripting (XSS) vulnerability in configuration/httpListenerEdit.jsf in the GlassFish 2 UR2 b04 webadmin interface in Sun Java System Applic… | Patch early | 4.3 medium | 5.4% | 2008-11-28 |
| CVE-2023-34723 EXP | An issue was discovered in TechView LA-5570 Wireless Gateway 1.0.19_T53, allows attackers to gain sensitive information via /config/system.conf. | Patch early | 7.5 high | 5.4% | 2023-08-25 |
| CVE-2002-0886 EXP | Cisco DSL CPE devices running CBOS 2.4.4 and earlier allows remote attackers to cause a denial of service (hang or memory consumption) via (1) a large… | Patch early | 5.0 medium | 5.4% | 2002-10-04 |
| CVE-2022-22836 EXP | CoreFTP Server before 727 allows directory traversal (for file creation) by an authenticated attacker via ../ in an HTTP PUT request. | Patch early | 6.5 medium | 5.4% | 2022-01-10 |
| CVE-2001-1064 EXP | Cisco 600 series routers running CBOS 2.0.1 through 2.4.2ap allows remote attackers to cause a denial of service via multiple connections to the route… | Patch early | 5.0 medium | 5.4% | 2001-08-31 |
| CVE-2007-5410 EXP | PHP remote file inclusion vulnerability in admin.wmtrssreader.php in the webmaster-tips.net Flash RSS Reader (com_wmtrssreader) 1.0 component for Joom… | Patch early | 6.8 medium | 5.4% | 2007-10-12 |
| CVE-2003-1210 EXP | Multiple SQL injection vulnerabilities in the Downloads module for PHP-Nuke 5.x through 6.5 allow remote attackers to execute arbitrary SQL commands v… | Patch early | 7.5 high | 5.4% | 2003-12-31 |
| CVE-2008-0337 EXP | Heap-based buffer overflow in the _mwProcessReadSocket function in http.c in MiniWeb HTTP Server 0.8.19 allows remote attackers to execute arbitrary c… | Patch early | 7.5 high | 5.4% | 2008-01-17 |
| CVE-2004-2736 EXP | Polar HelpDesk 3.0 allows remote attackers to bypass authentication by setting the UserId and UserType values in a cookie. | Patch early | 5.0 medium | 5.4% | 2004-12-31 |
| CVE-2015-2678 EXP | Multiple cross-site scripting (XSS) vulnerabilities in MetalGenix GeniXCMS before 0.0.2 allow remote attackers to inject arbitrary web script or HTML… | Patch early | 4.3 medium | 5.4% | 2015-03-23 |
| CVE-2000-0278 EXP | The SalesLogix Eviewer allows remote attackers to cause a denial of service by accessing the URL for the slxweb.dll administration program, which does… | Patch early | 5.0 medium | 5.4% | 2000-08-03 |
| CVE-2009-0162 EXP | Cross-site scripting (XSS) vulnerability in Safari before 3.2.3, and 4 Public Beta, on Apple Mac OS X 10.5 before 10.5.7 and Windows allows remote att… | Patch early | 4.3 medium | 5.4% | 2009-05-13 |
| CVE-2000-0212 EXP | InterAccess TelnetD Server 4.0 allows remote attackers to conduct a denial of service via malformed terminal client configuration information. | Patch early | 5.0 medium | 5.4% | 2000-02-24 |
| CVE-2000-0451 EXP | The Intel express 8100 ISDN router allows remote attackers to cause a denial of service via oversized or fragmented ICMP packets. | Patch early | 5.0 medium | 5.4% | 2000-05-19 |
| CVE-2003-1160 EXP | FlexWATCH Network video server 132 allows remote attackers to bypass authentication and gain administrative privileges via an HTTP request to aindex.h… | Patch early | 10.0 high | 5.4% | 2003-10-30 |
| CVE-2005-0633 EXP | Buffer overflow in Trillian 3.0 and Pro 3.0 allows remote attackers to execute arbitrary code via a crafted PNG image file. | Patch early | 7.5 high | 5.3% | 2005-03-02 |
| CVE-2009-0241 EXP | Stack-based buffer overflow in the process_path function in gmetad/server.c in Ganglia 3.1.1 allows remote attackers to cause a denial of service (cra… | Patch early | 7.5 high | 5.3% | 2009-01-21 |
| CVE-2023-38357 EXP | Session tokens in RWS WorldServer 11.7.3 and earlier have a low entropy and can be enumerated, leading to unauthorized access to user sessions. | Patch early | 5.3 medium | 5.3% | 2023-08-01 |
| CVE-2009-5112 EXP | wgarcmin.cgi in WebGlimpse 2.18.7 and earlier allows remote attackers to obtain the installation path via a crafted request. | Patch early | 5.0 medium | 5.3% | 2012-03-19 |
| CVE-2023-30350 EXP | FS S3900-24T4S devices allow authenticated attackers with guest access to escalate their privileges and reset the admin password. | Patch early | 8.8 high | 5.3% | 2023-05-29 |
| CVE-2002-0332 EXP | Buffer overflows in xtell (xtelld) 1.91.1 and earlier, and 2.x before 2.7, allows remote attackers to execute arbitrary code via (1) a long DNS hostna… | Patch early | 7.5 high | 5.3% | 2002-06-25 |
| CVE-2001-0442 EXP | Buffer overflow in Mercury MTA POP3 server for NetWare 1.48 and earlier allows remote attackers to cause a denial of service and possibly execute arbi… | Patch early | 7.5 high | 5.3% | 2001-06-27 |
| CVE-2007-6615 EXP | Directory traversal vulnerability in includes/block.php in Agares Media phpAutoVideo 2.21 allows remote attackers to include and execute arbitrary loc… | Patch early | 6.8 medium | 5.3% | 2008-01-03 |
| CVE-2014-3110 EXP | Multiple cross-site scripting (XSS) vulnerabilities on Honeywell FALCON XLWeb Linux controller devices 2.04.01 and earlier and FALCON XLWeb XLWebExe c… | Patch early | 4.3 medium | 5.3% | 2014-07-24 |
| CVE-2009-4092 EXP | Cross-site request forgery (CSRF) vulnerability in user.php in Simplog 0.9.3.2, and possibly earlier, allows remote attackers to hijack the authentica… | Patch early | 6.8 medium | 5.3% | 2009-11-29 |
| CVE-2017-3622 EXP | Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Common Desktop Environment (CDE)). The supported version th… | Patch early | 7.8 high | 5.3% | 2017-04-24 |
| CVE-2010-4280 EXP | Multiple SQL injection vulnerabilities in Pandora FMS before 3.1.1 allow remote authenticated users to execute arbitrary SQL commands via (1) the id_g… | Patch early | 7.5 high | 5.3% | 2010-12-02 |
| CVE-2013-6627 EXP | net/http/http_stream_parser.cc in Google Chrome before 31.0.1650.48 does not properly process HTTP Informational (aka 1xx) status codes, which allows… | Patch early | 5.0 medium | 5.3% | 2013-11-13 |
| CVE-2007-0016 EXP | Stack-based buffer overflow in MoviePlay 4.76 allows remote attackers to execute arbitrary code via a long filename in a LST file. | Patch early | 7.5 high | 5.3% | 2007-01-03 |
| CVE-2003-0320 EXP | header.php in ttCMS 2.3 and earlier allows remote attackers to inject arbitrary PHP code by setting the ttcms_user_admin parameter to "1" and modifyin… | Patch early | 7.5 high | 5.3% | 2003-06-09 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt