CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
405,135 CVEs
1,739 on KEV
17,301 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-13
405,135 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2025-29471 EXP | Cross Site Scripting vulnerability in Nagios Log Server v.2024R1.3.1 allows a remote attacker to execute arbitrary code via a payload into the Email f… | Patch early | 8.3 high | 7.2% | 2025-04-15 |
| CVE-2011-4835 EXP | Directory traversal vulnerability in the web interface in HomeSeer HS2 2.5.0.20 allows remote attackers to access arbitrary files via unspecified vect… | Patch early | 7.5 high | 7.2% | 2011-12-15 |
| CVE-2012-5344 EXP | Directory traversal vulnerability in the WebServer (Thttpd.bat) in IpTools (aka Tiny TCP/IP server) 0.1.4 allows remote attackers to read arbitrary fi… | Patch early | 5.0 medium | 7.2% | 2012-10-09 |
| CVE-2008-4923 EXP | Multiple insecure method vulnerabilities in MW6 Technologies Aztec ActiveX control (AZTECLib.MW6Aztec, Aztec.dll) 3.0.0.1 allow remote attackers to ov… | Patch early | 9.0 high | 7.1% | 2008-11-04 |
| CVE-2008-4924 EXP | Multiple insecure method vulnerabilities in MW6 Technologies 1D Barcode ActiveX control (BARCODELib.MW6Barcode, Barcode.dll) 3.0.0.1 allow remote atta… | Patch early | 9.0 high | 7.1% | 2008-11-04 |
| CVE-2008-4925 EXP | Multiple insecure method vulnerabilities in MW6 Technologies DataMatrix ActiveX control (DATAMATRIXLib.MW6DataMatrix, DataMatrix.dll) 3.0.0.1 allow re… | Patch early | 9.0 high | 7.1% | 2008-11-04 |
| CVE-2006-2233 EXP | Buffer overflow in BankTown Client Control (aka BtCxCtl20Com) 1.4.2.51817, and possibly 1.5.2.50209, allows remote attackers to execute arbitrary code… | Patch early | 7.5 high | 7.1% | 2006-05-05 |
| CVE-2017-13261 EXP | In bnep_process_control_packet of bnep_utils.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to remote infor… | Patch early | 7.5 high | 7.1% | 2018-04-04 |
| CVE-2007-0639 EXP | Multiple static code injection vulnerabilities in error.php in GuppY 4.5.16 and earlier allow remote attackers to inject arbitrary PHP code into a .in… | Patch early | 7.5 high | 7.1% | 2007-01-31 |
| CVE-2002-0406 EXP | Menasoft SPHERE server 0.99x and 0.5x allows remote attackers to cause a denial of service by establishing a large number of connections to the server… | Patch early | 5.0 medium | 7.1% | 2002-07-26 |
| CVE-1999-1030 EXP | counter.exe 2.70 allows a remote attacker to cause a denial of service (hang) via an HTTP request that ends in %0A (newline), which causes a malformed… | Patch early | 5.0 medium | 7.1% | 1999-05-19 |
| CVE-1999-1519 EXP | Gene6 G6 FTP Server 2.0 allows a remote attacker to cause a denial of service (resource exhaustion) via a long (1) user name or (2) password. | Patch early | 5.0 medium | 7.1% | 1999-11-17 |
| CVE-2008-4771 EXP | Stack-based buffer overflow in VATDecoder.VatCtrl.1 ActiveX control in (1) 4xem VatCtrl Class (VATDecoder.dll 1.0.0.27 and 1.0.0.51), (2) D-Link MPEG4… | Patch early | 9.3 high | 7.1% | 2008-10-28 |
| CVE-2003-0203 EXP | Buffer overflow in moxftp 2.2 and earlier allows remote malicious FTP servers to execute arbitrary code via a long FTP banner. | Patch early | 7.5 high | 7.1% | 2003-04-11 |
| CVE-2004-0071 EXP | Directory traversal vulnerability in buildManPage in class.manpagelookup.php for PHP Man Page Lookup 1.2.0 allows remote attackers to read arbitrary f… | Patch early | 5.0 medium | 7.1% | 2004-02-17 |
| CVE-2004-1646 EXP | Directory traversal vulnerability in Xedus 1.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the URL. | Patch early | 5.0 medium | 7.1% | 2004-08-30 |
| CVE-2008-7078 EXP | Multiple buffer overflows in Rumpus before 6.0.1 allow remote attackers to (1) cause a denial of service (segmentation fault) via a long HTTP verb in… | Patch early | 9.0 high | 7.1% | 2009-08-25 |
| CVE-2014-2477 EXP | Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox before 3.2.24, 4.0.26, 4.1.34, 4.2.26, and 4.3.12… | Patch early | 3.6 low | 7.1% | 2014-07-17 |
| CVE-2001-0028 EXP | Buffer overflow in the HTML parsing code in oops WWW proxy server 1.5.2 and earlier allows remote attackers to execute arbitrary commands via a large… | Patch early | 10.0 high | 7.1% | 2001-02-12 |
| CVE-2005-4456 EXP | Multiple buffer overflows in MailEnable Professional 1.71 and Enterprise 1.1 before patch ME-10009 allow remote attackers to cause a denial of service… | Patch early | 7.8 high | 7.1% | 2005-12-21 |
| CVE-2007-5731 EXP | Absolute path traversal vulnerability in Apache Jakarta Slide 2.1 and earlier allows remote authenticated users to read arbitrary files via a WebDAV w… | Patch early | 3.5 low | 7.1% | 2007-10-30 |
| CVE-2009-1325 EXP | Stack-based buffer overflow in Mini-stream Ripper 3.0.1.1 allows remote attackers to execute arbitrary code via a long URI in a playlist (.m3u) file. | Patch early | 9.3 high | 7.1% | 2009-04-17 |
| CVE-2009-1326 EXP | Stack-based buffer overflow in Mini-stream RM Downloader 3.0.0.9 allows remote attackers to execute arbitrary code via a long URI in a playlist (.m3u)… | Patch early | 9.3 high | 7.1% | 2009-04-17 |
| CVE-2009-1328 EXP | Stack-based buffer overflow in Mini-stream RM-MP3 Converter 3.0.0.7 allows remote attackers to execute arbitrary code via a long URI in a playlist (.m… | Patch early | 9.3 high | 7.1% | 2009-04-17 |
| CVE-1999-1020 EXP | The installation of Novell Netware NDS 5.99 provides an unauthenticated client with Read access for the tree, which allows remote attackers to access… | Patch early | 7.5 high | 7.1% | 1998-09-18 |
| CVE-2004-0520 EXP | Cross-site scripting (XSS) vulnerability in mime.php for SquirrelMail before 1.4.3 allows remote attackers to insert arbitrary HTML and script via the… | Patch early | 6.8 medium | 7.1% | 2004-08-18 |
| CVE-2008-3578 EXP | HydraIRC 0.3.164 and earlier allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a long irc:// U… | Patch early | 5.0 medium | 7.1% | 2008-08-10 |
| CVE-2018-12522 EXP | An issue was discovered in perfSONAR Monitoring and Debugging Dashboard (MaDDash) 2.0.2. A direct request to /style/ provides a directory listing. | Patch early | 5.3 medium | 7.1% | 2018-06-18 |
| CVE-2018-12523 EXP | An issue was discovered in perfSONAR Monitoring and Debugging Dashboard (MaDDash) 2.0.2. A direct request to /etc/ provides a directory listing. | Patch early | 5.3 medium | 7.1% | 2018-06-18 |
| CVE-2018-12524 EXP | An issue was discovered in perfSONAR Monitoring and Debugging Dashboard (MaDDash) 2.0.2. A direct request to /lib/ provides a directory listing. | Patch early | 5.3 medium | 7.1% | 2018-06-18 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt