CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
407,366 CVEs
1,741 on KEV
17,302 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-14
324,663 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2003-0320 EXP | header.php in ttCMS 2.3 and earlier allows remote attackers to inject arbitrary PHP code by setting the ttcms_user_admin parameter to "1" and modifyin… | Patch early | 7.5 high | 5.3% | 2003-06-09 |
| CVE-1999-0477 EXP | The Expression Evaluator in the ColdFusion Application Server allows a remote attacker to upload files to the server via openfile.cfm, which does not… | Patch early | 7.5 high | 5.3% | 1999-12-25 |
| CVE-1999-0753 EXP | The w3-msql CGI script provided with Mini SQL allows remote attackers to view restricted directories. | Patch early | 7.5 high | 5.3% | 1999-08-17 |
| CVE-2007-5958 EXP | X.Org Xserver before 1.4.1 allows local users to determine the existence of arbitrary files via a filename argument in the -sp option to the X program… | Patch early | 5.0 medium | 5.3% | 2008-01-18 |
| CVE-2007-5265 EXP | Multiple format string vulnerabilities in websrv.cpp in Dawn of Time 1.69s beta4 and earlier allow remote attackers to execute arbitrary code via form… | Patch early | 7.5 high | 5.3% | 2007-10-08 |
| CVE-2009-1039 EXP | Buffer overflow in CDex 1.70b2 allows remote attackers to execute arbitrary code via a crafted Info header in an Ogg Vorbis (.ogg) file. | Patch early | 7.5 high | 5.3% | 2009-03-20 |
| CVE-2018-8729 EXP | Multiple cross-site scripting (XSS) vulnerabilities in the Activity Log plugin before 2.4.1 for WordPress allow remote attackers to inject arbitrary J… | Patch early | 6.1 medium | 5.3% | 2018-03-15 |
| CVE-2019-9591 EXP | A reflected Cross-site scripting (XSS) vulnerability in ShoreTel Connect ONSITE before 19.49.1500.0 allows remote attackers to inject arbitrary web sc… | Patch early | 6.1 medium | 5.3% | 2019-03-06 |
| CVE-2023-21752 EXP | Windows Backup Service Elevation of Privilege Vulnerability | Patch early | 7.1 high | 5.3% | 2023-01-10 |
| CVE-2009-1729 EXP | Multiple cross-site scripting (XSS) vulnerabilities in Sun Java System Communications Express 6 2005Q4 (aka 6.2) and 6.3 allow remote attackers to inj… | Patch early | 4.3 medium | 5.3% | 2009-05-21 |
| CVE-2024-11237 EXP | A vulnerability, which was classified as critical, has been found in TP-Link VN020 F3v(T) TT_V6.2.1021. Affected by this issue is some unknown functio… | Patch early | 7.5 high | 5.3% | 2024-11-15 |
| CVE-2012-0895 EXP | Cross-site scripting (XSS) vulnerability in map/map.php in the Count Per Day module before 3.1.1 for WordPress allows remote attackers to inject arbit… | Patch early | 4.3 medium | 5.3% | 2012-01-20 |
| CVE-2006-1377 EXP | Cross-site scripting (XSS) vulnerability in img.php in (1) EasyMoblog 0.5.1 and (2) CoMoblog 1.1 allows remote attackers to inject arbitrary web scrip… | Patch early | 4.3 medium | 5.3% | 2006-03-24 |
| CVE-2004-2511 EXP | Multiple cross-site scripting (XSS) vulnerabilities in DCP-Portal 5.3.2 and earlier allow remote attackers to inject arbitrary web script or HTML via… | Patch early | 4.3 medium | 5.3% | 2004-12-31 |
| CVE-2007-1473 EXP | Cross-site scripting (XSS) vulnerability in framework/NLS/NLS.php in Horde Framework before 3.1.4 RC1, when the login page contains a language selecti… | Patch early | 4.3 medium | 5.3% | 2007-03-16 |
| CVE-2019-6804 EXP | An XSS issue was discovered on the Job Edit page in Rundeck Community Edition before 3.0.13, related to assets/javascripts/workflowStepEditorKO.js and… | Patch early | 6.1 medium | 5.3% | 2019-01-25 |
| CVE-2023-36306 EXP | A Cross Site Scripting (XSS) vulnerability in Adiscon Aiscon LogAnalyzer through 4.1.13 allows a remote attacker to execute arbitrary code via the ask… | Patch early | 6.1 medium | 5.3% | 2023-08-08 |
| CVE-2012-6506 EXP | Multiple cross-site scripting (XSS) vulnerabilities in the Zingiri Web Shop plugin 2.4.0 for WordPress allow remote attackers to inject arbitrary web… | Patch early | 4.3 medium | 5.3% | 2013-01-24 |
| CVE-1999-1566 EXP | Buffer overflow in iParty server 1.2 and earlier allows remote attackers to cause a denial of service (crash) by connecting to default port 6004 and s… | Patch early | 5.0 medium | 5.3% | 1999-05-08 |
| CVE-2013-6874 EXP | Stack-based buffer overflow in Vortex Light Alloy before 4.7.4 allows remote attackers to execute arbitrary code via a long URL in a .m3u file. | Patch early | 9.3 high | 5.3% | 2013-11-26 |
| CVE-2016-5310 EXP | The RAR file parser component in the AntiVirus Decomposer engine in Symantec Advanced Threat Protection: Network (ATP); Symantec Email Security.Cloud;… | Patch early | 5.5 medium | 5.3% | 2017-04-14 |
| CVE-2009-0464 EXP | PHP remote file inclusion vulnerability in includes/header.php in Groone GBook 2.0 allows remote attackers to execute arbitrary PHP code via a URL in… | Patch early | 5.1 medium | 5.3% | 2009-02-10 |
| CVE-2019-9592 EXP | A reflected Cross-site scripting (XSS) vulnerability in ShoreTel Connect ONSITE 19.45.1602.0 allows remote attackers to inject arbitrary web script or… | Patch early | 6.1 medium | 5.3% | 2019-03-06 |
| CVE-2019-16118 EXP | Cross site scripting (XSS) in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via admin/controllers/Options.php. | Patch early | 6.1 medium | 5.3% | 2019-09-08 |
| CVE-2008-6186 EXP | Stack-based buffer overflow in RaidenFTPD 2.4 build 3620 allows remote authenticated users to cause a denial of service (crash) or execute arbitrary c… | Patch early | 9.0 high | 5.3% | 2009-02-19 |
| CVE-2001-0580 EXP | Hughes Technologies Virtual DNS (VDNS) Server 1.0 allows a remote attacker to create a denial of service by connecting to port 6070, sending some data… | Patch early | 5.0 medium | 5.3% | 2001-08-22 |
| CVE-2007-4145 EXP | Heap-based buffer overflow in the BlueSkychat (BlueSkyCat) ActiveX control (V2.V2Ctrl.1) in v2.ocx 8.1.2.0 and earlier allows remote attackers to exec… | Patch early | 4.3 medium | 5.3% | 2007-08-03 |
| CVE-2020-2231 EXP | Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the remote address of the host starting a build via 'Trigger builds remotely', resu… | Patch early | 5.4 medium | 5.3% | 2020-08-12 |
| CVE-2008-6899 EXP | Multiple buffer overflows in freeSSHd 1.2.1 allow remote authenticated users to cause a denial of service (crash) and execute arbitrary code via a lon… | Patch early | 9.0 high | 5.3% | 2009-08-05 |
| CVE-2007-5332 EXP | Multiple unspecified vulnerabilities in (1) mediasvr and (2) caloggerd in CA BrightStor ARCServe BackUp v9.01 through R11.5, and Enterprise Backup r10… | Patch early | 10.0 high | 5.3% | 2007-10-13 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt