CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
408,024 CVEs
1,741 on KEV
17,306 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-14
325,183 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2007-5332 EXP | Multiple unspecified vulnerabilities in (1) mediasvr and (2) caloggerd in CA BrightStor ARCServe BackUp v9.01 through R11.5, and Enterprise Backup r10… | Patch early | 10.0 high | 5.3% | 2007-10-13 |
| CVE-2009-0821 EXP | Mozilla Firefox 2.0.0.20 and earlier allows remote attackers to cause a denial of service (application crash) via nested calls to the window.print fun… | Patch early | 5.0 medium | 5.3% | 2009-03-05 |
| CVE-2010-1686 EXP | Stack-based buffer overflow in (1) Urgent Backup 3.20, and (2) ABC Backup Pro 5.20 and ABC Backup 5.50, allows user-assisted remote attackers to execu… | Patch early | 9.3 high | 5.3% | 2010-05-05 |
| CVE-2017-6516 EXP | A Local Privilege Escalation Vulnerability in MagniComp's Sysinfo before 10-H64 for Linux and UNIX platforms could allow a local attacker to gain elev… | Patch early | 6.7 medium | 5.3% | 2017-03-14 |
| CVE-2000-1085 EXP | The xp_peekqueue function in Microsoft SQL Server 2000 and SQL Server Desktop Engine (MSDE) does not properly restrict the length of a buffer before c… | Patch early | 4.6 medium | 5.3% | 2001-01-09 |
| CVE-2002-0002 EXP | Format string vulnerability in stunnel before 3.22 when used in client mode for (1) smtp, (2) pop, or (3) nntp allows remote malicious servers to exec… | Patch early | 7.5 high | 5.3% | 2002-01-31 |
| CVE-2013-4695 EXP | Winamp 5.63: Invalid Pointer Dereference leading to Arbitrary Code Execution | Patch early | 7.8 high | 5.3% | 2019-12-27 |
| CVE-2009-0981 EXP | Unspecified vulnerability in the Application Express component in Oracle Database 11.1.0.7 allows remote authenticated users to affect confidentiality… | Patch early | 4.0 medium | 5.3% | 2009-04-15 |
| CVE-2000-0221 EXP | The Nautica Marlin bridge allows remote attackers to cause a denial of service via a zero length UDP packet to the SNMP port. | Patch early | 5.0 medium | 5.3% | 2000-02-25 |
| CVE-2007-6324 EXP | PHP remote file inclusion vulnerability in head.php in CityWriter 0.9.7 allows remote attackers to execute arbitrary PHP code via a URL in the path pa… | Patch early | 6.8 medium | 5.3% | 2007-12-13 |
| CVE-2018-20484 EXP | Zoho ManageEngine ADSelfService Plus 5.7 before build 5702 has XSS in the self-update layout implementation. | Patch early | 6.1 medium | 5.3% | 2018-12-26 |
| CVE-2018-20485 EXP | Zoho ManageEngine ADSelfService Plus 5.7 before build 5702 has XSS in the employee search feature. | Patch early | 6.1 medium | 5.3% | 2018-12-26 |
| CVE-2006-2494 EXP | Stack-based buffer overflow in IntelliTamper 2.07 allows remote attackers to execute arbitrary code via a crafted .map file. | Patch early | 5.1 medium | 5.3% | 2006-05-20 |
| CVE-2007-3792 EXP | Multiple PHP remote file inclusion vulnerabilities in AzDG Dating Gold 3.0.5 allow remote attackers to execute arbitrary PHP code via a URL in the int… | Patch early | 4.3 medium | 5.3% | 2007-07-15 |
| CVE-2020-10883 EXP | This vulnerability allows local attackers to escalate privileges on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1750 routers. A… | Patch early | 7.8 high | 5.3% | 2020-03-25 |
| CVE-2009-0351 EXP | Stack-based buffer overflow in WFTPSRV.exe in WinFTP 2.3.0 allows remote authenticated users to execute arbitrary code via a long LIST argument beginn… | Patch early | 9.0 high | 5.3% | 2009-01-29 |
| CVE-2008-5073 EXP | Heap-based buffer overflow in an ActiveX control in Novell ZENworks Desktop Management 6.5 allows remote attackers to execute arbitrary code via a lon… | Patch early | 9.3 high | 5.3% | 2008-11-14 |
| CVE-2000-0647 EXP | WFTPD and WFTPD Pro 2.41 allows remote attackers to cause a denial of service by executing an MLST command before logging into the server. | Patch early | 5.0 medium | 5.3% | 2000-07-21 |
| CVE-2001-0460 EXP | Websweeper 4.0 does not limit the length of certain HTTP headers, which allows remote attackers to cause a denial of service (memory exhaustion) via a… | Patch early | 5.0 medium | 5.3% | 2001-06-27 |
| CVE-2013-2501 EXP | Cross-site scripting (XSS) vulnerability in the Terillion Reviews plugin before 1.2 for WordPress allows remote attackers to inject arbitrary web scri… | Patch early | 4.3 medium | 5.3% | 2013-03-22 |
| CVE-2018-16083 EXP | An out of bounds read in forward error correction code in WebRTC in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to perform an out of… | Patch early | 8.8 high | 5.3% | 2019-01-09 |
| CVE-2004-0648 EXP | Mozilla (Suite) before 1.7.1, Firefox before 0.9.2, and Thunderbird before 0.7.2 allow remote attackers to launch arbitrary programs via a URI referen… | Patch early | 10.0 high | 5.3% | 2004-08-06 |
| CVE-2017-13797 EXP | An issue was discovered in certain Apple products. iOS before 11.1 is affected. Safari before 11.0.1 is affected. iCloud before 7.1 on Windows is affe… | Patch early | 8.8 high | 5.3% | 2017-11-13 |
| CVE-2008-4247 EXP | ftpd in OpenBSD 4.3, FreeBSD 7.0, NetBSD 4.0, Solaris, and possibly other operating systems interprets long commands from an FTP client as multiple co… | Patch early | 7.5 high | 5.3% | 2008-09-25 |
| CVE-2023-36346 EXP | POS Codekop v2.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the nm_member parameter at print.php. | Patch early | 6.1 medium | 5.3% | 2023-06-23 |
| CVE-2007-1584 EXP | Buffer underflow in the header function in PHP 5.2.0 allows context-dependent attackers to execute arbitrary code by passing an all-whitespace string… | Patch early | 6.8 medium | 5.2% | 2007-03-21 |
| CVE-2006-6104 EXP | The System.Web class in the XSP for ASP.NET server 1.1 through 2.0 in Mono does not properly verify local pathnames, which allows remote attackers to… | Patch early | 5.0 medium | 5.2% | 2006-12-21 |
| CVE-2015-4614 EXP | Multiple SQL injection vulnerabilities in includes/Function.php in the Easy2Map plugin before 1.2.5 for WordPress allow remote attackers to execute ar… | Patch early | 7.5 high | 5.2% | 2015-07-08 |
| CVE-2008-1501 EXP | The send_user_mode function in s_user.c in (1) Undernet ircu 2.10.12.12 and earlier, (2) snircd 1.3.4 and earlier, and unspecified other ircu derivati… | Patch early | 5.0 medium | 5.2% | 2008-03-25 |
| CVE-2011-1485 EXP | Race condition in the pkexec utility and polkitd daemon in PolicyKit (aka polkit) 0.96 allows local users to gain privileges by executing a setuid pro… | Patch early | 6.9 medium | 5.2% | 2011-05-31 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt