CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
405,135 CVEs
1,739 on KEV
17,301 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-13
405,135 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2009-4531 EXP | httpdx 1.4.4 and earlier allows remote attackers to obtain the source code for a web page by appending a . (dot) character to the URI. | Patch early | 5.0 medium | 7.1% | 2009-12-31 |
| CVE-2014-5092 EXP | Status2k allows Remote Command Execution in admin/options/editpl.php. | Patch early | 8.8 high | 7.1% | 2020-01-10 |
| CVE-2020-11804 EXP | An issue was discovered in Titan SpamTitan 7.07. Due to improper sanitization of the parameter quid, used in the page mailqueue.php, code injection ca… | Patch early | 8.8 high | 7.1% | 2020-09-17 |
| CVE-2006-2998 EXP | PHP remote file inclusion vulnerability in board/post.php in free QBoard 1.1 and earlier allows remote attackers to execute arbitrary PHP code via a U… | Patch early | 7.5 high | 7.1% | 2006-06-13 |
| CVE-2004-1543 EXP | Directory traversal vulnerability in viewimg.php in KorWeblog 1.6.2-cvs and earlier allows remote attackers to list arbitrary directories via a .. (do… | Patch early | 5.0 medium | 7.1% | 2004-12-31 |
| CVE-2008-6791 EXP | PumpKIN TFTP Server 2.7.2.0 allows remote attackers to cause a denial of service via a write request with a long mode field. | Patch early | 5.0 medium | 7.1% | 2009-05-04 |
| CVE-2017-15220 EXP | Flexense VX Search Enterprise 10.1.12 is vulnerable to a buffer overflow via an empty POST request to a long URI beginning with a /../ substring. This… | Patch early | 9.8 critical | 7.1% | 2017-10-11 |
| CVE-2000-1022 EXP | The mailguard feature in Cisco Secure PIX Firewall 5.2(2) and earlier does not properly restrict access to SMTP commands, which allows remote attacker… | Patch early | 7.5 high | 7.1% | 2000-12-11 |
| CVE-2008-3906 EXP | CRLF injection vulnerability in Sys.Web in Mono 2.0 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response spl… | Patch early | 4.3 medium | 7.1% | 2008-09-04 |
| CVE-2001-0991 EXP | Cross-site scripting vulnerability in Proxomitron Naoko-4 BetaFour and earlier allows remote attackers to execute arbitrary script on other clients vi… | Patch early | 7.5 high | 7.1% | 2001-07-24 |
| CVE-2002-0118 EXP | Cross-site scripting vulnerability in Infopop Ultimate Bulletin Board (UBB) 6.2.0 Beta Release 1.0 allows remote attackers to execute arbitrary script… | Patch early | 7.5 high | 7.1% | 2002-03-25 |
| CVE-2002-1008 EXP | Cross-site scripting vulnerability in PowerBASIC urlcount.cgi, as included in Lil' HTTP web server, allows remote attackers to execute arbitrary web s… | Patch early | 7.5 high | 7.1% | 2002-10-04 |
| CVE-2001-0319 EXP | orderdspc.d2w macro in IBM Net.Commerce 3.x allows remote attackers to execute arbitrary SQL queries by inserting them into the order_rn option of the… | Patch early | 7.5 high | 7.1% | 2001-05-03 |
| CVE-2009-1592 EXP | Stack-based buffer overflow in ElectraSoft 32bit FTP 09.04.24 allows remote FTP servers to execute arbitrary code via a long banner. NOTE: this might… | Patch early | 10.0 high | 7.1% | 2009-05-08 |
| CVE-2008-5784 EXP | V3 Chat - Profiles/Dating Script 3.0.2 allows remote attackers to bypass authentication and gain administrative access by setting the admin cookie to… | Patch early | 9.8 critical | 7.1% | 2008-12-31 |
| CVE-2004-2253 EXP | Directory traversal vulnerability in user.cgi in SurgeLDAP 1.0g and earlier allows remote attackers to read arbitrary files via a .. in the page param… | Patch early | 5.0 medium | 7.1% | 2004-12-31 |
| CVE-2003-1166 EXP | Directory traversal vulnerability in (1) Openfile.aspx and (2) Html.aspx in HTTP Commander 4.0 allows remote attackers to view arbitrary files via a .… | Patch early | 5.0 medium | 7.1% | 2003-12-31 |
| CVE-2008-6811 EXP | Unrestricted file upload vulnerability in image_processing.php in the e-Commerce Plugin 3.4 and earlier for Wordpress allows remote attackers to execu… | Patch early | 6.8 medium | 7.1% | 2009-05-18 |
| CVE-2005-1204 EXP | Desktop Rover 3.0, and possibly earlier versions, allows remote attackers to cause a denial of service (application crash) via a crafted packet to TCP… | Patch early | 5.0 medium | 7.1% | 2005-05-02 |
| CVE-2006-1291 EXP | publish.ical.php in Jim Hu and Chad Little PHP iCalendar 2.21 and earlier does not require authentication for write access to the calendars directory,… | Patch early | 7.5 high | 7.1% | 2006-03-19 |
| CVE-2006-2230 EXP | Multiple format string vulnerabilities in xiTK (xitk/main.c) in xine 0.99.4 might allow attackers to cause a denial of service via format string speci… | Patch early | 5.0 medium | 7.1% | 2006-05-05 |
| CVE-2009-1645 EXP | Multiple stack-based buffer overflows in Mini-stream Easy RM-MP3 Converter 3.0.0.7 allow remote attackers to execute arbitrary code via (1) a long rts… | Patch early | 9.3 high | 7.1% | 2009-05-15 |
| CVE-2005-2640 EXP | Behavioral discrepancy information leak in Juniper Netscreen VPN running ScreenOS 5.2.0 and earlier, when using IKE with pre-shared key authentication… | Patch early | 5.0 medium | 7.1% | 2005-08-23 |
| CVE-2008-1276 EXP | Multiple buffer overflows in the IMAP service (MEIMAPS.EXE) in MailEnable Professional Edition and Enterprise Edition 3.13 and earlier allow remote au… | Patch early | 9.0 high | 7.1% | 2008-03-10 |
| CVE-2002-0106 EXP | BEA Systems Weblogic Server 6.1 allows remote attackers to cause a denial of service via a series of requests to .JSP files that contain an MS-DOS dev… | Patch early | 5.0 medium | 7.1% | 2002-03-25 |
| CVE-2007-1648 EXP | 0irc 1345 build 20060823 allows remote attackers to cause a denial of service (application crash) by operating an IRC server that sends a long string… | Patch early | 7.8 high | 7.1% | 2007-03-24 |
| CVE-2007-2497 EXP | RealNetworks RealPlayer 10 Gold allows remote attackers to cause a denial of service (memory consumption) via a certain .ra file. NOTE: this issue wa… | Patch early | 7.8 high | 7.1% | 2007-05-04 |
| CVE-2015-5353 EXP | Directory traversal vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to include and execute arbitrary local files via a .. (dot dot) i… | Patch early | 7.5 high | 7.1% | 2015-07-01 |
| CVE-2012-0292 EXP | The awhost32 service in Symantec pcAnywhere through 12.5.3, Altiris IT Management Suite pcAnywhere Solution 7.0 (aka 12.5.x) and 7.1 (aka 12.6.x), Alt… | Patch early | 5.0 medium | 7.1% | 2012-03-08 |
| CVE-2020-11700 EXP | An issue was discovered in Titan SpamTitan 7.07. Improper sanitization of the parameter fname, used on the page certs-x.php, would allow an attacker t… | Patch early | 6.5 medium | 7.1% | 2020-09-17 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt