CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
407,382 CVEs
1,741 on KEV
17,302 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-14
324,675 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2000-1081 EXP | The xp_displayparamstmt function in SQL Server and Microsoft SQL Server Desktop Engine (MSDE) does not properly restrict the length of a buffer before… | Patch early | 4.6 medium | 5.2% | 2001-01-09 |
| CVE-2008-0783 EXP | Multiple cross-site scripting (XSS) vulnerabilities in Cacti 0.8.7 before 0.8.7b and 0.8.6 before 0.8.6k allow remote attackers to inject arbitrary we… | Patch early | 4.3 medium | 5.2% | 2008-02-14 |
| CVE-2003-1431 EXP | Buffer overflow in Epic Games Unreal Engine 226f through 436 allows remote attackers to cause a denial of service (crash) via a long host string in th… | Patch early | 7.1 high | 5.2% | 2003-12-31 |
| CVE-2005-4317 EXP | Limbo CMS 1.0.4.2 and earlier, with register_globals off, does not protect the $_SERVER variable from external modification, which allows remote attac… | Patch early | 6.8 medium | 5.2% | 2005-12-17 |
| CVE-2000-0299 EXP | Buffer overflow in WebObjects.exe in the WebObjects Developer 4.5 package allows remote attackers to cause a denial of service via an HTTP request wit… | Patch early | 5.0 medium | 5.2% | 2000-04-04 |
| CVE-2001-0380 EXP | Crosscom/Olicom XLT-F running XL 80 IM Version 5.5 Build Level 2 allows a remote attacker SNMP read and write access via a default, undocumented commu… | Patch early | 6.4 medium | 5.2% | 2001-06-18 |
| CVE-2007-1583 EXP | The mb_parse_str function in PHP 4.0.0 through 4.4.6 and 5.0.0 through 5.2.1 sets the internal register_globals flag and does not disable it in certai… | Patch early | 6.8 medium | 5.2% | 2007-03-21 |
| CVE-2006-0685 EXP | The check_login function in login.php in Virtual Hosting Control System (VHCS) 2.4.7.1 and earlier does not exit when authentication fails, which allo… | Patch early | 10.0 high | 5.2% | 2006-02-15 |
| CVE-2015-8664 EXP | Integer overflow in the WebCursor::Deserialize function in content/common/cursors/webcursor.cc in Google Chrome before 47.0.2526.106 allows remote att… | Patch early | 8.8 high | 5.2% | 2015-12-24 |
| CVE-2004-1466 EXP | The set_time_limit function in Gallery before 1.4.4_p2 deletes non-image files in a temporary directory every 30 seconds after they have been uploaded… | Patch early | 7.5 high | 5.2% | 2004-12-31 |
| CVE-2015-4682 EXP | Polycom RealPresence Resource Manager (aka RPRM) before 8.4 allows remote authenticated users to obtain the installation path via an HTTP POST request… | Patch early | 6.5 medium | 5.2% | 2017-09-19 |
| CVE-2010-4879 EXP | PHP remote file inclusion vulnerability in dompdf.php in dompdf 0.6.0 beta1 allows remote attackers to execute arbitrary PHP code via a URL in the inp… | Patch early | 7.5 high | 5.2% | 2011-10-07 |
| CVE-2015-8725 EXP | The dissect_diameter_base_framed_ipv6_prefix function in epan/dissectors/packet-diameter.c in the DIAMETER dissector in Wireshark 1.12.x before 1.12.9… | Patch early | 5.5 medium | 5.2% | 2016-01-04 |
| CVE-2007-6609 EXP | Multiple stack-based buffer overflows in the CPLI_ReadTag_OGG function in CPI_PlaylistItem.c in CoolPlayer 217 and earlier allow user-assisted remote… | Patch early | 5.0 medium | 5.2% | 2007-12-31 |
| CVE-2008-1866 EXP | admin/modif_config.php in Blog Pixel Motion (aka PixelMotion) does not require admin authentication, which allows remote authenticated users to upload… | Patch early | 9.0 high | 5.2% | 2008-04-17 |
| CVE-2022-31325 EXP | There is a SQL Injection vulnerability in ChurchCRM 4.4.5 via the 'PersonID' field in /churchcrm/WhyCameEditor.php. | Patch early | 7.2 high | 5.2% | 2022-06-08 |
| CVE-1999-0765 EXP | SGI IRIX midikeys program allows local users to modify arbitrary files via a text editor. | Patch early | 10.0 high | 5.2% | 1999-05-19 |
| CVE-2016-3962 EXP | Stack-based buffer overflow in the NTP time-server interface on Meinberg IMS-LANTIME M3000, IMS-LANTIME M1000, IMS-LANTIME M500, LANTIME M900, LANTIME… | Patch early | 7.3 high | 5.2% | 2016-07-03 |
| CVE-2006-1234 EXP | SQL injection vulnerability in index.php in DSCounter 1.2, with magic_quotes_gpc disabled, allows remote attackers to execute arbitrary SQL commands v… | Patch early | 5.1 medium | 5.2% | 2006-03-14 |
| CVE-2017-6096 EXP | A SQL injection issue was discovered in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects /inc/lists/view-list.php (Requires auth… | Patch early | 7.2 high | 5.2% | 2017-02-21 |
| CVE-2017-6097 EXP | A SQL injection issue was discovered in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects /inc/campaign/count_of_send.php (Requir… | Patch early | 7.2 high | 5.2% | 2017-02-21 |
| CVE-2001-1289 EXP | Quake 3 arena 1.29f and 1.29g allows remote attackers to cause a denial of service (crash) via a malformed connection packet that begins with several… | Patch early | 5.0 medium | 5.2% | 2001-07-29 |
| CVE-2009-2361 EXP | SQL injection vulnerability in include/class.staff.php in osTicket before 1.6 RC5 allows remote attackers to execute arbitrary SQL commands via the st… | Patch early | 7.5 high | 5.2% | 2009-07-08 |
| CVE-2000-1078 EXP | ICQ Web Front HTTPd allows remote attackers to cause a denial of service by requesting a URL that contains a "?" character. | Patch early | 5.0 medium | 5.2% | 2000-12-11 |
| CVE-2001-0647 EXP | Orange Web Server 2.1, based on GoAhead, allows a remote attacker to perform a denial of service via an HTTP GET request that does not include the HTT… | Patch early | 5.0 medium | 5.2% | 2001-08-06 |
| CVE-2001-0743 EXP | Paging function in O'Reilly WebBoard Pager 4.10 allows remote attackers to cause a denial of service via a message with an escaped ' character followe… | Patch early | 5.0 medium | 5.2% | 2001-10-18 |
| CVE-2000-0341 EXP | ATRIUM Cassandra NNTP Server 1.10 allows remote attackers to cause a denial of service via a long login name. | Patch early | 5.0 medium | 5.2% | 2000-05-01 |
| CVE-2013-2586 EXP | XAMPP 1.8.1 does not properly restrict access to xampp/lang.php, which allows remote attackers to modify xampp/lang.tmp and execute cross-site scripti… | Patch early | 4.3 medium | 5.2% | 2014-09-29 |
| CVE-2005-2175 EXP | The web interface for Lotus Notes mail automatically processes HTML in an attachment without prompting the user to save or open it, which makes it eas… | Patch early | 5.0 medium | 5.2% | 2005-07-09 |
| CVE-2004-1003 EXP | Trend ScanMail allows remote attackers to obtain potentially sensitive information or disable the anti-virus capability via the smency.nsf file. | Patch early | 5.0 medium | 5.2% | 2005-03-01 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt