CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
407,432 CVEs
1,741 on KEV
17,302 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-14
324,716 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2016-1803 EXP | CoreCapture in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1 allows attackers to execute arbitrary code in… | Patch early | 7.8 high | 5.1% | 2016-05-20 |
| CVE-2018-11525 EXP | The plugin "Advanced Order Export For WooCommerce" for WordPress (v1.5.4 and before) is vulnerable to CSV Injection. | Patch early | 7.8 high | 5.1% | 2018-06-19 |
| CVE-2018-11526 EXP | The plugin "WordPress Comments Import & Export" for WordPress (v2.0.4 and before) is vulnerable to CSV Injection. | Patch early | 7.8 high | 5.1% | 2018-06-19 |
| CVE-2006-5519 EXP | PHP remote file inclusion vulnerability in Savant2/Savant2_Plugin_options.php in the MambWeather 1.8.1 and earlier component for Mambo allows remote a… | Patch early | 6.8 medium | 5.1% | 2006-10-26 |
| CVE-2003-0293 EXP | PalmOS allows remote attackers to cause a denial of service (CPU consumption) via a flood of ICMP echo request (ping) packets. | Patch early | 5.0 medium | 5.1% | 2003-06-16 |
| CVE-2012-2171 EXP | SQL injection vulnerability in ModuleServlet.do in the Storage Manager Profiler in IBM System Storage DS Storage Manager before 10.83.xx.18 on DS Seri… | Patch early | 6.5 medium | 5.1% | 2012-06-22 |
| CVE-2020-25901 EXP | Host Header Injection in Spiceworks 7.5.7.0 allowing the attacker to render arbitrary links that point to a malicious website with poisoned Host heade… | Patch early | 6.1 medium | 5.1% | 2020-12-18 |
| CVE-2007-3017 EXP | The WYSIWYG editor applet in activeWeb contentserver CMS before 5.6.2964 only filters malicious tags from articles sent to admin/applets/wysiwyg/rende… | Patch early | 4.0 medium | 5.1% | 2007-07-17 |
| CVE-2019-15092 EXP | The webtoffee "WordPress Users & WooCommerce Customers Import Export" plugin 1.3.0 for WordPress allows CSV injection in the user_url, display_name, f… | Patch early | 7.3 high | 5.1% | 2019-08-23 |
| CVE-2009-0610 EXP | Multiple static code injection vulnerabilities in post.php in Simple PHP News 1.0 final allow remote attackers to inject arbitrary PHP code into news.… | Patch early | 7.5 high | 5.1% | 2009-02-17 |
| CVE-2004-2040 EXP | Multiple cross-site scripting (XSS) vulnerabilities in e107 0.615 allow remote attackers to inject arbitrary web script or HTML via the (1) LAN_407 pa… | Patch early | 4.3 medium | 5.1% | 2004-05-29 |
| CVE-2004-2081 EXP | The samiftp.dll library in Sami FTP Server 1.1.3 allows local users to cause a denial of service (pmsystem.exe crash) by issuing (1) a CD command with… | Patch early | 5.0 medium | 5.1% | 2004-12-31 |
| CVE-2011-4024 EXP | Cross-site scripting (XSS) vulnerability in ocsinventory in OCS Inventory NG 2.0.1 and earlier allows remote attackers to inject arbitrary web script… | Patch early | 4.3 medium | 5.1% | 2011-10-21 |
| CVE-2005-0780 EXP | paFileDB 3.1 and earlier allows remote attackers to obtain sensitive information via a direct request to (1) auth.php, (2) login.php, (3) category.php… | Patch early | 5.0 medium | 5.1% | 2005-03-12 |
| CVE-2017-2447 EXP | An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. tvOS before 10.2 is affected. The issu… | Patch early | 8.1 high | 5.1% | 2017-04-02 |
| CVE-2009-1087 EXP | Multiple argument injection vulnerabilities in PPLive.exe in PPLive 1.9.21 and earlier allow remote attackers to execute arbitrary code via a UNC shar… | Patch early | 9.3 high | 5.1% | 2009-03-25 |
| CVE-2006-3009 EXP | Multiple cross-site scripting (XSS) vulnerabilities in Open Business Management (OBM) 1.0.3 pl1 allow remote attackers to inject arbitrary HTML or web… | Patch early | 5.8 medium | 5.1% | 2006-06-13 |
| CVE-2002-0336 EXP | Buffer overflow in Galacticomm Worldgroup FTP server 3.20 and earlier allows remote attackers to cause a denial of service, and possibly execute arbit… | Patch early | 7.5 high | 5.1% | 2002-06-25 |
| CVE-2000-0185 EXP | RealMedia RealServer reveals the real IP address of a Real Server, even if the address is supposed to be private. | Patch early | 5.0 medium | 5.1% | 2000-03-08 |
| CVE-2004-1100 EXP | Cross-site scripting (XSS) vulnerability in mailpost.exe in MailPost 5.1.1sv, and possibly earlier versions, when debug mode is enabled, allows remote… | Patch early | 6.8 medium | 5.1% | 2005-01-10 |
| CVE-2009-0734 EXP | Heap-based buffer overflow in MultimediaPlayer.exe 6.86.240.7 in Nokia PC Suite 6.86.9.3 allows remote attackers to execute arbitrary code via a long… | Patch early | 9.3 high | 5.1% | 2009-02-25 |
| CVE-2009-2375 EXP | Stack-based buffer overflow in Photo DVD Maker 8.02, and possibly earlier versions, allows remote attackers to execute arbitrary code via a long File_… | Patch early | 9.3 high | 5.1% | 2009-07-08 |
| CVE-2015-4591 EXP | eClinicalWorks Population Health (CCMR) suffers from a cross site scripting vulnerability in login.jsp which allows remote unauthenticated users to in… | Patch early | 6.1 medium | 5.1% | 2017-01-10 |
| CVE-2012-1790 EXP | Absolute path traversal vulnerability in Webgrind 1.0 and 1.0.2 allows remote attackers to read arbitrary files via a full pathname in the file parame… | Patch early | 5.0 medium | 5.1% | 2012-03-19 |
| CVE-2005-1782 EXP | Multiple cross-site scripting (XSS) vulnerabilities in BookReview beta 1.0 allow remote attackers to inject arbitrary web script or HTML via the node… | Patch early | 4.3 medium | 5.1% | 2005-05-26 |
| CVE-2007-0888 EXP | Directory traversal vulnerability in the TFTP server in Kiwi CatTools before 3.2.0 beta allows remote attackers to read arbitrary files, and upload fi… | Patch early | 10.0 high | 5.1% | 2007-02-12 |
| CVE-2009-2766 EXP | httpd.c in httpd in the management GUI in DD-WRT 24 sp1 does not require administrative authentication for programs under cgi-bin/, which allows remot… | Patch early | 7.5 high | 5.1% | 2009-08-14 |
| CVE-2007-4639 EXP | EnterpriseDB Advanced Server 8.2 does not properly handle certain debugging function calls that occur before a call to pldbg_create_listener, which al… | Patch early | 6.5 medium | 5.1% | 2007-08-31 |
| CVE-2006-4852 EXP | SQL injection vulnerability in browse.asp in QuadComm Q-Shop 3.5 allows remote attackers to execute arbitrary SQL commands via the OrderBy parameter. | Patch early | 7.5 high | 5.1% | 2006-09-19 |
| CVE-2009-4453 EXP | Insecure method vulnerability in SoftCab Sound Converter ActiveX control (sndConverter.ocx) 1.2 allows remote attackers to create or overwrite arbitra… | Patch early | 8.8 high | 5.1% | 2009-12-29 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt