CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
407,501 CVEs
1,741 on KEV
17,302 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-14
324,739 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2016-7617 EXP | An issue was discovered in certain Apple products. macOS before 10.12.2 is affected. The issue involves the "Bluetooth" component. It allows attackers… | Patch early | 7.8 high | 5.1% | 2017-02-20 |
| CVE-2019-1476 EXP | An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows Elevation of… | Patch early | 7.8 high | 5.1% | 2019-12-10 |
| CVE-2019-12788 EXP | An issue was discovered in Photodex ProShow Producer v9.0.3797 (an application that runs with Administrator privileges). It is possible to perform a b… | Patch early | 7.8 high | 5.1% | 2019-06-10 |
| CVE-2005-2564 EXP | Direct static code injection vulnerability in editcss.php in Gravity Board X (GBX) 1.1 allows remote attackers to execute arbitrary PHP code, HTML, an… | Patch early | 7.5 high | 5.1% | 2005-08-16 |
| CVE-2010-1226 EXP | The HTTP client functionality in Apple iPhone OS 3.1 on the iPhone 2G and 3.1.3 on the iPhone 3GS allows remote attackers to cause a denial of service… | Patch early | 5.0 medium | 5.1% | 2010-04-01 |
| CVE-2007-1050 EXP | Multiple cross-site scripting (XSS) vulnerabilities in index.php in AbleDesign MyCalendar allow remote attackers to inject arbitrary web script or HTM… | Patch early | 4.3 medium | 5.1% | 2007-02-21 |
| CVE-2005-1030 EXP | Multiple cross-site scripting (XSS) vulnerabilities in Active Auction House allow remote attackers to inject arbitrary web script or HTML via the (1)… | Patch early | 4.3 medium | 5.1% | 2005-05-02 |
| CVE-2022-39285 EXP | ZoneMinder is a free, open source Closed-circuit television software application The file parameter is vulnerable to a cross site scripting vulnerabil… | Patch early | 7.6 high | 5.1% | 2022-10-07 |
| CVE-2015-5889 EXP | rsh in the remote_cmds component in Apple OS X before 10.11 allows local users to obtain root privileges via vectors involving environment variables. | Patch early | 7.2 high | 5.1% | 2015-10-09 |
| CVE-2007-2189 EXP | PHP remote file inclusion vulnerability in admin/admin_album_otf.php in the MX Smartor Full Album Pack (FAP) 2.0 RC1 module for mxBB allows remote att… | Patch early | 6.8 medium | 5.1% | 2007-04-24 |
| CVE-2008-0068 EXP | Directory traversal vulnerability in OpenView5.exe in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allows remote attackers to read a… | Patch early | 5.0 medium | 5.1% | 2008-04-16 |
| CVE-2001-0390 EXP | IBM Websphere/NetCommerce3 3.1.2 allows remote attackers to cause a denial of service by directly calling the macro.d2w macro with a long string of %0… | Patch early | 5.0 medium | 5.1% | 2001-07-02 |
| CVE-2001-0688 EXP | Broker FTP Server 5.9.5.0 allows a remote attacker to cause a denial of service by repeatedly issuing an invalid CD or CWD ("CD . .") command. | Patch early | 5.0 medium | 5.1% | 2001-09-20 |
| CVE-2009-4171 EXP | An ActiveX control in YahooBridgeLib.dll for Yahoo! Messenger 9.0.0.2162, and possibly other 9.0 versions, allows remote attackers to cause a denial o… | Patch early | 4.3 medium | 5.1% | 2009-12-02 |
| CVE-2009-3577 EXP | Autodesk 3D Studio Max (3DSMax) 6 through 9 and 2008 through 2010 allows remote attackers to execute arbitrary code via a .max file with a MAXScript s… | Patch early | 9.3 high | 5.1% | 2009-11-24 |
| CVE-2016-3989 EXP | The NTP time-server interface on Meinberg IMS-LANTIME M3000, IMS-LANTIME M1000, IMS-LANTIME M500, LANTIME M900, LANTIME M600, LANTIME M400, LANTIME M3… | Patch early | 8.1 high | 5.1% | 2016-07-03 |
| CVE-2017-3629 EXP | Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Kernel). Supported versions that are affected are 10 and 11… | Patch early | 7.8 high | 5.1% | 2017-06-22 |
| CVE-2012-2104 EXP | cgi-bin/munin-cgi-graph in Munin 2.x writes data to a log file without sanitizing non-printable characters, which might allow user-assisted remote att… | Patch early | 6.8 medium | 5.1% | 2012-08-26 |
| CVE-2005-3818 EXP | Multiple cross-site scripting (XSS) vulnerabilities in vTiger CRM 4.2 and earlier allow remote attackers to inject arbitrary web script or HTML via (1… | Patch early | 4.3 medium | 5.1% | 2005-11-26 |
| CVE-2005-2804 EXP | Integer overflow in the registry parsing code in GroupWise 6.5.3, and possibly earlier version, allows remote attackers to cause a denial of service (… | Patch early | 5.0 medium | 5.1% | 2005-10-04 |
| CVE-2007-5693 EXP | Eval injection vulnerability in the translation module (translator.php) in SiteBar 3.3.8 allows remote authenticated users to execute arbitrary PHP co… | Patch early | 6.0 medium | 5.1% | 2007-10-29 |
| CVE-2011-1547 EXP | Multiple stack consumption vulnerabilities in the kernel in NetBSD 4.0, 5.0 before 5.0.3, and 5.1 before 5.1.1, when IPsec is enabled, allow remote at… | Patch early | 6.8 medium | 5.1% | 2011-05-09 |
| CVE-2012-5452 EXP | Multiple cross-site scripting (XSS) vulnerabilities in Subrion CMS 2.2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) mul… | Patch early | 4.3 medium | 5.1% | 2012-10-22 |
| CVE-2009-1422 EXP | Unspecified vulnerability in HP ProCurve Threat Management Services zl Module (J9155A) ST.1.0.090213 and earlier allows remote attackers to gain privi… | Patch early | 10.0 high | 5.1% | 2009-07-14 |
| CVE-2017-11322 EXP | The chroothole_client executable in UCOPIA Wireless Appliance before 5.1.8 allows remote attackers to gain root privileges via a dollar sign ($) metac… | Patch early | 8.2 high | 5.1% | 2017-10-03 |
| CVE-2005-2651 EXP | gorum/prod.php in Zorum 3.5 allows remote attackers to execute arbitrary code via shell metacharacters in the argv parameter. | Patch early | 7.5 high | 5.1% | 2005-08-23 |
| CVE-2021-27889 EXP | Cross-site Scripting (XSS) vulnerability in MyBB before 1.8.26 via Nested Auto URL when parsing messages. | Patch early | 6.1 medium | 5.1% | 2021-03-15 |
| CVE-2008-0192 EXP | Multiple cross-site scripting (XSS) vulnerabilities in WordPress 2.0.9 and earlier allow remote attackers to inject arbitrary web script or HTML via t… | Patch early | 4.3 medium | 5.1% | 2008-01-10 |
| CVE-2013-4883 EXP | Multiple cross-site scripting (XSS) vulnerabilities in McAfee ePolicy Orchestrator 4.6.6 and earlier, and the ePO Extension for the McAfee Agent (MA)… | Patch early | 4.3 medium | 5.1% | 2013-07-22 |
| CVE-2004-0733 EXP | Format string vulnerability in OllyDbg 1.10 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via forma… | Patch early | 7.5 high | 5.1% | 2004-07-27 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt