CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
407,501 CVEs
1,741 on KEV
17,302 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-14
324,739 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2002-1452 EXP | Buffer overflow in the search capability for MyWebServer 1.0.2 allows remote attackers to execute arbitrary code via a long searchTarget parameter. | Patch early | 7.5 high | 5.1% | 2002-08-14 |
| CVE-2014-0867 EXP | rcore6/main/addcookie.jsp in RICOS in IBM Algo Credit Limits (aka ACLM) 4.5.0 through 4.7.0 before 4.7.0.03 FP5 in IBM Algorithmics allows remote atta… | Patch early | 5.8 medium | 5.1% | 2014-07-07 |
| CVE-1999-0269 EXP | Netscape Enterprise servers may list files through the PageServices query. | Patch early | 5.0 medium | 5.1% | 1998-08-01 |
| CVE-2021-24901 EXP | The Security Audit WordPress plugin through 1.0.0 does not sanitise and escape the Data Id setting, which could allow high privilege users to perform… | Patch early | 4.8 medium | 5.1% | 2022-02-28 |
| CVE-2021-24904 EXP | The Mortgage Calculators WP WordPress plugin before 1.56 does not implement any sanitisation on the color setting of the background of a calculator, w… | Patch early | 4.8 medium | 5.1% | 2022-02-14 |
| CVE-2014-7178 EXP | Enalean Tuleap before 7.5.99.6 allows remote attackers to execute arbitrary commands via the User-Agent header, which is provided to the passthru PHP… | Patch early | 9.3 high | 5.1% | 2014-11-28 |
| CVE-2019-7652 EXP | TheHive Project UnshortenLink analyzer before 1.1, included in Cortex-Analyzers before 1.15.2, has SSRF. To exploit the vulnerability, an attacker mus… | Patch early | 7.7 high | 5.1% | 2019-05-09 |
| CVE-2006-3362 EXP | Unrestricted file upload vulnerability in connectors/php/connector.php in FCKeditor mcpuk file manager, as used in (1) Geeklog 1.4.0 through 1.4.0sr3,… | Patch early | 5.1 medium | 5.1% | 2006-07-06 |
| CVE-2010-2701 EXP | Multiple buffer overflows in the FathFTP ActiveX control 1.7 allow remote attackers to execute arbitrary code via (1) the GetFromURL member or (2) a l… | Patch early | 9.3 high | 5.1% | 2010-07-12 |
| CVE-2009-2360 EXP | Cross-site scripting (XSS) vulnerability in passwd/main.php in the Passwd module before 3.1.1 for Horde allows remote attackers to inject arbitrary we… | Patch early | 4.3 medium | 5.1% | 2009-07-08 |
| CVE-2009-1646 EXP | Stack-based buffer overflow in Mini-stream RM Downloader 3.0.0.9 allows remote attackers to execute arbitrary code via a long rtsp URL in a .ram file. | Patch early | 9.3 high | 5.1% | 2009-05-15 |
| CVE-2006-7169 EXP | PHP remote file inclusion vulnerability in includes/header_simple.php in Ultimate PHP Board (UPB) 2.0 and earlier allows remote attackers to execute a… | Patch early | 6.8 medium | 5.1% | 2007-03-20 |
| CVE-2018-5759 EXP | jsparse.c in Artifex MuJS through 1.0.2 does not properly maintain the AST depth for binary expressions, which allows remote attackers to cause a deni… | Patch early | 5.5 medium | 5.1% | 2018-01-24 |
| CVE-2003-0705 EXP | Buffer overflow in mah-jong 1.5.6 and earlier allows remote attackers to execute arbitrary code. | Patch early | 7.5 high | 5.1% | 2003-09-17 |
| CVE-2005-3636 EXP | Cross-site scripting (XSS) vulnerability in SAP Web Application Server (WAS) 6.10 allows remote attackers to inject arbitrary web script or HTML via E… | Patch early | 4.3 medium | 5.1% | 2005-11-16 |
| CVE-2007-4104 EXP | Multiple cross-site scripting (XSS) vulnerabilities in the WP-FeedStats before 2.4 plugin for WordPress allow remote attackers to inject arbitrary web… | Patch early | 4.3 medium | 5.1% | 2007-07-31 |
| CVE-2008-7070 EXP | Argument injection vulnerability in the URI handler in KVIrc 3.4.2 Shiny allows remote attackers to execute arbitrary commands via a " (quote) followe… | Patch early | 9.3 high | 5.1% | 2009-08-25 |
| CVE-2008-2922 EXP | Stack-based buffer overflow in artegic Dana IRC client 1.3 and earlier allows remote attackers to cause a denial of service (application crash) or pos… | Patch early | 7.5 high | 5% | 2008-06-30 |
| CVE-2005-1470 EXP | Multiple unknown vulnerabilities in the (1) TZSP, (2) MGCP, (3) ISUP, (4) SMB, or (5) Bittorrent dissectors in Ethereal before 0.10.11 allow remote at… | Patch early | 5.0 medium | 5% | 2005-05-05 |
| CVE-2016-0079 EXP | The kernel in Microsoft Windows 10 Gold, 1511, and 1607 allows local users to gain privileges via a crafted application that makes an API call to acce… | Patch early | 5.0 medium | 5% | 2016-10-14 |
| CVE-2008-2481 EXP | PHP remote file inclusion vulnerability in authentication/phpbb3/phpbb3.functions.php in phpRaider 1.0.7 and 1.0.7a, when register_globals is enabled,… | Patch early | 10.0 high | 5% | 2008-05-28 |
| CVE-2012-1198 EXP | base_ag_main.php in Basic Analysis and Security Engine (BASE) 1.4.5 allows remote attackers to execute arbitrary code by uploading contents of the fil… | Patch early | 7.5 high | 5% | 2012-02-18 |
| CVE-2010-1003 EXP | Directory traversal vulnerability in www/editor/tiny_mce/langs/language.php in eFront 3.5.x through 3.5.5 allows remote attackers to include and execu… | Patch early | 6.8 medium | 5% | 2010-03-19 |
| CVE-2010-1174 EXP | Cisco TFTP Server 1.1 allows remote attackers to cause a denial of service (daemon crash) via a crafted (1) read (aka RRQ) or (2) write (aka WRQ) requ… | Patch early | 5.0 medium | 5% | 2010-03-29 |
| CVE-2007-1391 EXP | PHP remote file inclusion vulnerability in modules/abook/foldertree.php in Leo West WEBO (aka weborganizer) 1.0 allows remote attackers to execute arb… | Patch early | 10.0 high | 5% | 2007-03-10 |
| CVE-2006-2413 EXP | GNUnet before SVN revision 2781 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via an empty UDP datagram, po… | Patch early | 5.0 medium | 5% | 2006-05-16 |
| CVE-2002-1405 EXP | CRLF injection vulnerability in Lynx 2.8.4 and earlier allows remote attackers to inject false HTTP headers into an HTTP request that is provided on t… | Patch early | 5.0 medium | 5% | 2003-02-19 |
| CVE-2001-0486 EXP | Remote attackers can cause a denial of service in Novell BorderManager 3.6 and earlier by sending TCP SYN flood to port 353. | Patch early | 5.0 medium | 5% | 2001-07-02 |
| CVE-2014-1842 EXP | Directory traversal vulnerability in the web interface in Titan FTP Server before 10.40 build 1829 allows remote attackers to list all usernames via a… | Patch early | 5.0 medium | 5% | 2014-04-29 |
| CVE-2002-2300 EXP | Buffer overflow in ftpd 5.4 in 3Com NBX 4.0.17 or ftpd 5.4.2 in 3Com NBX 4.1.4 allows remote attackers to cause a denial of service (crash) via a long… | Patch early | 7.5 high | 5% | 2002-12-31 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt