CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
407,516 CVEs
1,741 on KEV
17,302 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-14
324,751 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2005-3635 EXP | Multiple cross-site scripting (XSS) vulnerabilities in SAP Web Application Server (WAS) 6.10 through 7.00 allow remote attackers to inject arbitrary w… | Patch early | 4.3 medium | 5% | 2005-11-16 |
| CVE-2007-1416 EXP | PHP remote file inclusion vulnerability in createurl.php in JCcorp (aka James Coyle) URLshrink allows remote attackers to execute arbitrary PHP code v… | Patch early | 10.0 high | 5% | 2007-03-12 |
| CVE-2017-13847 EXP | An issue was discovered in certain Apple products. iOS before 11.2 is affected. macOS before 10.13.2 is affected. The issue involves the "IOKit" compo… | Patch early | 7.8 high | 5% | 2017-12-25 |
| CVE-2017-12950 EXP | The gig::Region::Region function in gig.cpp in libgig 4.0.0 allows remote attackers to cause a denial of service (NULL pointer dereference and applica… | Patch early | 6.5 medium | 5% | 2017-08-28 |
| CVE-2012-6622 EXP | Multiple cross-site scripting (XSS) vulnerabilities in fs-admin/fs-admin.php in the ForumPress WP Forum Server plugin before 1.7.4 for WordPress allow… | Patch early | 4.3 medium | 5% | 2014-01-16 |
| CVE-2009-3863 EXP | Buffer overflow in the gxmim1.dll ActiveX control in Novell Groupwise Client 7.0.3.1294 allows remote attackers to cause a denial of service (applicat… | Patch early | 5.0 medium | 5% | 2009-11-04 |
| CVE-2014-9173 EXP | SQL injection vulnerability in view.php in the Google Doc Embedder plugin before 2.5.15 for WordPress allows remote attackers to execute arbitrary SQL… | Patch early | 7.5 high | 5% | 2014-12-02 |
| CVE-2011-1047 EXP | Multiple SQL injection vulnerabilities in VastHTML Forum Server (aka ForumPress) plugin 1.6.1 and 1.6.5 for WordPress allow remote attackers to execut… | Patch early | 7.5 high | 5% | 2011-02-21 |
| CVE-2007-1195 EXP | Multiple buffer overflows in XM Easy Personal FTP Server 5.3.0 allow remote attackers to execute arbitrary code via unspecified vectors. NOTE: this is… | Patch early | 7.5 high | 5% | 2007-03-02 |
| CVE-2014-9097 EXP | Multiple SQL injection vulnerabilities in the Apptha WordPress Video Gallery (contus-video-gallery) plugin 2.5, possibly as distributed before 2014-07… | Patch early | 7.5 high | 5% | 2014-11-26 |
| CVE-2014-8358 EXP | Huawei EC156, EC176, and EC177 USB Modem products with software before UTPS-V200R003B015D02SP07C1014 (23.015.02.07.1014) and before V200R003B015D02SP0… | Patch early | 7.8 high | 5% | 2017-12-11 |
| CVE-2007-4377 EXP | Stack-based buffer overflow in the IMAP service in SurgeMail 38k allows remote authenticated users to execute arbitrary code via a long argument to th… | Patch early | 6.0 medium | 5% | 2007-08-16 |
| CVE-2007-0172 EXP | Multiple PHP remote file inclusion vulnerabilities in AllMyGuests 0.3.0 and earlier allow remote attackers to execute arbitrary PHP code via a URL in… | Patch early | 7.5 high | 5% | 2007-01-11 |
| CVE-2004-1719 EXP | Multiple cross-site scripting (XSS) vulnerabilities in Merak Webmail Server 5.2.7 allow remote attackers to inject arbitrary web script or HTML via th… | Patch early | 4.3 medium | 5% | 2004-08-17 |
| CVE-2007-0368 EXP | Stack-based buffer overflow in mbse-bbs 0.70 and earlier allows local users to execute arbitrary code via a long string in the MBSE_ROOT environment v… | Patch early | 10.0 high | 5% | 2007-01-19 |
| CVE-2006-4359 EXP | Stack-based buffer overflow in Trident Software PowerZip 7.06 Build 3895 on Windows 2000 allows remote attackers to execute arbitrary code via a ZIP a… | Patch early | 5.1 medium | 5% | 2006-08-27 |
| CVE-2007-1628 EXP | Multiple PHP remote file inclusion vulnerabilities in Study planner (Studiewijzer) 0.15 and earlier, when register_globals is enabled, allow remote at… | Patch early | 9.3 high | 5% | 2007-03-23 |
| CVE-2005-1873 EXP | Multiple buffer overflows in Crob FTP 3.6.1, and possibly earlier versions, allow remote attackers to execute arbitrary code via (1) an FTP command wi… | Patch early | 7.5 high | 5% | 2005-06-09 |
| CVE-2002-1891 EXP | Buffer overflow in IRCIT 0.3.1 IRC client allows remote attackers to execute arbitrary code via a long invite request. | Patch early | 7.5 high | 5% | 2002-12-31 |
| CVE-2000-0523 EXP | Buffer overflow in the logging feature of EServ 2.9.2 and earlier allows an attacker to execute arbitrary commands via a long MKD command. | Patch early | 10.0 high | 5% | 2000-06-06 |
| CVE-2008-4626 EXP | Directory traversal vulnerability in index.php in Fritz Berger yet another php photo album - next generation (yappa-ng) 2.3.2 and possibly other versi… | Patch early | 6.8 medium | 5% | 2008-10-21 |
| CVE-2016-1767 EXP | QuickTime in Apple OS X before 10.11.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafte… | Patch early | 7.8 high | 5% | 2016-03-24 |
| CVE-2016-1769 EXP | QuickTime in Apple OS X before 10.11.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafte… | Patch early | 7.8 high | 5% | 2016-03-24 |
| CVE-2003-1136 EXP | Cross-site scripting (XSS) vulnerability in Chi Kien Uong Guestbook 1.51 allows remote attackers to inject arbitrary web script or HTML via (1) HTML i… | Patch early | 4.3 medium | 5% | 2003-10-23 |
| CVE-2008-1304 EXP | Multiple cross-site scripting (XSS) vulnerabilities in WordPress 2.3.2 allow remote attackers to inject arbitrary web script or HTML via the (1) invit… | Patch early | 4.3 medium | 5% | 2008-03-12 |
| CVE-2006-4553 EXP | PHP remote file inclusion vulnerability in plugin.class.php in the com_comprofiler Components 1.0 RC2 for Mambo and Joomla! allows remote attackers to… | Patch early | 6.8 medium | 5% | 2006-09-06 |
| CVE-2012-3808 EXP | Samsung Kies before 2.5.0.12094_27_11 has arbitrary file modification. | Patch early | 7.5 high | 5% | 2020-01-09 |
| CVE-2012-3809 EXP | Samsung Kies before 2.5.0.12094_27_11 has arbitrary directory modification. | Patch early | 7.5 high | 5% | 2020-01-09 |
| CVE-2012-3810 EXP | Samsung Kies before 2.5.0.12094_27_11 has registry modification. | Patch early | 7.5 high | 5% | 2020-01-09 |
| CVE-2026-29053 EXP | Ghost is a Node.js content management system. From version 0.7.2 to 6.19.0, specifically crafted malicious themes can execute arbitrary code on the se… | Patch early | 7.6 high | 5% | 2026-03-05 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt