CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
407,543 CVEs
1,741 on KEV
17,302 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-14
324,767 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2017-7938 EXP | Stack-based buffer overflow in DMitry (Deepmagic Information Gathering Tool) version 1.3a (Unix) allows attackers to cause a denial of service (applic… | Patch early | 6.6 medium | 5% | 2017-04-20 |
| CVE-2013-5676 EXP | The Jenkins Plugin for SonarQube 3.7 and earlier allows remote authenticated users to obtain sensitive information (cleartext passwords) by reading th… | Patch early | 4.0 medium | 5% | 2013-12-13 |
| CVE-2022-37255 EXP | TP-Link Tapo C310 1.3.0 devices allow access to the RTSP video feed via credentials of User --- and Password TPL075526460603. | Patch early | 7.5 high | 5% | 2023-04-16 |
| CVE-2014-0865 EXP | RICOS in IBM Algo Credit Limits (aka ACLM) 4.5.0 through 4.7.0 before 4.7.0.03 FP5 in IBM Algorithmics relies on client-side input validation, which a… | Patch early | 4.9 medium | 5% | 2014-07-07 |
| CVE-2019-15742 EXP | A local privilege-escalation vulnerability exists in the Poly Plantronics Hub before 3.14 for Windows client application. A local attacker can exploit… | Patch early | 7.8 high | 5% | 2020-01-17 |
| CVE-2010-3695 EXP | Cross-site scripting (XSS) vulnerability in fetchmailprefs.php in Horde IMP before 4.3.8, and Horde Groupware Webmail Edition before 1.2.7, allows rem… | Patch early | 4.3 medium | 5% | 2011-03-31 |
| CVE-2006-4865 EXP | Walter Beschmout PhpQuiz allows remote attackers to obtain sensitive information via a direct request to cfgphpquiz/install.php and other unspecified… | Patch early | 5.0 medium | 5% | 2006-09-19 |
| CVE-2006-3748 EXP | PHP remote file inclusion vulnerability in includes/abbc/abbc.class.php in the LoudMouth Component for Mambo 4.0j, and possibly other versions includi… | Patch early | 6.8 medium | 5% | 2006-07-21 |
| CVE-2010-2129 EXP | Directory traversal vulnerability in the JE Ajax Event Calendar (com_jeajaxeventcalendar) component 1.0.1 and 1.0.3 for Joomla! allows remote attacker… | Patch early | 6.8 medium | 5% | 2010-06-01 |
| CVE-2004-0591 EXP | Cross-site scripting (XSS) vulnerability in the print_header_uc function for SqWebMail 4.0.4 and earlier, and possibly 3.x, allows remote attackers to… | Patch early | 6.8 medium | 5% | 2004-08-06 |
| CVE-2022-42953 EXP | Certain ZKTeco products (ZEM500-510-560-760, ZEM600-800, ZEM720, ZMM) allow access to sensitive information via direct requests for the form/DataApp?s… | Patch early | 7.5 high | 5% | 2022-12-25 |
| CVE-2007-1020 EXP | Cross-site scripting (XSS) vulnerability in index.php in CedStat 1.31 allows remote attackers to inject arbitrary web script or HTML via the hier para… | Patch early | 6.8 medium | 5% | 2007-02-21 |
| CVE-2001-0296 EXP | Buffer overflow in WFTPD Pro 3.00 allows remote attackers to execute arbitrary commands via a long CWD command. | Patch early | 10.0 high | 5% | 2001-05-03 |
| CVE-2005-1380 EXP | Cross-site scripting (XSS) vulnerability in BEA Admin Console 8.1 allows remote attackers to execute arbitrary web script or HTML via the server param… | Patch early | 6.8 medium | 5% | 2005-05-03 |
| CVE-2003-0805 EXP | Multiple buffer overflows in UMN gopher daemon (gopherd) 2.x and 3.x before 3.0.6 allows attackers to execute arbitrary code via (1) a long filename a… | Patch early | 7.5 high | 5% | 2003-10-06 |
| CVE-2006-4608 EXP | Multiple cross-site scripting (XSS) vulnerabilities in Longino Jacome php-Revista 1.1.2 allow remote attackers to inject arbitrary web script or HTML… | Patch early | 6.8 medium | 5% | 2006-09-07 |
| CVE-2006-4794 EXP | Multiple cross-site scripting (XSS) vulnerabilities in e107 0.7.5 allow remote attackers to inject arbitrary web script or HTML via the query string (… | Patch early | 4.3 medium | 5% | 2006-09-14 |
| CVE-2019-6498 EXP | GattLib 0.2 has a stack-based buffer over-read in gattlib_connect in dbus/gattlib.c because strncpy is misused. | Patch early | 8.8 high | 5% | 2019-01-21 |
| CVE-2003-0835 EXP | Multiple buffer overflows in asf_http_request of MPlayer before 0.92 allows remote attackers to execute arbitrary code via an ASX header with a long h… | Patch early | 7.5 high | 5% | 2003-11-17 |
| CVE-2002-0276 EXP | Buffer overflow in various decoders in Ettercap 0.6.3.1 and earlier, when running on networks with an MTU greater than 2000, allows remote attackers t… | Patch early | 7.5 high | 5% | 2002-05-31 |
| CVE-2008-6253 EXP | Directory traversal vulnerability in data/inc/lib/pcltar.lib.php in Pluck 4.5.3, when register_globals is enabled, allows remote attackers to include… | Patch early | 6.8 medium | 5% | 2009-02-24 |
| CVE-2007-3060 EXP | Multiple cross-site scripting (XSS) vulnerabilities in PHP Live! 3.2.2 allow remote attackers to inject arbitrary web script or HTML via the (1) sid p… | Patch early | 4.3 medium | 5% | 2007-06-06 |
| CVE-2021-28242 EXP | SQL Injection in the "evoadm.php" component of b2evolution v7.2.2-stable allows remote attackers to obtain sensitive database information by injecting… | Patch early | 8.8 high | 5% | 2021-04-15 |
| CVE-2019-13623 EXP | In NSA Ghidra before 9.1, path traversal can occur in RestoreTask.java (from the package ghidra.app.plugin.core.archive) via an archive with an execut… | Patch early | 7.8 high | 5% | 2019-07-17 |
| CVE-2013-4868 EXP | Karotz API 12.07.19.00: Session Token Information Disclosure | Patch early | 5.3 medium | 5% | 2019-12-27 |
| CVE-2017-0300 EXP | The kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Go… | Patch early | 5.0 medium | 5% | 2017-06-15 |
| CVE-2007-6103 EXP | I Hear U (IHU) 0.5.6 and earlier allows remote attackers to cause (1) a denial of service (infinite loop) via a packet that contains zero in the size… | Patch early | 5.0 medium | 5% | 2007-11-23 |
| CVE-2005-0671 EXP | Format string vulnerability in Carsten's 3D Engine (Ca3DE), March 2004 version and earlier, allows remote attackers to execute arbitrary code via form… | Patch early | 7.5 high | 5% | 2005-03-03 |
| CVE-2017-0100 EXP | A DCOM object in Helppane.exe in Microsoft Windows 7 SP1; Windows Server 2008 R2; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; Window… | Patch early | 7.8 high | 5% | 2017-03-17 |
| CVE-2007-1702 EXP | PHP remote file inclusion vulnerability in mod_flatmenu.php in the Flatmenu 1.07 and earlier Mambo module allows remote attackers to execute arbitrary… | Patch early | 6.8 medium | 5% | 2007-03-27 |
← previous page 334 of 334
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt