CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
398,603 CVEs
1,728 on KEV
17,267 EPSS ≥ 10%
25,086 with exploits
synced 2026-09-28
169,054 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2009-1493 EXP | The customDictionaryOpen spell method in the JavaScript API in Adobe Reader 9.1, 8.1.4, 7.1.1, and earlier on Linux and UNIX allows remote attackers t… | Patch early | 6.8 medium | 21.8% | 2009-04-30 |
| CVE-2005-1649 EXP | The IPv6 support in Windows XP SP2, 2003 Server SP1, and Longhorn, with Windows Firewall turned off, allows remote attackers to cause a denial of serv… | Patch early | 5.0 medium | 21.8% | 2005-05-18 |
| CVE-2007-4934 EXP | Multiple PHP remote file inclusion vulnerabilities in phpFFL 1.24 allow remote attackers to execute arbitrary PHP code via a URL in the PHPFFL_FILE_RO… | Patch early | 4.6 medium | 21.7% | 2007-09-18 |
| CVE-2008-1067 EXP | Multiple PHP remote file inclusion vulnerabilities in phpQLAdmin 2.2.7 allow remote attackers to execute arbitrary PHP code via a URL in the _SESSION[… | Patch early | 6.8 medium | 21.7% | 2008-02-28 |
| CVE-1999-0999 EXP | Microsoft SQL 7.0 server allows a remote attacker to cause a denial of service via a malformed TDS packet. | Patch early | 4.3 medium | 21.7% | 1999-11-19 |
| CVE-2006-3915 EXP | Microsoft Internet Explorer 6 on Windows XP SP2 allows remote attackers to cause a denial of service (crash) by iterating over any native function, as… | Patch early | 5.0 medium | 21.6% | 2006-07-28 |
| CVE-2006-3511 EXP | Internet Explorer 6 on Windows XP SP2 allows remote attackers to cause a denial of service (crash) by setting the fonts property of the HtmlDlgSafeHel… | Patch early | 5.0 medium | 21.6% | 2006-07-11 |
| CVE-2009-3431 EXP | Stack consumption vulnerability in Adobe Reader and Acrobat 9.1.3, 9.1.2, 9.1.1, and earlier 9.x versions; 8.1.6 and earlier 8.x versions; and possibl… | Patch early | 5.0 medium | 21.6% | 2009-09-25 |
| CVE-2014-5111 EXP | Multiple directory traversal vulnerabilities in Fonality trixbox allow remote attackers to read arbitrary files via a .. (dot dot) in the lang paramet… | Patch early | 5.0 medium | 21.6% | 2014-07-28 |
| CVE-2006-2081 EXP | Oracle Database Server 10g Release 2 allows local users to execute arbitrary SQL queries via the GET_DOMAIN_INDEX_METADATA function in the DBMS_EXPORT… | Patch early | 4.6 medium | 21.6% | 2006-04-27 |
| CVE-2005-3206 EXP | iSQL*Plus (isqlplus) for Oracle9i Database Server Release 2 9.0.2.4 allows remote attackers to cause a denial of service (TNS listener stop) via an HT… | Patch early | 5.0 medium | 21.5% | 2005-10-14 |
| CVE-2008-1124 EXP | Multiple PHP remote file inclusion vulnerabilities in Podcast Generator 1.0 BETA 2 and earlier allow remote attackers to execute arbitrary PHP code vi… | Patch early | 6.8 medium | 21.5% | 2008-03-03 |
| CVE-2008-0572 EXP | Multiple PHP remote file inclusion vulnerabilities in Mindmeld 1.2.0.10 allow remote attackers to execute arbitrary PHP code via a URL in the MM_GLOBA… | Patch early | 6.8 medium | 21.5% | 2008-02-05 |
| CVE-1999-0867 EXP | Denial of service in IIS 4.0 via a flood of HTTP requests with malformed headers. | Patch early | 5.0 medium | 21.5% | 1999-08-11 |
| CVE-2010-2266 EXP | nginx 0.8.36 allows remote attackers to cause a denial of service (crash) via certain encoded directory traversal sequences that trigger memory corrup… | Patch early | 5.0 medium | 21.5% | 2010-06-15 |
| CVE-2012-3794 EXP | Pro-face WinGP PC Runtime 3.1.00 and earlier, and ProServr.exe in Pro-face Pro-Server EX 1.30.000 and earlier, allows remote attackers to cause a deni… | Patch early | 5.0 medium | 21.5% | 2012-06-25 |
| CVE-2009-2146 EXP | Unrestricted file upload vulnerability in the Compose Email feature in the Emails module in Sugar Community Edition (aka SugarCRM) before 5.2f allows… | Patch early | 6.0 medium | 21.5% | 2009-06-22 |
| CVE-2011-0959 EXP | Multiple cross-site scripting (XSS) vulnerabilities in Cisco Unified Operations Manager (CUOM) before 8.6 allow remote attackers to inject arbitrary w… | Patch early | 4.3 medium | 21.5% | 2011-05-20 |
| CVE-2008-5745 EXP | Integer overflow in quartz.dll in the DirectShow framework in Microsoft Windows Media Player (WMP) 9, 10, and 11, including 11.0.5721.5260, allows rem… | Patch early | 4.3 medium | 21.4% | 2008-12-29 |
| CVE-2008-1046 EXP | PHP remote file inclusion vulnerability in footer.php in Quinsonnas Mail Checker 1.55 allows remote attackers to execute arbitrary PHP code via a URL… | Patch early | 6.8 medium | 21.4% | 2008-02-27 |
| CVE-2008-1051 EXP | PHP remote file inclusion vulnerability in include/body_comm.inc.php in phpProfiles 4.5.2 BETA allows remote attackers to execute arbitrary PHP code v… | Patch early | 6.8 medium | 21.4% | 2008-02-27 |
| CVE-2008-5750 EXP | Argument injection vulnerability in Microsoft Internet Explorer 8 beta 2 on Windows XP SP3 allows remote attackers to execute arbitrary commands via t… | Patch early | 6.8 medium | 21.4% | 2008-12-29 |
| CVE-1999-0288 EXP | The WINS server in Microsoft Windows NT 4.0 before SP4 allows remote attackers to cause a denial of service (process termination) via invalid UDP fram… | Patch early | 5.0 medium | 21.3% | 1998-08-01 |
| CVE-2000-0211 EXP | The Windows Media server allows remote attackers to cause a denial of service via a series of client handshake packets that are sent in an improper se… | Patch early | 5.0 medium | 21.3% | 2000-02-23 |
| CVE-2003-0540 EXP | The address parser code in Postfix 1.1.12 and earlier allows remote attackers to cause a denial of service (lock) via (1) a malformed envelope address… | Patch early | 5.0 medium | 21.3% | 2003-08-27 |
| CVE-2014-5383 EXP | SQL injection vulnerability in AlienVault OSSIM before 4.7.0 allows remote authenticated users to execute arbitrary SQL commands via unspecified vecto… | Patch early | 6.5 medium | 21.2% | 2014-08-21 |
| CVE-2019-9955 EXP | On Zyxel ATP200, ATP500, ATP800, USG20-VPN, USG20W-VPN, USG40, USG40W, USG60, USG60W, USG110, USG210, USG310, USG1100, USG1900, USG2200-VPN, ZyWALL 11… | Patch early | 6.1 medium | 21.2% | 2019-04-22 |
| CVE-2022-47874 EXP | Improper Access Control in /tc/rpc in Jedox GmbH Jedox 2020.2.5 allows remote authenticated users to view details of database connections via class 'c… | Patch early | 6.5 medium | 21.1% | 2023-05-02 |
| CVE-2002-0201 EXP | Cyberstop Web Server for Windows 0.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long HTTP… | Patch early | 5.0 medium | 21.1% | 2002-05-16 |
| CVE-2011-4362 EXP | Integer signedness error in the base64_decode function in the HTTP authentication functionality (http_auth.c) in lighttpd 1.4 before 1.4.30 and 1.5 be… | Patch early | 5.0 medium | 21.1% | 2011-12-24 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt