CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
398,603 CVEs
1,728 on KEV
17,267 EPSS ≥ 10%
25,086 with exploits
synced 2026-09-28
169,057 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-1999-0153 EXP | Windows 95/NT out of band (OOB) data denial of service through NETBIOS port, aka WinNuke. | Patch early | 5.0 medium | 21.1% | 1997-07-01 |
| CVE-2006-5647 EXP | Sophos Anti-Virus and Endpoint Security before 6.0.5, Anti-Virus for Linux before 5.0.10, and other platforms before 4.11 allows remote attackers to c… | Patch early | 6.4 medium | 21.1% | 2006-11-01 |
| CVE-2010-3274 EXP | Multiple cross-site scripting (XSS) vulnerabilities in EmployeeSearch.cc in the Employee Search Engine in ZOHO ManageEngine ADSelfService Plus before… | Patch early | 4.3 medium | 21% | 2011-02-17 |
| CVE-2010-2265 EXP | Cross-site scripting (XSS) vulnerability in the GetServerName function in sysinfo/commonFunc.js in Microsoft Windows Help and Support Center for Windo… | Patch early | 4.3 medium | 21% | 2010-06-15 |
| CVE-2011-4804 EXP | Directory traversal vulnerability in the obSuggest (com_obsuggest) component before 1.8 for Joomla! allows remote attackers to read arbitrary files vi… | Patch early | 5.0 medium | 21% | 2011-12-14 |
| CVE-2006-1490 EXP | PHP before 5.1.3-RC1 might allow remote attackers to obtain portions of memory via crafted binary data sent to a script that processes user input in t… | Patch early | 5.0 medium | 21% | 2006-03-29 |
| CVE-2021-46387 EXP | ZyXEL ZyWALL 2 Plus Internet Security Appliance is affected by Cross Site Scripting (XSS). Insecure URI handling leads to bypass security restriction… | Patch early | 6.1 medium | 21% | 2022-03-01 |
| CVE-2001-0322 EXP | MSHTML.DLL HTML parser in Internet Explorer 4.0, and other versions, allows remote attackers to cause a denial of service (application crash) via a sc… | Patch early | 5.0 medium | 21% | 2001-06-02 |
| CVE-2014-1777 EXP | Microsoft Internet Explorer 10 and 11 allows remote attackers to read local files on the client via a crafted web site, aka "Internet Explorer Informa… | Patch early | 4.3 medium | 21% | 2014-06-11 |
| CVE-2013-2113 EXP | The create method in app/controllers/users_controller.rb in Foreman before 1.2.0-RC2 allows remote authenticated users with permissions to create or e… | Patch early | 6.0 medium | 20.9% | 2013-07-31 |
| CVE-2019-6110 EXP | In OpenSSH 7.9, due to accepting and displaying arbitrary stderr output from the server, a malicious server (or Man-in-The-Middle attacker) can manipu… | Patch early | 6.8 medium | 20.9% | 2019-01-31 |
| CVE-2015-1579 EXP | Directory traversal vulnerability in the Elegant Themes Divi theme for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in… | Patch early | 5.0 medium | 20.9% | 2015-02-11 |
| CVE-2006-3655 EXP | Unspecified vulnerability in mso.dll in Microsoft PowerPoint 2003 allows user-assisted attackers to execute arbitrary code via a crafted PowerPoint fi… | Patch early | 5.1 medium | 20.9% | 2006-07-18 |
| CVE-2006-7065 EXP | Microsoft Internet Explorer allows remote attackers to cause a denial of service (crash) via an IFRAME with a certain XML file and XSL stylesheet that… | Patch early | 5.0 medium | 20.9% | 2007-03-02 |
| CVE-2023-0830 EXP | A vulnerability classified as critical has been found in EasyNAS 1.1.0. Affected is the function system of the file /backup.pl. The manipulation leads… | Patch early | 6.3 medium | 20.9% | 2023-02-14 |
| CVE-2014-2908 EXP | Cross-site scripting (XSS) vulnerability in the integrated web server on Siemens SIMATIC S7-1200 CPU devices 2.x and 3.x allows remote attackers to in… | Patch early | 4.3 medium | 20.9% | 2014-04-25 |
| CVE-2012-5612 EXP | Heap-based buffer overflow in Oracle MySQL 5.5.19 and other versions through 5.5.28, and MariaDB 5.5.28a and possibly other versions, allows remote au… | Patch early | 6.5 medium | 20.8% | 2012-12-03 |
| CVE-2011-1976 EXP | Cross-site scripting (XSS) vulnerability in the Report Viewer Control in Microsoft Visual Studio 2005 SP1 and Report Viewer 2005 SP1 allows remote att… | Patch early | 4.3 medium | 20.8% | 2011-08-10 |
| CVE-2000-0465 EXP | Internet Explorer 4.x and 5.x does not properly verify the domain of a frame within a browser window, which allows a remote attacker to read client f… | Patch early | 5.1 medium | 20.8% | 2000-05-17 |
| CVE-2006-3471 EXP | Microsoft Internet Explorer 6 on Windows XP allows remote attackers to cause a denial of service (crash) via a table with a frameset as a child, which… | Patch early | 5.0 medium | 20.8% | 2006-07-10 |
| CVE-2010-1305 EXP | Directory traversal vulnerability in jinventory.php in the JInventory (com_jinventory) component 1.23.02 and possibly other versions before 1.26.03, a… | Patch early | 5.0 medium | 20.7% | 2010-04-08 |
| CVE-2005-3204 EXP | Cross-site scripting (XSS) vulnerability in Oracle XML DB 9iR2 allows remote attackers to inject arbitrary web script or HTML via the query string in… | Patch early | 4.3 medium | 20.7% | 2005-10-14 |
| CVE-2000-0073 EXP | Buffer overflow in Microsoft Rich Text Format (RTF) reader allows attackers to cause a denial of service via a malformed control word. | Patch early | 5.0 medium | 20.7% | 1999-11-17 |
| CVE-2006-2914 EXP | PHP remote file inclusion vulnerability in DeluxeBB 1.06 allows remote attackers to execute arbitrary code via a URL in the templatefolder parameter t… | Patch early | 5.1 medium | 20.7% | 2006-06-23 |
| CVE-2000-0105 EXP | Outlook Express 5.01 and Internet Explorer 5.01 allow remote attackers to view a user's email messages via a script that accesses a variable that refe… | Patch early | 5.0 medium | 20.7% | 2000-02-01 |
| CVE-2019-0186 EXP | The input fields of the Apache Pluto "Chat Room" demo portlet 3.0.0 and 3.0.1 are vulnerable to Cross-Site Scripting (XSS) attacks. Mitigation: * Unin… | Patch early | 6.1 medium | 20.6% | 2019-04-26 |
| CVE-2014-9734 EXP | Directory traversal vulnerability in the Slider Revolution (revslider) plugin before 4.2 for WordPress allows remote attackers to read arbitrary files… | Patch early | 5.0 medium | 20.6% | 2015-06-30 |
| CVE-2000-0983 EXP | Microsoft NetMeeting with Remote Desktop Sharing enabled allows remote attackers to cause a denial of service (CPU utilization) via a sequence of null… | Patch early | 5.0 medium | 20.6% | 2000-12-19 |
| CVE-2019-14312 EXP | Aptana Jaxer 1.0.3.4547 is vulnerable to a local file inclusion vulnerability in the wikilite source code viewer. This vulnerability allows a remote a… | Patch early | 6.5 medium | 20.6% | 2019-08-09 |
| CVE-2002-2031 EXP | Internet Explorer 5.0, 5.0.1 and 5.5 with JavaScript execution enabled allows remote attackers to determine the existence of arbitrary files via a scr… | Patch early | 5.0 medium | 20.5% | 2002-12-31 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt