CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
398,612 CVEs
1,728 on KEV
17,267 EPSS ≥ 10%
25,086 with exploits
synced 2026-09-28
169,072 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-1999-1578 EXP | Buffer overflow in Registration Wizard ActiveX control (regwizc.dll, InvokeRegWizard) 3.0.0.0 for Internet Explorer 4.01 and 5 allows remote attackers… | Patch early | 5.1 medium | 19.4% | 1999-09-24 |
| CVE-2002-1714 EXP | Microsoft Internet Explorer 5.0 through 6.0 allows remote attackers to cause a denial of service (crash) via an object of type "text/html" with the DA… | Patch early | 5.0 medium | 19.4% | 2002-12-31 |
| CVE-2006-2297 EXP | Heap-based buffer overflow in Microsoft Infotech Storage System Library (itss.dll) allows user-assisted attackers to execute arbitrary code via a craf… | Patch early | 4.0 medium | 19.4% | 2006-05-10 |
| CVE-2016-3116 EXP | CRLF injection vulnerability in Dropbear SSH before 2016.72 allows remote authenticated users to bypass intended shell-command restrictions via crafte… | Patch early | 6.4 medium | 19.3% | 2016-03-22 |
| CVE-2014-4940 EXP | Multiple directory traversal vulnerabilities in Tera Charts (tera-charts) plugin 0.1 for WordPress allow remote attackers to read arbitrary files via… | Patch early | 5.0 medium | 19.3% | 2014-07-11 |
| CVE-2000-0377 EXP | The Remote Registry server in Windows NT 4.0 allows local authenticated users to cause a denial of service via a malformed request, which causes the w… | Patch early | 5.0 medium | 19.2% | 2000-06-08 |
| CVE-2010-1657 EXP | Directory traversal vulnerability in the SmartSite (com_smartsite) component 1.0.0 for Joomla! allows remote attackers to read arbitrary files via a .… | Patch early | 5.0 medium | 19.2% | 2010-05-03 |
| CVE-2019-12616 EXP | An issue was discovered in phpMyAdmin before 4.9.0. A vulnerability was found that allows an attacker to trigger a CSRF attack against a phpMyAdmin us… | Patch early | 6.5 medium | 19.2% | 2019-06-05 |
| CVE-2011-3182 EXP | PHP before 5.3.7 does not properly check the return values of the malloc, calloc, and realloc library functions, which allows context-dependent attack… | Patch early | 5.0 medium | 19.2% | 2011-08-25 |
| CVE-1999-0386 EXP | Microsoft Personal Web Server and FrontPage Personal Web Server in some Windows systems allows a remote attacker to read files on the server by using… | Patch early | 5.0 medium | 19.1% | 1999-03-01 |
| CVE-2019-16516 EXP | An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. There is a user enumeration vulnerability, allowing… | Patch early | 5.3 medium | 19.1% | 2020-01-23 |
| CVE-2006-0187 EXP | By design, Microsoft Visual Studio 2005 automatically executes code in the Load event of a user-defined control (UserControl1_Load function), which al… | Patch early | 5.1 medium | 19.1% | 2006-01-12 |
| CVE-2006-4343 EXP | The get_server_hello function in the SSLv2 client code in OpenSSL 0.9.7 before 0.9.7l, 0.9.8 before 0.9.8d, and earlier versions allows remote servers… | Patch early | 4.3 medium | 19.1% | 2006-09-28 |
| CVE-2011-3833 EXP | Unrestricted file upload vulnerability in ftp_upload_file.php in Support Incident Tracker (aka SiT!) 3.65 allows remote authenticated users to execute… | Patch early | 6.0 medium | 19% | 2012-01-29 |
| CVE-2015-2153 EXP | The rpki_rtr_pdu_print function in print-rpki-rtr.c in the TCP printer in tcpdump before 4.7.2 allows remote attackers to cause a denial of service (o… | Patch early | 5.0 medium | 19% | 2015-03-24 |
| CVE-2014-8272 EXP | The IPMI 1.5 functionality in Dell iDRAC6 modular before 3.65, iDRAC6 monolithic before 1.98, and iDRAC7 before 1.57.57 does not properly select sessi… | Patch early | 5.0 medium | 19% | 2014-12-19 |
| CVE-2015-4414 EXP | Directory traversal vulnerability in download_audio.php in the SE HTML5 Album Audio Player (se-html5-album-audio-player) plugin 1.1.0 and earlier for… | Patch early | 5.0 medium | 19% | 2015-06-17 |
| CVE-2009-2433 EXP | Stack-based buffer overflow in the AddFavorite method in Microsoft Internet Explorer allows remote attackers to cause a denial of service (application… | Patch early | 4.3 medium | 18.9% | 2009-07-10 |
| CVE-2010-4409 EXP | Integer overflow in the NumberFormatter::getSymbol (aka numfmt_get_symbol) function in PHP 5.3.3 and earlier allows context-dependent attackers to cau… | Patch early | 5.0 medium | 18.9% | 2010-12-06 |
| CVE-2019-9881 EXP | The createComment mutation in the WPGraphQL 0.2.3 plugin for WordPress allows unauthenticated users to post comments on any article, even when 'allow… | Patch early | 5.3 medium | 18.8% | 2019-06-10 |
| CVE-2014-5368 EXP | Directory traversal vulnerability in the file_get_contents function in downloadfiles/download.php in the WP Content Source Control (wp-source-control)… | Patch early | 5.0 medium | 18.8% | 2014-08-22 |
| CVE-2008-2650 EXP | Directory traversal vulnerability in cmsimple/cms.php in CMSimple 3.1, when register_globals is enabled, allows remote attackers to include and execut… | Patch early | 6.8 medium | 18.8% | 2008-06-10 |
| CVE-2004-0501 EXP | Outlook 2003 allows remote attackers to bypass intended access restrictions and cause Outlook to request a URL from a remote site via an HTML e-mail m… | Patch early | 5.0 medium | 18.7% | 2004-08-18 |
| CVE-2005-1279 EXP | tcpdump 3.8.3 and earlier allows remote attackers to cause a denial of service (infinite loop) via a crafted (1) BGP packet, which is not properly han… | Patch early | 5.0 medium | 18.7% | 2005-05-02 |
| CVE-2012-6495 EXP | Multiple directory traversal vulnerabilities in the (1) twikidraw (action/twikidraw.py) and (2) anywikidraw (action/anywikidraw.py) actions in MoinMoi… | Patch early | 6.0 medium | 18.7% | 2013-01-03 |
| CVE-2010-1714 EXP | Directory traversal vulnerability in the Arcade Games (com_arcadegames) component 1.0 for Joomla! allows remote attackers to read arbitrary files via… | Patch early | 5.0 medium | 18.7% | 2010-05-04 |
| CVE-2010-1353 EXP | Directory traversal vulnerability in the LoginBox Pro (com_loginbox) component for Joomla! allows remote attackers to read arbitrary files via a .. (d… | Patch early | 5.0 medium | 18.7% | 2010-04-12 |
| CVE-2009-4098 EXP | Unrestricted file upload vulnerability in banner-edit.php in OpenX adserver 2.8.1 and earlier allows remote authenticated users with banner / file upl… | Patch early | 6.0 medium | 18.7% | 2009-11-29 |
| CVE-2013-1861 EXP | MariaDB 5.5.x before 5.5.30, 5.3.x before 5.3.13, 5.2.x before 5.2.15, and 5.1.x before 5.1.68, and Oracle MySQL 5.1.69 and earlier, 5.5.31 and earlie… | Patch early | 5.0 medium | 18.7% | 2013-03-28 |
| CVE-2002-1148 EXP | The default servlet (org.apache.catalina.servlets.DefaultServlet) in Tomcat 4.0.4 and 4.1.10 and earlier allows remote attackers to read source code f… | Patch early | 5.0 medium | 18.6% | 2002-10-11 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt