CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
424,984 CVEs
1,779 on KEV
17,545 EPSS ≥ 10%
25,095 with exploits
synced 2026-11-13
178,889 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2015-6908 EXP | The ber_get_next function in libraries/liblber/io.c in OpenLDAP 2.4.42 and earlier allows remote attackers to cause a denial of service (reachable ass… | Patch early | 5.0 medium | 18.8% | 2015-09-11 |
| CVE-2013-1861 EXP | MariaDB 5.5.x before 5.5.30, 5.3.x before 5.3.13, 5.2.x before 5.2.15, and 5.1.x before 5.1.68, and Oracle MySQL 5.1.69 and earlier, 5.5.31 and earlie… | Patch early | 5.0 medium | 18.8% | 2013-03-28 |
| CVE-2014-5368 EXP | Directory traversal vulnerability in the file_get_contents function in downloadfiles/download.php in the WP Content Source Control (wp-source-control)… | Patch early | 5.0 medium | 18.8% | 2014-08-22 |
| CVE-2008-2650 EXP | Directory traversal vulnerability in cmsimple/cms.php in CMSimple 3.1, when register_globals is enabled, allows remote attackers to include and execut… | Patch early | 6.8 medium | 18.8% | 2008-06-10 |
| CVE-2001-0348 EXP | Microsoft Windows 2000 telnet service allows attackers to cause a denial of service (crash) via a long logon command that contains a backspace. | Patch early | 5.0 medium | 18.8% | 2001-07-21 |
| CVE-2004-0501 EXP | Outlook 2003 allows remote attackers to bypass intended access restrictions and cause Outlook to request a URL from a remote site via an HTML e-mail m… | Patch early | 5.0 medium | 18.7% | 2004-08-18 |
| CVE-2005-1279 EXP | tcpdump 3.8.3 and earlier allows remote attackers to cause a denial of service (infinite loop) via a crafted (1) BGP packet, which is not properly han… | Patch early | 5.0 medium | 18.7% | 2005-05-02 |
| CVE-2010-1657 EXP | Directory traversal vulnerability in the SmartSite (com_smartsite) component 1.0.0 for Joomla! allows remote attackers to read arbitrary files via a .… | Patch early | 5.0 medium | 18.7% | 2010-05-03 |
| CVE-2010-1353 EXP | Directory traversal vulnerability in the LoginBox Pro (com_loginbox) component for Joomla! allows remote attackers to read arbitrary files via a .. (d… | Patch early | 5.0 medium | 18.7% | 2010-04-12 |
| CVE-2010-1714 EXP | Directory traversal vulnerability in the Arcade Games (com_arcadegames) component 1.0 for Joomla! allows remote attackers to read arbitrary files via… | Patch early | 5.0 medium | 18.7% | 2010-05-04 |
| CVE-2023-5702 EXP | A vulnerability was found in Viessmann Vitogate 300 up to 2.1.3.0 and classified as problematic. Affected by this issue is some unknown functionality… | Patch early | 4.3 medium | 18.7% | 2023-10-23 |
| CVE-2009-4098 EXP | Unrestricted file upload vulnerability in banner-edit.php in OpenX adserver 2.8.1 and earlier allows remote authenticated users with banner / file upl… | Patch early | 6.0 medium | 18.7% | 2009-11-29 |
| CVE-2002-1148 EXP | The default servlet (org.apache.catalina.servlets.DefaultServlet) in Tomcat 4.0.4 and 4.1.10 and earlier allows remote attackers to read source code f… | Patch early | 5.0 medium | 18.6% | 2002-10-11 |
| CVE-2012-6495 EXP | Multiple directory traversal vulnerabilities in the (1) twikidraw (action/twikidraw.py) and (2) anywikidraw (action/anywikidraw.py) actions in MoinMoi… | Patch early | 6.0 medium | 18.6% | 2013-01-03 |
| CVE-2010-5278 EXP | Directory traversal vulnerability in manager/controllers/default/resource/tvs.php in MODx Revolution 2.0.2-pl, and possibly earlier, when magic_quotes… | Patch early | 4.3 medium | 18.6% | 2012-10-07 |
| CVE-2012-0007 EXP | The Microsoft Anti-Cross Site Scripting (AntiXSS) Library 3.x and 4.0 does not properly evaluate characters after the detection of a Cascading Style S… | Patch early | 4.3 medium | 18.6% | 2012-01-10 |
| CVE-2007-6236 EXP | Microsoft Windows Media Player (WMP) allows remote attackers to cause a denial of service (application crash) via a certain AIFF file that triggers a… | Patch early | 5.0 medium | 18.6% | 2007-12-04 |
| CVE-2006-6601 EXP | Windows Media Player 10.00.00.4036 in Microsoft Windows XP SP2 allows user-assisted remote attackers to cause a denial of service via a .MID (MIDI) fi… | Patch early | 4.3 medium | 18.6% | 2006-12-15 |
| CVE-2010-0520 EXP | Heap-based buffer overflow in QuickTimeAuthoring.qtx in QuickTime in Apple Mac OS X before 10.6.3 allows remote attackers to execute arbitrary code or… | Patch early | 6.8 medium | 18.6% | 2010-03-30 |
| CVE-2018-19877 EXP | login.php in Adiscon LogAnalyzer before 4.1.7 has XSS via the Login Button Referer field. | Patch early | 6.1 medium | 18.6% | 2018-12-05 |
| CVE-2004-1623 EXP | The WAV file property handler in Windows XP SP1 allows remote attackers to cause a denial of service (infinite loop in Explorer) via a WAV file with a… | Patch early | 5.0 medium | 18.6% | 2004-10-22 |
| CVE-2013-1600 EXP | An Authentication Bypass vulnerability exists in upnp/asf-mp4.asf when streaming live video in D-Link TESCO DCS-2121 1.05_TESCO, TESCO DCS-2102 1.05_T… | Patch early | 5.3 medium | 18.5% | 2020-01-28 |
| CVE-2015-2153 EXP | The rpki_rtr_pdu_print function in print-rpki-rtr.c in the TCP printer in tcpdump before 4.7.2 allows remote attackers to cause a denial of service (o… | Patch early | 5.0 medium | 18.5% | 2015-03-24 |
| CVE-2005-0709 EXP | MySQL 4.0.23 and earlier, and 4.1.x up to 4.1.10, allows remote authenticated users with INSERT and DELETE privileges to execute arbitrary code by usi… | Patch early | 4.6 medium | 18.4% | 2005-05-02 |
| CVE-2008-2905 EXP | PHP remote file inclusion vulnerability in includes/Cache/Lite/Output.php in the Cache_Lite package in Mambo 4.6.4 and earlier, when register_globals… | Patch early | 6.8 medium | 18.4% | 2008-06-30 |
| CVE-2019-9881 EXP | The createComment mutation in the WPGraphQL 0.2.3 plugin for WordPress allows unauthenticated users to post comments on any article, even when 'allow… | Patch early | 5.3 medium | 18.4% | 2019-06-10 |
| CVE-2025-60689 EXP | An unauthenticated command injection vulnerability exists in the Start_EPI function of the httpd binary on Linksys E1200 v2 routers (Firmware E1200_v2… | Patch early | 5.4 medium | 18.3% | 2025-11-13 |
| CVE-2006-7031 EXP | Microsoft Internet Explorer 6.0.2900 SP2 and earlier allows remote attackers to cause a denial of service (crash) via a table element with a CSS attri… | Patch early | 6.5 medium | 18.3% | 2007-02-23 |
| CVE-2009-1379 EXP | Use-after-free vulnerability in the dtls1_retrieve_buffered_fragment function in ssl/d1_both.c in OpenSSL 1.0.0 Beta 2 allows remote attackers to caus… | Patch early | 5.0 medium | 18.2% | 2009-05-19 |
| CVE-2007-0811 EXP | Microsoft Internet Explorer 6.0 SP1 on Windows 2000, and 6.0 SP2 on Windows XP, allows remote attackers to cause a denial of service (NULL pointer der… | Patch early | 4.3 medium | 18.2% | 2007-02-07 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt