CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
398,672 CVEs
1,728 on KEV
17,267 EPSS ≥ 10%
25,086 with exploits
synced 2026-09-28
205,551 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2019-11231 EXP | An issue was discovered in GetSimple CMS through 3.3.15. insufficient input sanitation in the theme-edit.php file allows upload of files with arbitrar… | Patch early | 9.8 critical | 71.6% | 2019-05-22 |
| CVE-2018-20434 EXP | LibreNMS 1.46 allows remote attackers to execute arbitrary OS commands by using the $_POST['community'] parameter to html/pages/addhost.inc.php during… | Patch early | 9.8 critical | 71.5% | 2019-04-24 |
| CVE-2019-19985 EXP | The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed unauthenticated file download with user information disclo… | Patch early | 5.3 medium | 71.4% | 2019-12-26 |
| CVE-2021-46419 EXP | An unauthorized file deletion vulnerability in Telesquare TLR-2855KS6 via DELETE method can allow deletion of system files and scripts. | Patch early | 9.1 critical | 71.4% | 2022-04-07 |
| CVE-2006-0295 EXP | Mozilla Firefox 1.5, Thunderbird 1.5 if Javascript is enabled in mail, and SeaMonkey before 1.0 might allow remote attackers to execute arbitrary code… | Patch early | 5.1 medium | 71.3% | 2006-02-02 |
| CVE-2016-1909 EXP | Fortinet FortiAnalyzer before 5.0.12 and 5.2.x before 5.2.5; FortiSwitch 3.3.x before 3.3.3; FortiCache 3.0.x before 3.0.8; and FortiOS 4.1.x before 4… | Patch early | 9.8 critical | 71.3% | 2016-01-15 |
| CVE-2021-4039 EXP | A command injection vulnerability in the web interface of the Zyxel NWA-1100-NH firmware could allow an attacker to execute arbitrary OS commands on t… | Patch early | 9.8 critical | 71% | 2022-03-01 |
| CVE-2020-29597 EXP | IncomCMS 2.0 has a modules/uploader/showcase/script.php insecure file upload vulnerability. This vulnerability allows unauthenticated attackers to upl… | Patch early | 9.8 critical | 71% | 2020-12-07 |
| CVE-2017-8895 EXP | In Veritas Backup Exec 2014 before build 14.1.1187.1126, 15 before build 14.2.1180.3160, and 16 before FP1, there is a use-after-free vulnerability in… | Patch early | 9.8 critical | 71% | 2017-05-10 |
| CVE-2013-2641 EXP | Directory traversal vulnerability in patience.cgi in Sophos Web Appliance before 3.7.8.2 allows remote attackers to read arbitrary files via the id pa… | Patch early | 5.0 medium | 71% | 2014-03-18 |
| CVE-1999-0513 EXP | ICMP messages to broadcast addresses are allowed, allowing for a Smurf attack that can cause a denial of service. | Patch early | 5.0 medium | 70.9% | 1998-01-05 |
| CVE-2014-5460 EXP | Unrestricted file upload vulnerability in the Tribulant Slideshow Gallery plugin before 1.4.7 for WordPress allows remote authenticated users to execu… | Patch early | 6.5 medium | 70.9% | 2014-09-11 |
| CVE-2016-5675 EXP | handle_daylightsaving.php in NUUO NVRmini 2 1.7.5 through 3.0.0, NUUO NVRsolo 1.0.0 through 3.0.0, NUUO Crystal 2.2.1 through 3.2.0, and NETGEAR Ready… | Patch early | 9.8 critical | 70.9% | 2016-08-31 |
| CVE-2020-11456 EXP | LimeSurvey before 4.1.12+200324 has stored XSS in application/views/admin/surveysgroups/surveySettings.php and application/models/SurveysGroups.php (a… | Patch early | 5.4 medium | 70.8% | 2020-04-01 |
| CVE-2021-35064 EXP | KramerAV VIAWare, all tested versions, allow privilege escalation through misconfiguration of sudo. Sudoers permits running of multiple dangerous comm… | Patch early | 9.8 critical | 70.8% | 2021-07-12 |
| CVE-2018-10094 EXP | SQL injection vulnerability in Dolibarr before 7.0.2 allows remote attackers to execute arbitrary SQL commands via vectors involving integer parameter… | Patch early | 9.8 critical | 70.7% | 2018-05-22 |
| CVE-2007-3431 EXP | PHP remote file inclusion vulnerability in cal.func.php in Valerio Capello Dagger - The Cutting Edge r23jan2007 allows remote attackers to execute arb… | Patch early | 6.8 medium | 70.7% | 2007-06-27 |
| CVE-2013-4211 EXP | A Code Execution Vulnerability exists in OpenX Ad Server 2.8.10 due to a backdoor in flowplayer-3.1.1.min.js library, which could let a remote malicio… | Patch early | 9.8 critical | 70.7% | 2020-02-14 |
| CVE-2006-6565 EXP | FileZilla Server before 0.9.22 allows remote attackers to cause a denial of service (crash) via a wildcard argument to the (1) LIST or (2) NLST comman… | Patch early | 4.0 medium | 70.6% | 2006-12-15 |
| CVE-2001-1243 EXP | Scripting.FileSystemObject in asp.dll for Microsoft IIS 4.0 and 5.0 allows local or remote attackers to cause a denial of service (crash) via (1) crea… | Patch early | 5.0 medium | 70.5% | 2001-07-04 |
| CVE-2007-3798 EXP | Integer overflow in print-bgp.c in the BGP dissector in tcpdump 3.9.6 and earlier allows remote attackers to execute arbitrary code via crafted TLVs i… | Patch early | 9.8 critical | 70.4% | 2007-07-16 |
| CVE-2003-0001 EXP | Multiple ethernet Network Interface Card (NIC) device drivers do not pad frames with null bytes, which allows remote attackers to obtain information f… | Patch early | 5.0 medium | 70.2% | 2003-01-17 |
| CVE-2019-1184 EXP | An elevation of privilege vulnerability exists when Windows Core Shell COM Server Registrar improperly handles COM calls. An attacker who successfully… | Patch early | 6.7 medium | 70.2% | 2019-08-14 |
| CVE-2008-0927 EXP | dhost.exe in Novell eDirectory 8.7.3 before sp10 and 8.8.2 allows remote attackers to cause a denial of service (CPU consumption) via an HTTP request… | Patch early | 5.0 medium | 70.1% | 2008-04-14 |
| CVE-2019-7257 EXP | Linear eMerge E3-Series devices allow Unrestricted File Upload. | Patch early | 10.0 critical | 70% | 2019-07-02 |
| CVE-2021-42071 EXP | In Visual Tools DVR VX16 4.2.28.0, an unauthenticated attacker can achieve remote command execution via shell metacharacters in the cgi-bin/slogin/log… | Patch early | 9.8 critical | 69.9% | 2021-10-07 |
| CVE-2020-10770 EXP | A flaw was found in Keycloak before 13.0.0, where it is possible to force the server to call out an unverified URL using the OIDC parameter request_ur… | Patch early | 5.3 medium | 69.7% | 2020-12-15 |
| CVE-2012-4284 EXP | A Privilege Escalation vulnerability exists in Viscosity 1.4.1 on Mac OS X due to a path name validation issue in the setuid-set ViscosityHelper binar… | Patch early | 9.8 critical | 69.5% | 2020-01-10 |
| CVE-2018-7573 EXP | An issue was discovered in FTPShell Client 6.7. A remote FTP server can send 400 characters of 'F' in conjunction with the FTP 220 response code to cr… | Patch early | 9.8 critical | 69.2% | 2018-03-01 |
| CVE-2013-4124 EXP | Integer overflow in the read_nttrans_ea_list function in nttrans.c in smbd in Samba 3.x before 3.5.22, 3.6.x before 3.6.17, and 4.x before 4.0.8 allow… | Patch early | 5.0 medium | 69% | 2013-08-06 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt