CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
398,831 CVEs
1,728 on KEV
17,272 EPSS ≥ 10%
25,086 with exploits
synced 2026-09-28
148,982 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2004-0627 EXP | The check_scramble_323 function in MySQL 4.1.x before 4.1.3, and 5.0, allows remote attackers to bypass authentication via a zero-length scrambled str… | Patch early | 10.0 high | 69.6% | 2004-12-06 |
| CVE-2012-0003 EXP | Unspecified vulnerability in winmm.dll in Windows Multimedia Library in Windows Media Player (WMP) in Microsoft Windows XP SP2 and SP3, Server 2003 SP… | Patch early | 8.1 high | 69.6% | 2012-01-10 |
| CVE-2011-3658 EXP | The SVG implementation in Mozilla Firefox 8.0, Thunderbird 8.0, and SeaMonkey 2.5 does not properly interact with DOMAttrModified event handlers, whic… | Patch early | 7.5 high | 69.6% | 2011-12-21 |
| CVE-2011-1567 EXP | Multiple stack-based buffer overflows in IGSSdataServer.exe 9.00.00.11063 and earlier in 7-Technologies Interactive Graphical SCADA System (IGSS) allo… | Patch early | 10.0 high | 69.6% | 2011-04-05 |
| CVE-2007-6204 EXP | Multiple stack-based buffer overflows in HP OpenView Network Node Manager (OV NNM) 6.41, 7.01, and 7.51 allow remote attackers to execute arbitrary co… | Patch early | 10.0 high | 69.6% | 2007-12-13 |
| CVE-2009-4484 EXP | Multiple stack-based buffer overflows in the CertDecoder::GetName function in src/asn.cpp in TaoCrypt in yaSSL before 1.9.9, as used in mysqld in MySQ… | Patch early | 7.5 high | 69.6% | 2009-12-30 |
| CVE-2014-0307 EXP | Use-after-free vulnerability in Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory c… | Patch early | 9.3 high | 69.5% | 2014-03-12 |
| CVE-2009-4188 EXP | HP Operations Dashboard has a default password of j2deployer for the j2deployer account, which allows remote attackers to execute arbitrary code via a… | Patch early | 10.0 high | 69.5% | 2009-12-03 |
| CVE-2005-0560 EXP | Heap-based buffer overflow in the SvrAppendReceivedChunk function in xlsasink.dll in the SMTP service of Exchange Server 2000 and 2003 allows remote a… | Patch early | 7.5 high | 69.5% | 2005-05-02 |
| CVE-2008-1117 EXP | Directory traversal vulnerability in the Notes (aka Flash Notes or instant messages) feature in tb2ftp.dll in Timbuktu Pro 8.6.5 for Windows, and poss… | Patch early | 10.0 high | 69.5% | 2008-03-14 |
| CVE-2019-0568 EXP | A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scri… | Patch early | 7.5 high | 69.5% | 2019-01-08 |
| CVE-2018-7490 EXP | uWSGI before 2.0.17 mishandles a DOCUMENT_ROOT check during use of the --php-docroot option, allowing directory traversal. | Patch early | 7.5 high | 69.4% | 2018-02-26 |
| CVE-2012-5896 EXP | The Annotation Objects Extension ActiveX control in AnnotateX.dll in Quest InTrust 10.4.0.853 and earlier does not properly implement the Add method,… | Patch early | 10.0 high | 69.4% | 2012-11-17 |
| CVE-2017-8646 EXP | Microsoft Edge in Windows 10 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user… | Patch early | 7.5 high | 69.3% | 2017-08-08 |
| CVE-2017-8671 EXP | Microsoft Edge in Microsoft Windows 10 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the cu… | Patch early | 7.5 high | 69.3% | 2017-08-08 |
| CVE-2017-8640 EXP | Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the curren… | Patch early | 7.5 high | 69.3% | 2017-08-08 |
| CVE-2017-8656 EXP | Microsoft Edge in Microsoft Windows 10 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current… | Patch early | 7.5 high | 69.3% | 2017-08-08 |
| CVE-2017-8645 EXP | Microsoft Edge in Windows 10 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user… | Patch early | 7.5 high | 69.3% | 2017-08-08 |
| CVE-2015-3628 EXP | The iControl API in F5 BIG-IP LTM, AFM, Analytics, APM, ASM, Link Controller, and PEM 11.3.0 before 11.5.3 HF2 and 11.6.0 before 11.6.0 HF6, BIG-IP AA… | Patch early | 9.0 high | 69.3% | 2015-12-07 |
| CVE-2012-2311 EXP | sapi/cgi/cgi_main.c in PHP before 5.3.13 and 5.4.x before 5.4.3, when configured as a CGI script (aka php-cgi), does not properly handle query strings… | Patch early | 7.5 high | 69.3% | 2012-05-11 |
| CVE-2003-1192 EXP | Stack-based buffer overflow in IA WebMail Server 3.1.0 allows remote attackers to execute arbitrary code via a long GET request. | Patch early | 10.0 high | 69.2% | 2003-11-03 |
| CVE-2017-11802 EXP | ChakraCore and Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in… | Patch early | 7.5 high | 69.2% | 2017-10-13 |
| CVE-2013-0230 EXP | Stack-based buffer overflow in the ExecuteSoapAction function in the SOAPAction handler in the HTTP service in MiniUPnP MiniUPnPd 1.0 allows remote at… | Patch early | 10.0 high | 69.2% | 2013-01-31 |
| CVE-2014-8517 EXP | The fetch_url function in usr.bin/ftp/fetch.c in tnftp, as used in NetBSD 5.1 through 5.1.4, 5.2 through 5.2.2, 6.0 through 6.0.6, and 6.1 through 6.1… | Patch early | 7.5 high | 69.1% | 2014-11-17 |
| CVE-2011-4051 EXP | CEServer.exe in the CEServer component in the Remote Agent module in InduSoft Web Studio 6.1 and 7.0 does not require authentication, which allows rem… | Patch early | 10.0 high | 69.1% | 2011-12-05 |
| CVE-2003-0220 EXP | Buffer overflow in the administrator authentication process for Kerio Personal Firewall (KPF) 2.1.4 and earlier allows remote attackers to execute arb… | Patch early | 7.5 high | 69.1% | 2003-05-12 |
| CVE-2008-1105 EXP | Heap-based buffer overflow in the receive_smb_raw function in util/sock.c in Samba 3.0.0 through 3.0.29 allows remote attackers to execute arbitrary c… | Patch early | 7.5 high | 69.1% | 2008-05-29 |
| CVE-2007-3039 EXP | Stack-based buffer overflow in the Microsoft Message Queuing (MSMQ) service in Microsoft Windows 2000 Server SP4, Windows 2000 Professional SP4, and W… | Patch early | 9.0 high | 69.1% | 2007-12-12 |
| CVE-2016-4264 EXP | The Office Open XML (OOXML) feature in Adobe ColdFusion 10 before Update 21 and 11 before Update 10 allows remote attackers to read arbitrary files or… | Patch early | 8.6 high | 69% | 2016-09-01 |
| CVE-2012-1533 EXP | Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, and 6 Update 35 and earlier, allow… | Patch early | 10.0 high | 69% | 2012-10-16 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt