CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
398,917 CVEs
1,728 on KEV
17,272 EPSS ≥ 10%
25,086 with exploits
synced 2026-09-29
205,673 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2015-4455 EXP | Unrestricted file upload vulnerability in includes/upload.php in the Aviary Image Editor Add-on For Gravity Forms plugin 3.0 beta for WordPress allows… | Patch early | 9.8 critical | 40.6% | 2017-05-23 |
| CVE-2021-45092 EXP | Thinfinity VirtualUI before 3.0 has functionality in /lab.html reachable by default that could allow IFRAME injection via the vpath parameter. | Patch early | 9.8 critical | 40.6% | 2021-12-16 |
| CVE-2007-1286 EXP | Integer overflow in PHP 4.4.4 and earlier allows remote context-dependent attackers to execute arbitrary code via a long string to the unserialize fun… | Patch early | 6.8 medium | 40.4% | 2007-03-06 |
| CVE-2006-3493 EXP | Buffer overflow in LsCreateLine function (mso_203) in mso.dll and mso9.dll, as used by Microsoft Word and possibly other products in Microsoft Office… | Patch early | 5.1 medium | 40.4% | 2006-07-10 |
| CVE-2013-1599 EXP | A Command Injection vulnerability exists in the /var/www/cgi-bin/rtpd.cgi script in D-Link IP Cameras DCS-3411/3430 firmware 1.02, DCS-5605/5635 1.01,… | Patch early | 9.8 critical | 40.4% | 2020-01-28 |
| CVE-2006-2111 EXP | A component in Microsoft Outlook Express 6 allows remote attackers to bypass domain restrictions and obtain sensitive information via redirections wit… | Patch early | 4.3 medium | 40.3% | 2006-05-01 |
| CVE-2020-24217 EXP | An issue was discovered in the box application on HiSilicon based IPTV/H.264/H.265 video encoders. The file-upload endpoint does not enforce authentic… | Patch early | 9.8 critical | 40.3% | 2020-10-06 |
| CVE-2005-2852 EXP | Unknown vulnerability in CIFS.NLM in Novell Netware 6.5 SP2 and SP3, 5.1, and 6.0 allows remote attackers to cause a denial of service (ABEND) via an… | Patch early | 5.0 medium | 40.3% | 2005-09-08 |
| CVE-2007-5641 EXP | Multiple PHP remote file inclusion vulnerabilities in PHP Project Management 0.8.10 and earlier allow remote attackers to execute arbitrary PHP code v… | Patch early | 6.8 medium | 40.3% | 2007-10-23 |
| CVE-2007-5407 EXP | Multiple PHP remote file inclusion vulnerabilities in the JContentSubscription (com_jcs) 1.5.8 component for Joomla! allow remote attackers to execute… | Patch early | 6.8 medium | 40.2% | 2007-10-12 |
| CVE-2022-23513 EXP | Pi-Hole is a network-wide ad blocking via your own Linux hardware, AdminLTE is a Pi-hole Dashboard for stats and more. In case of an attack, the threa… | Patch early | 5.3 medium | 40.2% | 2022-12-23 |
| CVE-2007-2481 EXP | PHP remote file inclusion vulnerability in wordtube-button.php in the wordTube 1.43 and earlier plugin for WordPress, when register_globals is enabled… | Patch early | 6.8 medium | 40.1% | 2007-05-03 |
| CVE-2009-1968 EXP | Unspecified vulnerability in the Secure Enterprise Search component in Oracle Database 10.1.8.3 allows remote attackers to affect integrity via unknow… | Patch early | 4.3 medium | 40.1% | 2009-07-14 |
| CVE-2016-3371 EXP | The kernel API in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Window… | Patch early | 5.5 medium | 40.1% | 2016-09-14 |
| CVE-1999-0154 EXP | IIS 2.0 and 3.0 allows remote attackers to read the source code for ASP pages by appending a . (dot) to the end of the URL. | Patch early | 5.0 medium | 40% | 1999-12-31 |
| CVE-2019-7442 EXP | An XML external entity (XXE) vulnerability in the Password Vault Web Access (PVWA) of CyberArk Enterprise Password Vault <=10.7 allows remote attacker… | Patch early | 9.8 critical | 40% | 2019-05-08 |
| CVE-2019-7269 EXP | Linear eMerge 50P/5000P devices allow Authenticated Command Injection with root Code Execution. | Patch early | 9.8 critical | 40% | 2019-07-02 |
| CVE-2010-4051 EXP | The regcomp implementation in the GNU C Library (aka glibc or libc6) through 2.11.3, and 2.12.x through 2.12.2, allows context-dependent attackers to… | Patch early | 5.0 medium | 40% | 2011-01-13 |
| CVE-2006-4110 EXP | Apache 2.2.2, when running on Windows, allows remote attackers to read source code of CGI programs via a request that contains uppercase (or alternate… | Patch early | 4.3 medium | 40% | 2006-08-14 |
| CVE-2018-0833 EXP | The Microsoft Server Message Block 2.0 and 3.0 (SMBv2/SMBv3) client in Windows 8.1 and RT 8.1 and Windows Server 2012 R2 allows a denial of service vu… | Patch early | 5.3 medium | 39.9% | 2018-02-15 |
| CVE-2025-7441 EXP | The StoryChief plugin for WordPress is vulnerable to arbitrary file uploads in all versions up to, and including, 1.0.42. This vulnerability occurs th… | Patch early | 9.8 critical | 39.8% | 2025-08-16 |
| CVE-2018-10088 EXP | Buffer overflow in XiongMai uc-httpd 1.0.0 has unspecified impact and attack vectors, a different vulnerability than CVE-2017-16725. | Patch early | 9.8 critical | 39.7% | 2018-06-08 |
| CVE-2015-0252 EXP | internal/XMLReader.cpp in Apache Xerces-C before 3.1.2 allows remote attackers to cause a denial of service (segmentation fault and crash) via crafted… | Patch early | 5.0 medium | 39.7% | 2015-03-24 |
| CVE-2021-25156 EXP | A remote arbitrary directory create vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.4.x:… | Patch early | 4.9 medium | 39.7% | 2021-03-30 |
| CVE-2017-17968 EXP | A buffer overflow vulnerability in NetTransport.exe in NetTransport Download Manager 2.96L and earlier could allow remote HTTP servers to execute arbi… | Patch early | 9.8 critical | 39.6% | 2017-12-29 |
| CVE-2023-2068 EXP | The File Manager Advanced Shortcode WordPress plugin through 2.3.2 does not adequately prevent uploading files with disallowed MIME types when using t… | Patch early | 9.8 critical | 39.6% | 2023-06-27 |
| CVE-2019-17240 EXP | bl-kernel/security.class.php in Bludit 3.9.2 allows attackers to bypass a brute-force protection mechanism by using many different forged X-Forwarded-… | Patch early | 9.8 critical | 39.6% | 2019-10-06 |
| CVE-2006-0030 EXP | Unspecified vulnerability in Microsoft Excel 2000, 2002, and 2003, in Microsoft Office 2000 SP3 and other packages, allows user-assisted attackers to… | Patch early | 5.1 medium | 39.6% | 2006-03-14 |
| CVE-2015-2067 EXP | Directory traversal vulnerability in web/ajax_pluginconf.php in the MAGMI (aka Magento Mass Importer) plugin for Magento Server allows remote attacker… | Patch early | 5.0 medium | 39.4% | 2015-02-24 |
| CVE-2007-4815 EXP | Multiple PHP remote file inclusion vulnerabilities in WebED in Markus Iser ED Engine 0.8999 alpha allow remote attackers to execute arbitrary PHP code… | Patch early | 6.8 medium | 39.4% | 2007-09-11 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt