CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
425,632 CVEs
1,781 on KEV
17,555 EPSS ≥ 10%
25,095 with exploits
synced 2026-11-13
197,431 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2021-44790 EXP | A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Apache httpd… | Patch early | 9.8 critical | 96.8% | 2021-12-20 |
| CVE-2019-17662 EXP | ThinVNC 1.0b1 is vulnerable to arbitrary file read, which leads to a compromise of the VNC server. The vulnerability exists even when authentication i… | Patch early | 9.8 critical | 96.8% | 2019-10-16 |
| CVE-2001-0500 EXP | Buffer overflow in ISAPI extension (idq.dll) in Index Server 2.0 and Indexing Service 2000 in IIS 6.0 beta and earlier allows remote attackers to exec… | Patch early | 10.0 high | 96.7% | 2001-07-21 |
| CVE-2019-9194 EXP | elFinder before 2.1.48 has a command injection vulnerability in the PHP connector. | Patch early | 9.8 critical | 96.7% | 2019-02-26 |
| CVE-2020-3187 EXP | A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software co… | Patch early | 9.1 critical | 96.5% | 2020-05-06 |
| CVE-2019-15975 EXP | Multiple vulnerabilities in the authentication mechanisms of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker… | Patch early | 9.8 critical | 96.5% | 2020-01-06 |
| CVE-2017-6090 EXP | Unrestricted file upload vulnerability in clients/editclient.php in PhpCollab 2.5.1 and earlier allows remote authenticated users to execute arbitrary… | Patch early | 8.8 high | 96.4% | 2017-10-03 |
| CVE-2000-0573 EXP | The lreply function in wu-ftpd 2.6.0 and earlier does not properly cleanse an untrusted format string, which allows remote attackers to execute arbitr… | Patch early | 10.0 high | 96.2% | 2000-07-07 |
| CVE-2011-2523 EXP | vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp. | Patch early | 9.8 critical | 96.2% | 2019-11-27 |
| CVE-2018-19518 EXP | University of Washington IMAP Toolkit 2007f on UNIX, as used in imap_open() in PHP and other products, launches an rsh command (by means of the imap_r… | Patch early | 7.5 high | 96.1% | 2018-11-25 |
| CVE-2022-36446 EXP | software/apt-lib.pl in Webmin before 1.997 lacks HTML escaping for a UI command. | Patch early | 9.8 critical | 95.9% | 2022-07-25 |
| CVE-2023-0297 EXP | Code Injection in GitHub repository pyload/pyload prior to 0.5.0b3.dev31. | Patch early | 9.8 critical | 95.9% | 2023-01-14 |
| CVE-2019-1663 EXP | A vulnerability in the web-based management interface of the Cisco RV110W Wireless-N VPN Firewall, Cisco RV130W Wireless-N Multifunction VPN Router, a… | Patch early | 9.8 critical | 95.7% | 2019-02-28 |
| CVE-2013-0333 EXP | lib/active_support/json/backends/yaml.rb in Ruby on Rails 2.3.x before 2.3.16 and 3.0.x before 3.0.20 does not properly convert JSON data to YAML data… | Patch early | 7.5 high | 95.6% | 2013-01-30 |
| CVE-2020-11530 EXP | A blind SQL injection vulnerability is present in Chop Slider 3, a WordPress plugin. The vulnerability is introduced in the id GET parameter supplied… | Patch early | 9.8 critical | 95.4% | 2020-05-08 |
| CVE-2021-22911 EXP | A improper input sanitization vulnerability exists in Rocket.Chat server 3.11, 3.12 & 3.13 that could lead to unauthenticated NoSQL injection, resulti… | Patch early | 9.8 critical | 95.2% | 2021-05-27 |
| CVE-2002-0392 EXP | Apache 1.3 through 1.3.24, and Apache 2.0 through 2.0.36, allows remote attackers to cause a denial of service and possibly execute arbitrary code via… | Patch early | 7.5 high | 95.2% | 2002-07-03 |
| CVE-2024-0204 EXP | Authentication bypass in Fortra's GoAnywhere MFT prior to 7.4.1 allows an unauthorized user to create an admin user via the administration portal. | Patch early | 9.8 critical | 95.1% | 2024-01-22 |
| CVE-2011-4862 EXP | Buffer overflow in libtelnet/encrypt.c in telnetd in FreeBSD 7.3 through 9.0, MIT Kerberos Version 5 Applications (aka krb5-appl) 1.0.2 and earlier, H… | Patch early | 10.0 high | 95.1% | 2011-12-25 |
| CVE-2001-0797 EXP | Buffer overflow in login in various System V based operating systems allows remote attackers to execute arbitrary commands via a large number of argum… | Patch early | 10.0 high | 95% | 2001-12-12 |
| CVE-2019-20499 EXP | D-Link DWL-2600AP 4.2.0.15 Rev A devices have an authenticated OS command injection vulnerability via the Restore Configuration functionality in the W… | Patch early | 7.8 high | 94.8% | 2020-03-05 |
| CVE-2017-9798 EXP | Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, or if httpd… | Patch early | 7.5 high | 94.7% | 2017-09-18 |
| CVE-2020-24186 EXP | A Remote Code Execution vulnerability exists in the gVectors wpDiscuz plugin 7.0 through 7.0.4 for WordPress, which allows unauthenticated users to up… | Patch early | 10.0 critical | 94.6% | 2020-08-24 |
| CVE-2016-5674 EXP | __debugging_center_utils___.php in NUUO NVRmini 2 1.7.5 through 3.0.0, NUUO NVRsolo 1.7.5 through 3.0.0, and NETGEAR ReadyNAS Surveillance 1.1.1 throu… | Patch early | 9.8 critical | 94.6% | 2016-08-31 |
| CVE-2015-0235 EXP | Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18, allows context-dependent attac… | Patch early | 10.0 high | 94.6% | 2015-01-28 |
| CVE-2010-3972 EXP | Heap-based buffer overflow in the TELNET_STREAM_CONTEXT::OnSendData function in ftpsvc.dll in Microsoft FTP Service 7.0 and 7.5 for Internet Informati… | Patch early | 10.0 high | 94.5% | 2010-12-23 |
| CVE-2014-0515 EXP | Buffer overflow in Adobe Flash Player before 11.7.700.279 and 11.8.x through 13.0.x before 13.0.0.206 on Windows and OS X, and before 11.2.202.356 on… | Patch early | 10.0 high | 94.5% | 2014-04-29 |
| CVE-2017-14492 EXP | Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted… | Patch early | 9.8 critical | 94.5% | 2017-10-03 |
| CVE-2015-7857 EXP | SQL injection vulnerability in the getListQuery function in administrator/components/com_contenthistory/models/history.php in Joomla! 3.2 before 3.4.5… | Patch early | 7.5 high | 94.5% | 2015-10-29 |
| CVE-2021-46422 EXP | Telesquare SDT-CW3B1 1.1.0 is affected by an OS command injection vulnerability that allows a remote attacker to execute OS commands without any authe… | Patch early | 9.8 critical | 94.4% | 2022-04-27 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt