CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
398,917 CVEs
1,728 on KEV
17,272 EPSS ≥ 10%
25,086 with exploits
synced 2026-09-29
169,175 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2012-3588 EXP | Directory traversal vulnerability in preview.php in the Plugin Newsletter plugin 1.5 for WordPress allows remote attackers to read arbitrary files via… | Patch early | 5.0 medium | 10.7% | 2012-06-19 |
| CVE-2013-2621 EXP | Open Redirection Vulnerability in the redir.php script in Telaen before 1.3.1 allows remote attackers to redirect victims to arbitrary websites via a… | Patch early | 6.1 medium | 10.7% | 2020-02-03 |
| CVE-2007-4924 EXP | The Open Phone Abstraction Library (opal), as used by (1) Ekiga before 2.0.10 and (2) OpenH323 before 2.2.4, allows remote attackers to cause a denial… | Patch early | 5.0 medium | 10.7% | 2007-10-08 |
| CVE-2017-3133 EXP | A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.6.0 and earlier allows attackers to execute unauthorized code or commands via the… | Patch early | 6.1 medium | 10.7% | 2017-09-12 |
| CVE-2002-1077 EXP | IPSwitch IMail Web Calendaring service (iwebcal) allows remote attackers to cause a denial of service (crash) via an HTTP POST request without a Conte… | Patch early | 5.0 medium | 10.7% | 2002-10-04 |
| CVE-2009-3115 EXP | SolarWinds TFTP Server 9.2.0.111 and earlier allows remote attackers to cause a denial of service (service stop) via a crafted Option Acknowledgement… | Patch early | 5.0 medium | 10.7% | 2009-09-09 |
| CVE-2001-0253 EXP | Directory traversal vulnerability in hsx.cgi program in iWeb Hyperseek 2000 allows remote attackers to read arbitrary files and directories via a .. (… | Patch early | 5.0 medium | 10.6% | 2001-06-02 |
| CVE-2004-2442 EXP | Multiple interpretation error in various F-Secure Anti-Virus products, including Workstation 5.43 and earlier, Windows Servers 5.50 and earlier, MIMEs… | Patch early | 5.0 medium | 10.6% | 2004-12-31 |
| CVE-2008-6080 EXP | Directory traversal vulnerability in download.php in the ionFiles (com_ionfiles) 4.4.2 component for Joomla! allows remote attackers to read arbitrary… | Patch early | 5.0 medium | 10.6% | 2009-02-06 |
| CVE-2019-8937 EXP | HotelDruid 2.3.0 has XSS affecting the nsextt, cambia1, mese_fine, origine, and anno parameters in creaprezzi.php, tabella3.php, personalizza.php, and… | Patch early | 6.1 medium | 10.6% | 2019-05-17 |
| CVE-2004-1986 EXP | Directory traversal vulnerability in modules.php in Coppermine Photo Gallery 1.2.2b and 1.2.0 RC4 allows remote attackers with administrative privileg… | Patch early | 5.0 medium | 10.6% | 2004-04-04 |
| CVE-2009-0369 EXP | Microsoft Internet Explorer 7 allows remote attackers to trick a user into visiting an arbitrary URL via an onclick action that moves a crafted elemen… | Patch early | 4.3 medium | 10.6% | 2009-01-30 |
| CVE-2003-0195 EXP | CUPS before 1.1.19 allows remote attackers to cause a denial of service via a partial printing request to the IPP port (631), which does not time out. | Patch early | 5.0 medium | 10.6% | 2003-06-16 |
| CVE-2012-3796 EXP | Pro-face WinGP PC Runtime 3.1.00 and earlier, and ProServr.exe in Pro-face Pro-Server EX 1.30.000 and earlier, allows remote attackers to obtain sensi… | Patch early | 5.0 medium | 10.6% | 2012-06-25 |
| CVE-2014-1889 EXP | The Group creation process in the Buddypress plugin before 1.9.2 for WordPress allows remote authenticated users to gain control of arbitrary groups b… | Patch early | 6.5 medium | 10.6% | 2018-04-10 |
| CVE-2009-4227 EXP | Stack-based buffer overflow in the read_1_3_textobject function in f_readold.c in Xfig 3.2.5b and earlier, and in the read_textobject function in read… | Patch early | 6.8 medium | 10.6% | 2009-12-08 |
| CVE-2013-7204 EXP | Cross-site request forgery (CSRF) vulnerability in set_users.cgi in Conceptronic CIPCAMPTIWL Camera 1.0 with firmware 21.37.2.49 allows remote attacke… | Patch early | 6.8 medium | 10.6% | 2014-01-17 |
| CVE-2013-2131 EXP | Format string vulnerability in the rrdtool module 1.4.7 for Python, as used in Zenoss, allows context-dependent attackers to cause a denial of service… | Patch early | 5.0 medium | 10.6% | 2015-01-04 |
| CVE-2021-24300 EXP | The slider import search feature of the PickPlugins Product Slider for WooCommerce WordPress plugin before 1.13.22 did not properly sanitised the keyw… | Patch early | 6.1 medium | 10.6% | 2021-05-24 |
| CVE-2011-1487 EXP | The (1) lc, (2) lcfirst, (3) uc, and (4) ucfirst functions in Perl 5.10.x, 5.11.x, and 5.12.x through 5.12.3, and 5.13.x through 5.13.11, do not apply… | Patch early | 5.0 medium | 10.6% | 2011-04-11 |
| CVE-2006-3472 EXP | Microsoft Internet Explorer 6.0 and 6.0 SP1 allows remote attackers to cause a denial of service via an HTML page with an A tag containing a long titl… | Patch early | 5.0 medium | 10.6% | 2006-07-10 |
| CVE-2007-6325 EXP | PHP remote file inclusion vulnerability in adminbereich/designconfig.php in Fastpublish CMS 1.9999 allows remote attackers to execute arbitrary PHP co… | Patch early | 6.8 medium | 10.6% | 2007-12-13 |
| CVE-2006-6811 EXP | KsIRC 1.3.12 allows remote attackers to cause a denial of service (crash) via a long PRIVMSG string when connecting to an Internet Relay Chat (IRC) se… | Patch early | 6.5 medium | 10.6% | 2006-12-29 |
| CVE-2012-6499 EXP | Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows remote attackers to redirect u… | Patch early | 5.8 medium | 10.6% | 2013-01-12 |
| CVE-2010-3573 EXP | Unspecified vulnerability in the Networking component in Oracle Java SE and Java for Business 6 Update 21 and 5.0 Update 25 allows remote attackers to… | Patch early | 5.1 medium | 10.6% | 2010-10-19 |
| CVE-2010-2621 EXP | The QSslSocketBackendPrivate::transmit function in src_network_ssl_qsslsocket_openssl.cpp in Qt 4.6.3 and earlier allows remote attackers to cause a d… | Patch early | 5.0 medium | 10.5% | 2010-07-02 |
| CVE-2001-0557 EXP | T. Hauck Jana Webserver 1.46 and earlier allows a remote attacker to view arbitrary files via a '..' (dot dot) attack which is URL encoded (%2e%2e). | Patch early | 5.0 medium | 10.5% | 2001-08-14 |
| CVE-2006-2025 EXP | Integer overflow in the TIFFFetchData function in tif_dirread.c for libtiff before 3.8.1 allows context-dependent attackers to cause a denial of servi… | Patch early | 6.5 medium | 10.5% | 2006-04-25 |
| CVE-2019-0612 EXP | A security feature bypass vulnerability exists when Click2Play protection in Microsoft Edge improperly handles flash objects. By itself, this bypass v… | Patch early | 5.3 medium | 10.5% | 2019-04-08 |
| CVE-2021-31682 EXP | The login portal for the Automated Logic WebCTRL/WebCTRL OEM web application contains a vulnerability that allows for reflected XSS attacks due to the… | Patch early | 6.1 medium | 10.5% | 2021-10-22 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt