CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
425,724 CVEs
1,781 on KEV
17,555 EPSS ≥ 10%
25,095 with exploits
synced 2026-11-13
338,123 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2007-5067 EXP | Multiple buffer overflows in iMatix Xitami Web Server 2.5c2 allow remote attackers to execute arbitrary code via a long If-Modified-Since header to (1… | Patch early | 7.5 high | 73.2% | 2007-09-24 |
| CVE-2009-3867 EXP | Stack-based buffer overflow in the HsbParser.getSoundBank function in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17,… | Patch early | 9.3 high | 73.2% | 2009-11-05 |
| CVE-2007-0038 EXP | Stack-based buffer overflow in the animated cursor code in Microsoft Windows 2000 SP4 through Vista allows remote attackers to execute arbitrary code… | Patch early | 9.3 high | 73.1% | 2007-03-30 |
| CVE-2017-5637 EXP | Two four letter word commands "wchp/wchc" are CPU intensive and could cause spike of CPU utilization on Apache ZooKeeper server if abused, which leads… | Patch early | 7.5 high | 73.1% | 2017-10-10 |
| CVE-2005-2428 EXP | Lotus Domino R5 and R6 WebMail, with "Generate HTML for all fields" enabled, stores sensitive data from names.nsf in hidden form fields, which allows… | Patch early | 5.0 medium | 73% | 2005-08-03 |
| CVE-2006-1148 EXP | Multiple stack-based buffer overflows in the procConnectArgs function in servmgr.cpp in PeerCast before 0.1217 allow remote attackers to execute arbit… | Patch early | 7.5 high | 73% | 2006-03-10 |
| CVE-2007-1070 EXP | Multiple stack-based buffer overflows in Trend Micro ServerProtect for Windows and EMC 5.58, and for Network Appliance Filer 5.61 and 5.62, allow remo… | Patch early | 10.0 high | 73% | 2007-02-21 |
| CVE-2005-0560 EXP | Heap-based buffer overflow in the SvrAppendReceivedChunk function in xlsasink.dll in the SMTP service of Exchange Server 2000 and 2003 allows remote a… | Patch early | 7.5 high | 73% | 2005-05-02 |
| CVE-2012-0297 EXP | The management GUI in Symantec Web Gateway 5.0.x before 5.0.3 does not properly restrict access to application scripts, which allows remote attackers… | Patch early | 10.0 high | 73% | 2012-05-21 |
| CVE-2012-0394 EXP | The DebuggingInterceptor component in Apache Struts before 2.3.1.1, when developer mode is used, allows remote attackers to execute arbitrary commands… | Patch early | 6.8 medium | 72.9% | 2012-01-08 |
| CVE-2007-1674 EXP | Stack-based buffer overflow in the Alert Service (aolnsrvr.exe) in LANDesk Management Suite 8.7 allows remote attackers to execute arbitrary code via… | Patch early | 10.0 high | 72.9% | 2007-04-18 |
| CVE-1999-0256 EXP | Buffer overflow in War FTP allows remote execution of commands. | Patch early | 7.5 high | 72.9% | 1998-02-01 |
| CVE-2012-0262 EXP | op5config/welcome in system-op5config before 2.0.3 in op5 Monitor and op5 Appliance before 5.5.3 allows remote attackers to execute arbitrary commands… | Patch early | 10.0 high | 72.9% | 2013-12-31 |
| CVE-2015-2284 EXP | userlogin.jsp in SolarWinds Firewall Security Manager (FSM) before 6.6.5 HotFix1 allows remote attackers to gain privileges and execute arbitrary code… | Patch early | 10.0 high | 72.8% | 2015-03-24 |
| CVE-2014-6038 EXP | Zoho ManageEngine EventLog Analyzer versions 7 through 9.9 build 9002 have a database Information Disclosure Vulnerability. Fixed in EventLog Analyzer… | Patch early | 7.5 high | 72.8% | 2020-01-13 |
| CVE-2011-5007 EXP | Stack-based buffer overflow in the CmpWebServer component in 3S CoDeSys 3.4 SP4 Patch 2 and earlier, as used on the ABB AC500 PLC and possibly other p… | Patch early | 10.0 high | 72.7% | 2011-12-25 |
| CVE-2014-3828 EXP | Multiple SQL injection vulnerabilities in Centreon 2.5.1 and Centreon Enterprise Server 2.2 (fixed in Centreon web 2.5.3) allow remote attackers to ex… | Patch early | 10.0 high | 72.7% | 2014-10-23 |
| CVE-2008-6505 EXP | Multiple directory traversal vulnerabilities in Apache Struts 2.0.x before 2.0.12 and 2.1.x before 2.1.3 allow remote attackers to read arbitrary file… | Patch early | 5.0 medium | 72.7% | 2009-03-23 |
| CVE-2021-24862 EXP | The RegistrationMagic WordPress plugin before 5.0.1.6 does not escape user input in its rm_chronos_ajax AJAX action before using it in a SQL statement… | Patch early | 7.2 high | 72.7% | 2022-01-10 |
| CVE-2018-6389 EXP | In WordPress through 4.9.2, unauthenticated attackers can cause a denial of service (resource consumption) by using the large list of registered .js f… | Patch early | 7.5 high | 72.7% | 2018-02-06 |
| CVE-2002-1337 EXP | Buffer overflow in Sendmail 5.79 to 8.12.7 allows remote attackers to execute arbitrary code via certain formatted address fields, related to sender a… | Patch early | 10.0 high | 72.6% | 2003-03-07 |
| CVE-2009-1977 EXP | Unspecified vulnerability in the Oracle Secure Backup component in Oracle Secure Backup 10.2.0.3 allows remote attackers to affect confidentiality, in… | Patch early | 10.0 high | 72.6% | 2009-07-14 |
| CVE-2005-1348 EXP | Buffer overflow in HTTPMail in MailEnable Enterprise 1.04 and earlier and Professional 1.54 and earlier allows remote attackers to execute arbitrary c… | Patch early | 7.5 high | 72.6% | 2005-05-02 |
| CVE-2014-3914 EXP | Directory traversal vulnerability in the Admin Center for Tivoli Storage Manager (TSM) in Rocket ServerGraph 1.2 allows remote attackers to (1) create… | Patch early | 10.0 high | 72.6% | 2014-08-07 |
| CVE-2000-0945 EXP | The web configuration interface for Catalyst 3500 XL switches allows remote attackers to execute arbitrary commands without authentication when the en… | Patch early | 10.0 high | 72.6% | 2000-12-19 |
| CVE-2004-1315 EXP | viewtopic.php in phpBB 2.x before 2.0.11 improperly URL decodes the highlight parameter when extracting words and phrases to highlight, which allows r… | Patch early | 7.5 high | 72.5% | 2004-11-12 |
| CVE-2016-7241 EXP | Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) vi… | Patch early | 7.5 high | 72.5% | 2016-11-10 |
| CVE-2003-0001 EXP | Multiple ethernet Network Interface Card (NIC) device drivers do not pad frames with null bytes, which allows remote attackers to obtain information f… | Patch early | 5.0 medium | 72.5% | 2003-01-17 |
| CVE-2013-5331 EXP | Adobe Flash Player before 11.7.700.257 and 11.8.x and 11.9.x before 11.9.900.170 on Windows and Mac OS X and before 11.2.202.332 on Linux, Adobe AIR b… | Patch early | 9.3 high | 72.5% | 2013-12-11 |
| CVE-2004-1211 EXP | Multiple buffer overflows in the IMAP service in Mercury/32 4.01a allow remote authenticated users to cause a denial of service (application crash) an… | Patch early | 10.0 high | 72.5% | 2005-01-10 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt