CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
398,929 CVEs
1,728 on KEV
17,272 EPSS ≥ 10%
25,086 with exploits
synced 2026-09-29
318,191 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2017-8729 EXP | Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to execute arbitrary code in the context of the current user, due to the way that the M… | Patch early | 7.5 high | 72.2% | 2017-09-13 |
| CVE-2006-7196 EXP | Cross-site scripting (XSS) vulnerability in the calendar application example in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.31, 5.0.0 through… | Patch early | 4.3 medium | 72.2% | 2007-05-10 |
| CVE-2017-8636 EXP | Microsoft browsers in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold… | Patch early | 7.5 high | 72.1% | 2017-08-08 |
| CVE-2004-1315 EXP | viewtopic.php in phpBB 2.x before 2.0.11 improperly URL decodes the highlight parameter when extracting words and phrases to highlight, which allows r… | Patch early | 7.5 high | 72.1% | 2004-11-12 |
| CVE-2001-0236 EXP | Buffer overflow in Solaris snmpXdmid SNMP to DMI mapper daemon allows remote attackers to execute arbitrary commands via a long "indication" event. | Patch early | 10.0 high | 72% | 2001-05-03 |
| CVE-2007-4320 EXP | PHP remote file inclusion vulnerability in admin/addons/archive/archive.php in Ncaster 1.7.2 allows remote attackers to execute arbitrary PHP code via… | Patch early | 7.5 high | 72% | 2007-08-14 |
| CVE-2009-0478 EXP | Squid 2.7 to 2.7.STABLE5, 3.0 to 3.0.STABLE12, and 3.1 to 3.1.0.4 allows remote attackers to cause a denial of service via an HTTP request with an inv… | Patch early | 5.0 medium | 72% | 2009-02-08 |
| CVE-2017-16709 EXP | Crestron Airmedia AM-100 devices with firmware before 1.6.0 and AM-101 devices with firmware before 2.7.0 allows remote authenticated administrators t… | Patch early | 7.2 high | 72% | 2018-07-11 |
| CVE-2010-2263 EXP | nginx 0.8 before 0.8.40 and 0.7 before 0.7.66, when running on Windows, allows remote attackers to obtain source code or unparsed content of arbitrary… | Patch early | 5.0 medium | 71.9% | 2010-06-15 |
| CVE-2004-2271 EXP | Buffer overflow in MiniShare 1.4.1 and earlier allows remote attackers to execute arbitrary code via a long HTTP GET request. | Patch early | 7.5 high | 71.9% | 2004-12-31 |
| CVE-2012-0209 EXP | Horde 3.3.12, Horde Groupware 1.2.10, and Horde Groupware Webmail Edition 1.2.10, as distributed by FTP between November 2011 and February 2012, conta… | Patch early | 7.5 high | 71.9% | 2012-09-25 |
| CVE-2016-1543 EXP | The RPC API in the RSCD agent in BMC BladeLogic Server Automation (BSA) 8.2.x, 8.3.x, 8.5.x, 8.6.x, and 8.7.x on Linux and UNIX allows remote attacker… | Patch early | 7.5 high | 71.9% | 2016-06-13 |
| CVE-2010-5324 EXP | Directory traversal vulnerability in UploadServlet in the Remote Management component in Novell ZENworks Configuration Management (ZCM) 10 before 10.3… | Patch early | 10.0 high | 71.8% | 2015-06-07 |
| CVE-2009-3999 EXP | Stack-based buffer overflow in goform/formExportDataLogs in HP Power Manager before 4.2.10 allows remote attackers to execute arbitrary code via a lon… | Patch early | 10.0 high | 71.8% | 2010-01-20 |
| CVE-2009-3672 EXP | Microsoft Internet Explorer 6 and 7 does not properly handle objects in memory that (1) were not properly initialized or (2) are deleted, which allows… | Patch early | 9.3 high | 71.8% | 2009-12-02 |
| CVE-1999-1551 EXP | Buffer overflow in Ipswitch IMail Service 5.0 allows an attacker to cause a denial of service (crash) and possibly execute arbitrary commands via a lo… | Patch early | 5.0 medium | 71.8% | 1999-03-02 |
| CVE-2006-4305 EXP | Buffer overflow in SAP DB and MaxDB before 7.6.00.30 allows remote attackers to execute arbitrary code via a long database name when connecting via a… | Patch early | 10.0 high | 71.7% | 2006-08-30 |
| CVE-2010-3973 EXP | The WMITools ActiveX control in WBEMSingleView.ocx 1.50.1131.0 in Microsoft WMI Administrative Tools 1.1 and earlier in Microsoft Windows XP SP2 and S… | Patch early | 9.3 high | 71.7% | 2010-12-23 |
| CVE-2006-0564 EXP | Stack-based buffer overflow in Microsoft HTML Help Workshop 4.74.8702.0, and possibly earlier versions, and as included in the Microsoft HTML Help 1.4… | Patch early | 7.5 high | 71.7% | 2006-02-06 |
| CVE-2021-39327 EXP | The BulletProof Security WordPress plugin is vulnerable to sensitive information disclosure due to a file path disclosure in the publicly accessible ~… | Patch early | 5.3 medium | 71.7% | 2021-09-17 |
| CVE-2014-9727 EXP | AVM Fritz!Box allows remote attackers to execute arbitrary commands via shell metacharacters in the var:lang parameter to cgi-bin/webcm. | Patch early | 10.0 high | 71.7% | 2015-05-29 |
| CVE-2011-0267 EXP | Multiple buffer overflows in nnmRptConfig.exe in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53 allow remote attackers to execute arbitrary c… | Patch early | 10.0 high | 71.7% | 2011-01-13 |
| CVE-2019-19509 EXP | An issue was discovered in rConfig 3.9.3. A remote authenticated user can directly execute system commands by sending a GET request to ajaxArchiveFile… | Patch early | 8.8 high | 71.6% | 2020-01-06 |
| CVE-2011-3011 EXP | BaseServiceImpl.class in CA ARCserve D2D r15 does not properly handle sessions, which allows remote attackers to obtain credentials, and consequently… | Patch early | 5.0 medium | 71.6% | 2011-08-15 |
| CVE-2017-8641 EXP | Microsoft browsers in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold… | Patch early | 7.5 high | 71.6% | 2017-08-08 |
| CVE-2013-2751 EXP | Eval injection vulnerability in frontview/lib/np_handler.pl in the FrontView web interface in NETGEAR ReadyNAS RAIDiator before 4.1.12 and 4.2.x befor… | Patch early | 10.0 high | 71.6% | 2013-12-12 |
| CVE-2015-2845 EXP | The cpanel function in go_site.php in GoAutoDial GoAdmin CE before 3.3-1421902800 allows remote attackers to execute arbitrary commands via the $type… | Patch early | 10.0 high | 71.5% | 2015-05-12 |
| CVE-2007-5779 EXP | Buffer overflow in the GomManager (GomWeb Control) ActiveX control in GomWeb3.dll 1.0.0.12 in Gretech Online Movie Player (GOM Player) 2.1.6.3499 allo… | Patch early | 7.5 high | 71.5% | 2007-11-01 |
| CVE-2005-3683 EXP | Stack-based buffer overflow in freeFTPd before 1.0.9 with Logging enabled, allows remote attackers to cause a denial of service (application crash), a… | Patch early | 7.5 high | 71.5% | 2005-11-19 |
| CVE-2019-6977 EXP | gdImageColorMatch in gd_color_match.c in the GD Graphics Library (aka LibGD) 2.2.5, as used in the imagecolormatch function in PHP before 5.6.40, 7.x… | Patch early | 8.8 high | 71.5% | 2019-01-27 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt