CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
398,935 CVEs
1,728 on KEV
17,272 EPSS ≥ 10%
25,086 with exploits
synced 2026-09-29
318,195 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2006-6076 EXP | Buffer overflow in the Tape Engine (tapeeng.exe) in CA (formerly Computer Associates) BrightStor ARCserve Backup 11.5 and earlier allows remote attack… | Patch early | 10.0 high | 70.9% | 2006-11-24 |
| CVE-2020-11456 EXP | LimeSurvey before 4.1.12+200324 has stored XSS in application/views/admin/surveysgroups/surveySettings.php and application/models/SurveysGroups.php (a… | Patch early | 5.4 medium | 70.8% | 2020-04-01 |
| CVE-2005-2799 EXP | Buffer overflow in apply.cgi in Linksys WRT54G 3.01.03, 3.03.6, and possibly other versions before 4.20.7, allows remote attackers to execute arbitrar… | Patch early | 7.5 high | 70.8% | 2005-09-15 |
| CVE-2018-18323 EXP | CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.480 has Local File Inclusion via directory traversal with an admin/index.php?module=file_editor&f… | Patch early | 7.5 high | 70.7% | 2018-10-15 |
| CVE-2001-0168 EXP | Buffer overflow in AT&T WinVNC (Virtual Network Computing) server 3.3.3r7 and earlier allows remote attackers to execute arbitrary commands via a long… | Patch early | 10.0 high | 70.7% | 2001-05-03 |
| CVE-2018-8279 EXP | A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory Corruption Vulnerab… | Patch early | 7.5 high | 70.7% | 2018-07-11 |
| CVE-2014-1762 EXP | Unspecified vulnerability in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code with medium-integrity privileg… | Patch early | 7.5 high | 70.7% | 2014-04-27 |
| CVE-2008-0166 EXP | OpenSSL 0.9.8c-1 up to versions before 0.9.8g-9 on Debian-based operating systems uses a random number generator that generates predictable numbers, w… | Patch early | 7.5 high | 70.7% | 2008-05-13 |
| CVE-2007-3431 EXP | PHP remote file inclusion vulnerability in cal.func.php in Valerio Capello Dagger - The Cutting Edge r23jan2007 allows remote attackers to execute arb… | Patch early | 6.8 medium | 70.7% | 2007-06-27 |
| CVE-2006-6423 EXP | Stack-based buffer overflow in the IMAP service for MailEnable Professional and Enterprise Edition 2.0 through 2.35, Professional Edition 1.6 through… | Patch early | 10.0 high | 70.7% | 2006-12-12 |
| CVE-2006-2926 EXP | Stack-based buffer overflow in the WWW Proxy Server of Qbik WinGate 6.1.1.1077 allows remote attackers to cause a denial of service and possibly execu… | Patch early | 7.5 high | 70.7% | 2006-06-09 |
| CVE-2009-4195 EXP | Buffer overflow in Adobe Illustrator CS4 14.0.0, CS3 13.0.3 and earlier, and CS3 13.0.0 allows remote attackers to execute arbitrary code via a long D… | Patch early | 9.3 high | 70.7% | 2009-12-04 |
| CVE-2024-4367 EXP | A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. This vulnerability aff… | Patch early | 8.8 high | 70.7% | 2024-05-14 |
| CVE-2014-4880 EXP | Buffer overflow in Hikvision DVR DS-7204 Firmware 2.2.10 build 131009, and other models and versions, allows remote attackers to execute arbitrary cod… | Patch early | 7.5 high | 70.7% | 2014-12-08 |
| CVE-2007-2607 EXP | PHP remote file inclusion vulnerability in views/print/printbar.php in LaVague 0.3 and earlier allows remote attackers to execute arbitrary PHP code v… | Patch early | 7.5 high | 70.6% | 2007-05-11 |
| CVE-2007-2676 EXP | PHP remote file inclusion vulnerability in skins/header.php in Open Translation Engine (OTE) 0.7.8 allows remote attackers to execute arbitrary PHP co… | Patch early | 7.5 high | 70.6% | 2007-05-14 |
| CVE-2006-6565 EXP | FileZilla Server before 0.9.22 allows remote attackers to cause a denial of service (crash) via a wildcard argument to the (1) LIST or (2) NLST comman… | Patch early | 4.0 medium | 70.6% | 2006-12-15 |
| CVE-2010-1553 EXP | Stack-based buffer overflow in getnnmdata.exe in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allows remote attackers to execute arb… | Patch early | 10.0 high | 70.6% | 2010-05-13 |
| CVE-2001-1243 EXP | Scripting.FileSystemObject in asp.dll for Microsoft IIS 4.0 and 5.0 allows local or remote attackers to cause a denial of service (crash) via (1) crea… | Patch early | 5.0 medium | 70.5% | 2001-07-04 |
| CVE-2021-2109 EXP | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.… | Patch early | 7.2 high | 70.4% | 2021-01-20 |
| CVE-2015-0336 EXP | Adobe Flash Player before 13.0.0.277 and 14.x through 17.x before 17.0.0.134 on Windows and OS X and before 11.2.202.451 on Linux allows attackers to… | Patch early | 9.3 high | 70.4% | 2015-03-13 |
| CVE-2007-0584 EXP | PHP remote file inclusion vulnerability in membres/membreManager.php in PhP Generic Library & Framework for comm (g-neric) allows remote attackers to… | Patch early | 7.5 high | 70.4% | 2007-01-30 |
| CVE-2016-7288 EXP | The scripting engines in Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafte… | Patch early | 7.5 high | 70.4% | 2016-12-20 |
| CVE-2006-6183 EXP | Multiple stack-based buffer overflows in 3Com 3CTftpSvc 2.0.1, and possibly earlier, allow remote attackers to cause a denial of service (crash) or ex… | Patch early | 10.0 high | 70.3% | 2006-12-01 |
| CVE-2005-0045 EXP | The Server Message Block (SMB) implementation for Windows NT 4.0, 2000, XP, and Server 2003 does not properly validate certain SMB packets, which allo… | Patch early | 7.5 high | 70.3% | 2005-05-02 |
| CVE-2017-8634 EXP | Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to execute arbitrary code in the context of the current user due to the way that Micros… | Patch early | 7.5 high | 70.3% | 2017-08-08 |
| CVE-2006-1185 EXP | Unspecified vulnerability in Microsoft Internet Explorer 5.01 through 6 allows remote attackers to execute arbitrary code via certain invalid HTML tha… | Patch early | 7.5 high | 70.3% | 2006-04-11 |
| CVE-2012-4869 EXP | The callme_startcall function in recordings/misc/callme_page.php in FreePBX 2.9, 2.10, and earlier allows remote attackers to execute arbitrary comman… | Patch early | 7.5 high | 70.3% | 2012-09-06 |
| CVE-2013-2460 EXP | Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, and OpenJDK 7, allows remote atta… | Patch early | 9.3 high | 70.2% | 2013-06-18 |
| CVE-2003-0001 EXP | Multiple ethernet Network Interface Card (NIC) device drivers do not pad frames with null bytes, which allows remote attackers to obtain information f… | Patch early | 5.0 medium | 70.2% | 2003-01-17 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt