CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
398,939 CVEs
1,728 on KEV
17,272 EPSS ≥ 10%
25,086 with exploits
synced 2026-09-29
149,010 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2003-0717 EXP | The Messenger Service for Windows NT through Server 2003 does not properly verify the length of the message, which allows remote attackers to execute… | Patch early | 7.5 high | 61% | 2003-11-17 |
| CVE-2003-0471 EXP | Buffer overflow in WebAdmin.exe for WebAdmin allows remote attackers to execute arbitrary code via an HTTP request to WebAdmin.dll with a long USER ar… | Patch early | 7.5 high | 61% | 2003-08-07 |
| CVE-2011-0807 EXP | Unspecified vulnerability in Oracle Sun GlassFish Enterprise Server 2.1, 2.1.1, and 3.0.1, and Sun Java System Application Server 9.1, allows remote a… | Patch early | 10.0 high | 60.9% | 2011-04-20 |
| CVE-2006-5792 EXP | Unspecified vulnerability in XLink Omni-NFS Enterprise allows remote attackers to execute arbitrary code via unspecified vectors, as demonstrated by v… | Patch early | 7.5 high | 60.9% | 2006-11-07 |
| CVE-2014-3913 EXP | Stack-based buffer overflow in AccessServer32.exe in Ericom AccessNow Server allows remote attackers to execute arbitrary code via a request for a non… | Patch early | 10.0 high | 60.9% | 2014-06-04 |
| CVE-2013-0757 EXP | The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird… | Patch early | 9.3 high | 60.9% | 2013-01-13 |
| CVE-2011-1260 EXP | Microsoft Internet Explorer 8 and 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a… | Patch early | 9.3 high | 60.8% | 2011-06-16 |
| CVE-2023-27179 EXP | GDidees CMS v3.9.1 and lower was discovered to contain an arbitrary file download vulenrability via the filename parameter at /_admin/imgdownload.php. | Patch early | 7.5 high | 60.8% | 2023-04-11 |
| CVE-2018-18982 EXP | NUUO CMS All versions 3.3 and prior the web server application allows injection of arbitrary SQL characters, which can be used to inject SQL into an e… | Patch early | 8.8 high | 60.8% | 2018-11-27 |
| CVE-2005-1415 EXP | Buffer overflow in GlobalSCAPE Secure FTP Server 3.0.2 allows remote authenticated users to execute arbitrary code via a long FTP command. | Patch early | 10.0 high | 60.8% | 2005-05-03 |
| CVE-2008-4572 EXP | GuildFTPd 0.999.14, and possibly other versions, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via… | Patch early | 10.0 high | 60.7% | 2008-10-15 |
| CVE-2015-7603 EXP | Directory traversal vulnerability in Konica Minolta FTP Utility 1.0 allows remote attackers to read arbitrary files via a ..\ (dot dot backslash) in a… | Patch early | 7.8 high | 60.7% | 2015-09-29 |
| CVE-2014-4725 EXP | The MailPoet Newsletters (wysija-newsletters) plugin before 2.6.7 for WordPress allows remote attackers to bypass authentication and execute arbitrary… | Patch early | 7.5 high | 60.7% | 2014-07-27 |
| CVE-2008-5444 EXP | Unspecified vulnerability in the Oracle Secure Backup component in Oracle Secure Backup 10.2.0.2 allows remote attackers to affect confidentiality, in… | Patch early | 10.0 high | 60.6% | 2009-01-14 |
| CVE-2004-2416 EXP | Buffer overflow in the logging component of CCProxy allows remote attackers to execute arbitrary code via a long HTTP GET request. | Patch early | 7.5 high | 60.6% | 2004-12-31 |
| CVE-2010-0478 EXP | Stack-based buffer overflow in nsum.exe in the Windows Media Unicast Service in Media Services for Microsoft Windows 2000 Server SP4 allows remote att… | Patch early | 9.3 high | 60.4% | 2010-04-14 |
| CVE-2004-1317 EXP | Stack-based buffer overflow in doexec.c in Netcat for Windows 1.1, when running with the -e option, allows remote attackers to execute arbitrary code… | Patch early | 7.5 high | 60.4% | 2004-12-27 |
| CVE-2005-2715 EXP | Format string vulnerability in the Java user interface service (bpjava-msvc) daemon for VERITAS NetBackup Data and Business Center 4.5FP and 4.5MP, an… | Patch early | 10.0 high | 60.4% | 2005-10-12 |
| CVE-2014-2849 EXP | The Change Password dialog box (change_password) in Sophos Web Appliance before 3.8.2 allows remote authenticated users to change the admin user passw… | Patch early | 8.5 high | 60.3% | 2014-04-11 |
| CVE-2002-1059 EXP | Buffer overflow in Van Dyke SecureCRT SSH client before 3.4.6, and 4.x before 4.0 beta 3, allows an SSH server to execute arbitrary code via a long SS… | Patch early | 7.5 high | 60.3% | 2002-10-04 |
| CVE-2004-0575 EXP | Integer overflow in DUNZIP32.DLL for Microsoft Windows XP, Windows XP 64-bit Edition, Windows Server 2003, and Windows Server 2003 64-bit Edition allo… | Patch early | 10.0 high | 60.3% | 2004-11-03 |
| CVE-2006-6424 EXP | Multiple buffer overflows in Novell NetMail before 3.52e FTF2 allow remote attackers to execute arbitrary code (1) by appending literals to certain IM… | Patch early | 9.0 high | 60.3% | 2006-12-27 |
| CVE-2007-2280 EXP | Stack-based buffer overflow in OmniInet.exe (aka the backup client service daemon) in the Application Recovery Manager component in HP OpenView Storag… | Patch early | 10.0 high | 60.3% | 2009-12-18 |
| CVE-2011-0257 EXP | Integer signedness error in Apple QuickTime before 7.7 allows remote attackers to execute arbitrary code or cause a denial of service (application cra… | Patch early | 9.3 high | 60.1% | 2011-08-15 |
| CVE-2005-0595 EXP | Buffer overflow in ext.dll in BadBlue 2.55 allows remote attackers to execute arbitrary code via a long mfcisapicommand parameter. | Patch early | 7.5 high | 60.1% | 2005-05-02 |
| CVE-2013-0810 EXP | Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, and Windows Server 2008 SP2 allow remote attackers to execute arbitrary… | Patch early | 8.1 high | 59.9% | 2013-09-11 |
| CVE-2024-31621 EXP | An issue in FlowiseAI Inc Flowise v.1.6.2 and before allows a remote attacker to execute arbitrary code via a crafted script to the api/v1 component. | Patch early | 7.6 high | 59.9% | 2024-04-29 |
| CVE-2005-0053 EXP | Internet Explorer 5.01, 5.5, and 6 allows remote attackers to execute arbitrary code via drag and drop events, aka the "Drag-and-Drop Vulnerability." | Patch early | 7.5 high | 59.8% | 2005-05-02 |
| CVE-2007-6019 EXP | Adobe Flash Player 9.0.115.0 and earlier, and 8.0.39.0 and earlier, allows remote attackers to execute arbitrary code via an SWF file with a modified… | Patch early | 9.3 high | 59.8% | 2008-04-09 |
| CVE-2021-46417 EXP | Insecure handling of a download function leads to disclosure of internal files due to path traversal with root privileges in Franklin Fueling Systems… | Patch early | 7.5 high | 59.8% | 2022-04-07 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt