CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
425,729 CVEs
1,781 on KEV
17,555 EPSS ≥ 10%
25,095 with exploits
synced 2026-11-14
179,241 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2019-12461 EXP | Web Port 1.19.1 allows XSS via the /log type parameter. | Patch early | 6.1 medium | 9.3% | 2019-05-30 |
| CVE-2008-0073 EXP | Array index error in the sdpplin_parse function in input/libreal/sdpplin.c in xine-lib 1.1.10.1 allows remote RTSP servers to execute arbitrary code v… | Patch early | 6.8 medium | 9.3% | 2008-03-24 |
| CVE-2004-2526 EXP | Directory traversal vulnerability in ldacgi.exe in IBM Tivoli Directory Server 4.1 and earlier allows remote attackers to view arbitrary files via a .… | Patch early | 5.0 medium | 9.3% | 2004-12-31 |
| CVE-2023-38501 EXP | copyparty is file server software. Prior to version 1.8.7, the application contains a reflected cross-site scripting via URL-parameter `?k304=...` and… | Patch early | 6.3 medium | 9.2% | 2023-07-25 |
| CVE-2002-0772 EXP | Directory traversal vulnerability in dsnmanager.asp for Hosting Controller allows remote attackers to read arbitrary files and directories via a .. (d… | Patch early | 6.4 medium | 9.2% | 2002-08-12 |
| CVE-2002-1559 EXP | Directory traversal vulnerability in ion-p.exe (aka ion-p) allows remote attackers to read arbitrary files via (1) C: (drive letter) or (2) .. (dot-do… | Patch early | 5.0 medium | 9.2% | 2003-03-31 |
| CVE-2014-9225 EXP | The ajaxswing webui in the management server in Symantec Critical System Protection (SCSP) 5.2.9 through MP6 and Symantec Data Center Security: Server… | Patch early | 4.0 medium | 9.2% | 2015-01-21 |
| CVE-2009-1045 EXP | requests/status.xml in VLC 0.9.8a allows remote attackers to cause a denial of service (stack consumption and crash) via a long input argument in an i… | Patch early | 5.0 medium | 9.2% | 2009-03-23 |
| CVE-2006-2901 EXP | The web server for D-Link Wireless Access-Point (DWL-2100ap) firmware 2.10na and earlier allows remote attackers to obtain sensitive system informatio… | Patch early | 5.0 medium | 9.2% | 2006-06-07 |
| CVE-2001-0748 EXP | Acme.Serve 1.7, as used in Cisco Secure ACS Unix and possibly other products, allows remote attackers to read arbitrary files by prepending several /… | Patch early | 5.0 medium | 9.2% | 2001-10-18 |
| CVE-2011-0678 EXP | Unrestricted file upload vulnerability in the EasyEdit module in Lomtec ActiveWeb Professional 3.0 allows remote attackers to execute arbitrary code b… | Patch early | 6.8 medium | 9.2% | 2011-01-28 |
| CVE-2006-2458 EXP | Multiple heap-based buffer overflows in Libextractor 0.5.13 and earlier allow remote attackers to execute arbitrary code via (1) the asf_read_header f… | Patch early | 4.0 medium | 9.2% | 2006-05-18 |
| CVE-2011-4898 EXP | wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier generates different error messages for requests lacking a dbnam… | Patch early | 5.0 medium | 9.2% | 2012-01-30 |
| CVE-2013-2287 EXP | Multiple cross-site scripting (XSS) vulnerabilities in views/notify.php in the Uploader plugin 1.0.4 for WordPress allow remote attackers to inject ar… | Patch early | 4.3 medium | 9.2% | 2014-04-04 |
| CVE-2006-3372 EXP | Apple Safari 2.0.4/419.3 allows remote attackers to cause a denial of service (application crash) via a DHTML setAttributeNode function call with zero… | Patch early | 5.0 medium | 9.2% | 2006-07-06 |
| CVE-2006-4006 EXP | The do_gameinfo function in BomberClone 0.11.6 and earlier, and possibly other functions, does not reset the packet data size, which causes the send_p… | Patch early | 5.0 medium | 9.2% | 2006-08-07 |
| CVE-2000-0613 EXP | Cisco Secure PIX Firewall does not properly identify forged TCP Reset (RST) packets, which allows remote attackers to force the firewall to close legi… | Patch early | 5.0 medium | 9.2% | 2000-03-20 |
| CVE-2008-6976 EXP | MikroTik RouterOS 3.x through 3.13 and 2.x through 2.9.51 allows remote attackers to modify Network Management System (NMS) settings via a crafted SNM… | Patch early | 6.4 medium | 9.2% | 2009-08-19 |
| CVE-2005-0828 EXP | highlight.php in (1) RUNCMS 1.1A, (2) CIAMOS 0.9.2 RC1, (3) e-Xoops 1.05 Rev3, and possibly other products based on e-Xoops (exoops), allows remote at… | Patch early | 5.0 medium | 9.2% | 2005-05-02 |
| CVE-2007-6318 EXP | SQL injection vulnerability in wp-includes/query.php in WordPress 2.3.1 and earlier allows remote attackers to execute arbitrary SQL commands via the… | Patch early | 6.8 medium | 9.2% | 2007-12-12 |
| CVE-2011-5219 EXP | Directory traversal vulnerability in examples/show_code.php in mPDF 5.3 and earlier allows remote attackers to read arbitrary files via a .. (dot dot)… | Patch early | 5.0 medium | 9.2% | 2012-10-25 |
| CVE-2008-0623 EXP | Stack-based buffer overflow in the YMP Datagrid ActiveX control (datagrid.dll) in Yahoo! Music Jukebox 2.2.2.056 allows remote attackers to execute ar… | Patch early | 4.3 medium | 9.2% | 2008-02-06 |
| CVE-2014-3848 EXP | The iMember360 plugin before 3.9.001 for WordPress does not properly restrict access, which allows remote attackers to obtain database credentials via… | Patch early | 5.0 medium | 9.1% | 2014-05-23 |
| CVE-2010-3804 EXP | The JavaScript implementation in WebKit in Apple Safari before 5.0.3 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.3 on Mac OS X 10.4, use… | Patch early | 5.0 medium | 9.1% | 2010-11-22 |
| CVE-2008-5660 EXP | Format string vulnerability in the vinagre_utils_show_error function (src/vinagre-utils.c) in Vinagre 0.5.x before 0.5.2 and 2.x before 2.24.2 might a… | Patch early | 6.8 medium | 9.1% | 2008-12-17 |
| CVE-1999-0669 EXP | The Eyedog ActiveX control is marked as "safe for scripting" for Internet Explorer, which allows a remote attacker to execute arbitrary commands as de… | Patch early | 4.0 medium | 9.1% | 1999-09-01 |
| CVE-2006-2555 EXP | The parse_command function in Genecys 0.2 and earlier allows remote attackers to cause a denial of service (crash) via a command with a missing ":" (c… | Patch early | 5.0 medium | 9.1% | 2006-05-24 |
| CVE-2015-3301 EXP | Directory traversal vulnerability in the TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin) plugin for WordPress b… | Patch early | 4.0 medium | 9.1% | 2015-05-14 |
| CVE-2003-1396 EXP | Heap-based buffer overflow in Opera 6.05 through 7.10 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code… | Patch early | 6.8 medium | 9.1% | 2003-12-31 |
| CVE-2014-3004 EXP | The default configuration for the Xerces SAX Parser in Castor before 1.3.3 allows context-dependent attackers to conduct XML External Entity (XXE) att… | Patch early | 4.3 medium | 9.1% | 2014-06-11 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt