CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
399,003 CVEs
1,728 on KEV
17,272 EPSS ≥ 10%
25,086 with exploits
synced 2026-09-29
205,718 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2015-7254 EXP | Directory traversal vulnerability on Huawei HG532e, HG532n, and HG532s devices allows remote attackers to read arbitrary files via a .. (dot dot) in a… | Patch early | 5.0 medium | 27.5% | 2015-11-07 |
| CVE-2017-1002000 EXP | Vulnerability in wordpress plugin mobile-friendly-app-builder-by-easytouch v3.0, The code in file ./mobile-friendly-app-builder-by-easytouch/server/im… | Patch early | 9.8 critical | 27.4% | 2017-09-14 |
| CVE-2001-0951 EXP | Windows 2000 allows remote attackers to cause a denial of service (CPU consumption) by flooding Internet Key Exchange (IKE) UDP port 500 with packets… | Patch early | 5.0 medium | 27.4% | 2001-12-07 |
| CVE-2019-11013 EXP | Nimble Streamer 3.0.2-2 through 3.5.4-9 has a ../ directory traversal vulnerability. Successful exploitation could allow an attacker to traverse the f… | Patch early | 6.5 medium | 27.4% | 2019-08-22 |
| CVE-2022-24632 EXP | An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. It is directory traversal during file download via the BrowseFil… | Patch early | 5.3 medium | 27.4% | 2023-05-29 |
| CVE-2012-4356 EXP | Multiple directory traversal vulnerabilities in Sielco Sistemi Winlog Pro SCADA before 2.07.17 and Winlog Lite SCADA before 2.07.17 allow remote attac… | Patch early | 4.3 medium | 27.4% | 2012-08-19 |
| CVE-2017-16562 EXP | The UserPro plugin before 4.9.17.1 for WordPress, when used on a site with the "admin" username, allows remote attackers to bypass authentication and… | Patch early | 9.8 critical | 27.4% | 2017-11-10 |
| CVE-2003-0543 EXP | Integer overflow in OpenSSL 0.9.6 and 0.9.7 allows remote attackers to cause a denial of service (crash) via an SSL client certificate with certain AS… | Patch early | 5.0 medium | 27.4% | 2003-11-17 |
| CVE-2002-0936 EXP | The Java Server Pages (JSP) engine in Tomcat allows web page owners to cause a denial of service (engine crash) on the web server via a JSP page that… | Patch early | 5.0 medium | 27.3% | 2002-10-04 |
| CVE-2011-5057 EXP | Apache Struts 2.3.1.2 and earlier, 2.3.19-2.3.23, provides interfaces that do not properly restrict access to collections such as the session and requ… | Patch early | 5.0 medium | 27.2% | 2012-01-08 |
| CVE-2012-1465 EXP | Stack-based buffer overflow in the HTTP Server in NetMechanica NetDecision before 4.6.1 allows remote attackers to cause a denial of service (applicat… | Patch early | 4.3 medium | 27.1% | 2012-03-19 |
| CVE-2018-7750 EXP | transport.py in the SSH server implementation of Paramiko before 1.17.6, 1.18.x before 1.18.5, 2.0.x before 2.0.8, 2.1.x before 2.1.5, 2.2.x before 2.… | Patch early | 9.8 critical | 27.1% | 2018-03-13 |
| CVE-2013-3522 EXP | SQL injection vulnerability in index.php/ajax/api/reputation/vote in vBulletin 5.0.0 Beta 11, 5.0.0 Beta 28, and earlier allows remote authenticated u… | Patch early | 6.5 medium | 27.1% | 2013-05-10 |
| CVE-2002-1567 EXP | Cross-site scripting (XSS) vulnerability in Apache Tomcat 4.1 allows remote attackers to execute arbitrary web script and steal cookies via a URL with… | Patch early | 6.8 medium | 27.1% | 2003-10-06 |
| CVE-2017-18357 EXP | Shopware before 5.3.4 has a PHP Object Instantiation issue via the sort parameter to the loadPreviewAction() method of the Shopware_Controllers_Backen… | Patch early | 6.5 medium | 27.1% | 2019-01-15 |
| CVE-2018-14665 EXP | A flaw was found in xorg-x11-server before 1.20.3. An incorrect permission check for -modulepath and -logfile options when starting Xorg. X server all… | Patch early | 6.6 medium | 27% | 2018-10-25 |
| CVE-2013-6719 EXP | delivery.php in the Passive Capture Application (PCA) web console in IBM Tealeaf CX 7.x, 8.x through 8.6, 8.7 before FP2, and 8.8 before FP2 allows re… | Patch early | 6.0 medium | 27% | 2014-03-06 |
| CVE-2006-5296 EXP | PowerPoint in Microsoft Office 2003 does not properly handle a container object whose position value exceeds the record length, which allows user-assi… | Patch early | 4.3 medium | 27% | 2006-10-16 |
| CVE-2010-4804 EXP | The Android browser in Android before 2.3.4 allows remote attackers to obtain SD card contents via crafted content:// URIs, related to (1) BrowserActi… | Patch early | 4.3 medium | 27% | 2011-06-09 |
| CVE-2016-4203 EXP | Adobe Reader and Acrobat before 11.0.17, Acrobat and Acrobat Reader DC Classic before 15.006.30198, and Acrobat and Acrobat Reader DC Continuous befor… | Patch early | 9.8 critical | 26.9% | 2016-07-13 |
| CVE-2020-35314 EXP | A remote code execution vulnerability in the installUpdateThemePluginAction function in index.php in WonderCMS 3.1.3, allows remote attackers to uploa… | Patch early | 9.8 critical | 26.9% | 2021-04-20 |
| CVE-2003-1025 EXP | Internet Explorer 5.01 through 6 SP1 allows remote attackers to spoof the domain of a URL via a "%01" character before an @ sign in the user@domain po… | Patch early | 4.3 medium | 26.9% | 2004-01-20 |
| CVE-2007-5775 EXP | Unspecified vulnerability in BitDefender allows attackers to execute arbitrary code via unspecified vectors, aka EEYEB-20071024. NOTE: as of 20071029… | Patch early | 9.8 critical | 26.9% | 2007-11-01 |
| CVE-2000-0653 EXP | Microsoft Outlook Express allows remote attackers to monitor a user's email by creating a persistent browser link to the Outlook Express windows, aka… | Patch early | 5.0 medium | 26.9% | 2000-07-20 |
| CVE-2017-6359 EXP | QNAP QTS before 4.2.4 Build 20170313 allows attackers to gain administrator privileges and execute arbitrary commands via unspecified vectors. | Patch early | 9.8 critical | 26.9% | 2017-03-23 |
| CVE-2004-0558 EXP | The Internet Printing Protocol (IPP) implementation in CUPS before 1.1.21 allows remote attackers to cause a denial of service (service hang) via a ce… | Patch early | 5.0 medium | 26.8% | 2004-09-28 |
| CVE-2020-11819 EXP | In Rukovoditel 2.5.2, an attacker may inject an arbitrary .php file location instead of a language file and thus achieve command execution. | Patch early | 9.8 critical | 26.8% | 2020-04-16 |
| CVE-2009-0026 EXP | Multiple cross-site scripting (XSS) vulnerabilities in Apache Jackrabbit before 1.5.2 allow remote attackers to inject arbitrary web script or HTML vi… | Patch early | 4.3 medium | 26.8% | 2009-01-21 |
| CVE-2015-2166 EXP | Directory traversal vulnerability in the Instance Monitor in Ericsson Drutt Mobile Service Delivery Platform (MSDP) 4, 5, and 6 allows remote attacker… | Patch early | 5.0 medium | 26.8% | 2015-04-06 |
| CVE-2008-4029 EXP | Cross-domain vulnerability in Microsoft XML Core Services 3.0 and 4.0, as used in Internet Explorer, allows remote attackers to obtain sensitive infor… | Patch early | 4.3 medium | 26.7% | 2008-11-12 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt