CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
425,729 CVEs
1,781 on KEV
17,555 EPSS ≥ 10%
25,095 with exploits
synced 2026-11-14
197,459 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2010-0361 EXP | Stack-based buffer overflow in the WebDAV implementation in webservd in Sun Java System Web Server (aka SJWS) 7.0 Update 7 allows remote attackers to… | Patch early | 10.0 high | 80.4% | 2010-01-20 |
| CVE-2008-0244 EXP | SAP MaxDB 7.6.03 build 007 and earlier allows remote attackers to execute arbitrary commands via "&&" and other shell metacharacters in exec_sdbinfo a… | Patch early | 10.0 high | 80.3% | 2008-01-12 |
| CVE-2003-0349 EXP | Buffer overflow in the streaming media component for logging multicast requests in the ISAPI for the logging capability of Microsoft Windows Media Ser… | Patch early | 7.5 high | 80.3% | 2003-07-24 |
| CVE-2007-5365 EXP | Stack-based buffer overflow in the cons_options function in options.c in dhcpd in OpenBSD 4.0 through 4.2, and some other dhcpd implementations based… | Patch early | 7.2 high | 80.3% | 2007-10-11 |
| CVE-2014-3829 EXP | displayServiceStatus.php in Centreon 2.5.1 and Centreon Enterprise Server 2.2 (fixed in Centreon web 2.5.3) allows remote attackers to execute arbitra… | Patch early | 10.0 high | 80.2% | 2014-10-23 |
| CVE-2014-9583 EXP | common.c in infosvr in ASUS WRT firmware 3.0.0.4.376_1071, 3.0.0.376.2524-g0013f52, and other versions, as used in RT-AC66U, RT-N66U, and other router… | Patch early | 10.0 high | 80.2% | 2015-01-08 |
| CVE-2002-1359 EXP | Multiple SSH2 servers and clients do not properly handle large packets or large fields, which may allow remote attackers to cause a denial of service… | Patch early | 10.0 high | 80.2% | 2002-12-23 |
| CVE-2015-7387 EXP | ZOHO ManageEngine EventLog Analyzer 10.6 build 10060 and earlier allows remote attackers to bypass intended restrictions and execute arbitrary SQL com… | Patch early | 7.5 high | 80.2% | 2015-09-28 |
| CVE-2019-0567 EXP | A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scri… | Patch early | 7.5 high | 80.1% | 2019-01-08 |
| CVE-2018-12465 EXP | An OS command injection vulnerability in the web administration component of Micro Focus Secure Messaging Gateway (SMG) allows a remote attacker authe… | Patch early | 9.1 critical | 80% | 2018-06-29 |
| CVE-2006-3677 EXP | Mozilla Firefox 1.5 before 1.5.0.5 and SeaMonkey before 1.0.3 allows remote attackers to execute arbitrary code by changing certain properties of the… | Patch early | 7.5 high | 80% | 2006-07-27 |
| CVE-2013-5743 EXP | Multiple SQL injection vulnerabilities in Zabbix 1.8.x before 1.8.18rc1, 2.0.x before 2.0.9rc1, and 2.1.x before 2.1.7. | Patch early | 9.8 critical | 80% | 2019-12-11 |
| CVE-2006-4691 EXP | Stack-based buffer overflow in the NetpManageIPCConnect function in the Workstation service (wkssvc.dll) in Microsoft Windows 2000 SP4 and XP SP2 allo… | Patch early | 10.0 high | 80% | 2006-11-14 |
| CVE-2019-11600 EXP | A SQL injection vulnerability in the activities API in OpenProject before 8.3.2 allows a remote attacker to execute arbitrary SQL commands via the id… | Patch early | 8.1 high | 80% | 2019-05-13 |
| CVE-2019-4279 EXP | IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to execute arbitrary code on the system with a specially-crafted sequence o… | Patch early | 9.8 critical | 79.9% | 2019-05-17 |
| CVE-2006-4777 EXP | Heap-based buffer overflow in the DirectAnimation Path Control (DirectAnimation.PathControl) COM object (daxctle.ocx) for Internet Explorer 6.0 SP1, o… | Patch early | 7.6 high | 79.9% | 2006-09-14 |
| CVE-2013-6829 EXP | admin/confnetworking.html in PineApp Mail-SeCure allows remote attackers to execute arbitrary commands via shell metacharacters in the pinghost parame… | Patch early | 7.5 high | 79.9% | 2013-11-20 |
| CVE-2021-42362 EXP | The WordPress Popular Posts WordPress plugin is vulnerable to arbitrary file uploads due to insufficient input file type validation found in the ~/src… | Patch early | 8.8 high | 79.8% | 2021-11-17 |
| CVE-2017-12557 EXP | A Remote Code Execution vulnerability in HPE intelligent Management Center (iMC) PLAT version IMC Plat 7.3 E0504P2 and earlier was found. | Patch early | 9.8 critical | 79.8% | 2018-02-15 |
| CVE-2004-1080 EXP | The WINS service (wins.exe) on Microsoft Windows NT Server 4.0, Windows 2000 Server, and Windows Server 2003 allows remote attackers to write to arbit… | Patch early | 10.0 high | 79.8% | 2005-01-10 |
| CVE-2007-0449 EXP | Multiple buffer overflows in LGSERVER.EXE in CA BrightStor ARCserve Backup for Laptops and Desktops r11.0 through r11.1 SP1, Mobile Backup r4.0, Deskt… | Patch early | 10.0 high | 79.8% | 2007-01-23 |
| CVE-2012-1495 EXP | install/index.php in WebCalendar before 1.2.5 allows remote attackers to execute arbitrary code via the form_single_user_login parameter. | Patch early | 9.8 critical | 79.8% | 2020-01-27 |
| CVE-2016-2555 EXP | SQL injection vulnerability in include/lib/mysql_connect.inc.php in ATutor 2.2.1 allows remote attackers to execute arbitrary SQL commands via the sea… | Patch early | 9.8 critical | 79.8% | 2017-04-13 |
| CVE-2014-7866 EXP | Multiple directory traversal vulnerabilities in ZOHO ManageEngine OpManager 8 (build 88xx) through 11.4, IT360 10.3 and 10.4, and Social IT Plus 11.0… | Patch early | 7.5 high | 79.8% | 2014-12-10 |
| CVE-2016-6563 EXP | Processing malformed SOAP messages when performing the HNAP Login action causes a buffer overflow in the stack in some D-Link DIR routers. The vulnera… | Patch early | 9.8 critical | 79.7% | 2018-07-13 |
| CVE-2018-10583 EXP | An information disclosure vulnerability occurs when LibreOffice 6.0.3 and Apache OpenOffice Writer 4.1.5 automatically process and initiate an SMB con… | Patch early | 7.5 high | 79.5% | 2018-05-01 |
| CVE-2006-5276 EXP | Stack-based buffer overflow in the DCE/RPC preprocessor in Snort before 2.6.1.3, and 2.7 before beta 2; and Sourcefire Intrusion Sensor; allows remote… | Patch early | 10.0 high | 79.4% | 2007-02-20 |
| CVE-2008-5499 EXP | Unspecified vulnerability in Adobe Flash Player for Linux 10.0.12.36, and 9.0.151.0 and earlier, allows remote attackers to execute arbitrary code via… | Patch early | 9.3 high | 79.4% | 2008-12-18 |
| CVE-2006-5143 EXP | Multiple buffer overflows in CA BrightStor ARCserve Backup r11.5 SP1 and earlier, r11.1, and 9.01; BrightStor ARCserve Backup for Windows r11; BrightS… | Patch early | 7.5 high | 79.4% | 2006-10-10 |
| CVE-2014-4872 EXP | BMC Track-It! 11.3.0.355 does not require authentication on TCP port 9010, which allows remote attackers to upload arbitrary files, execute arbitrary… | Patch early | 7.5 high | 79.3% | 2014-10-10 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt