CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
399,157 CVEs
1,728 on KEV
17,272 EPSS ≥ 10%
25,086 with exploits
synced 2026-09-29
185,580 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2009-0837 EXP | Stack-based buffer overflow in Foxit Reader 3.0 before Build 1506, including 1120 and 1301, allows remote attackers to execute arbitrary code via a lo… | Patch early | 10.0 high | 75.8% | 2009-03-10 |
| CVE-2017-1092 EXP | IBM Informix Open Admin Tool 11.5, 11.7, and 12.1 could allow an unauthorized user to execute arbitrary code as system admin on Windows servers. IBM X… | Patch early | 9.8 critical | 75.8% | 2017-05-22 |
| CVE-2010-2550 EXP | The SMB Server in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Win… | Patch early | 10.0 high | 75.7% | 2010-08-11 |
| CVE-2022-2884 EXP | A vulnerability in GitLab CE/EE affecting all versions from 11.3.4 prior to 15.1.5, 15.2 to 15.2.3, 15.3 to 15.3 to 15.3.1 allows an an authenticated… | Patch early | 9.9 critical | 75.7% | 2022-10-17 |
| CVE-2004-0847 EXP | The Microsoft .NET forms authentication capability for ASP.NET allows remote attackers to bypass authentication for .aspx files in restricted director… | Patch early | 9.8 critical | 75.7% | 2004-11-03 |
| CVE-2014-9735 EXP | The ThemePunch Slider Revolution (revslider) plugin before 3.0.96 for WordPress and Showbiz Pro plugin 1.7.1 and earlier for Wordpress does not proper… | Patch early | 7.5 high | 75.7% | 2015-06-30 |
| CVE-2011-2371 EXP | Integer overflow in the Array.reduceRight method in Mozilla Firefox before 3.6.18 and 4.x through 4.0.1, Thunderbird before 3.1.11, and SeaMonkey thro… | Patch early | 10.0 high | 75.7% | 2011-06-30 |
| CVE-2022-1162 EXP | A hardcoded password was set for accounts registered using an OmniAuth provider (e.g. OAuth, LDAP, SAML) in GitLab CE/EE versions 14.7 prior to 14.7.7… | Patch early | 9.1 critical | 75.6% | 2022-04-04 |
| CVE-2010-2729 EXP | The Print Spooler service in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and… | Patch early | 9.3 high | 75.6% | 2010-09-15 |
| CVE-2018-9160 EXP | SickRage before v2018.03.09-1 includes cleartext credentials in HTTP responses. | Patch early | 9.8 critical | 75.6% | 2018-03-31 |
| CVE-2022-32429 EXP | An authentication-bypass issue in the component http://MYDEVICEIP/cgi-bin-sdb/ExportSettings.sh of Mega System Technologies Inc MSNSwitch MNT.2408 all… | Patch early | 9.8 critical | 75.6% | 2022-08-10 |
| CVE-2010-3275 EXP | libdirectx_plugin.dll in VideoLAN VLC Media Player before 1.1.8 allows remote attackers to execute arbitrary code via a crafted width in an AMV file,… | Patch early | 9.3 high | 75.5% | 2011-03-28 |
| CVE-2015-2080 EXP | The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process memory via il… | Patch early | 7.5 high | 75.4% | 2016-10-07 |
| CVE-2015-1592 EXP | Movable Type Pro, Open Source, and Advanced before 5.2.12 and Pro and Advanced 6.0.x before 6.0.7 does not properly use the Perl Storable::thaw functi… | Patch early | 7.5 high | 75.4% | 2015-02-19 |
| CVE-2023-3643 EXP | A vulnerability was found in Boss Mini 1.4.0 Build 6221. It has been classified as critical. This affects an unknown part of the file boss/servlet/doc… | Patch early | 7.3 high | 75.4% | 2023-07-12 |
| CVE-2020-25540 EXP | ThinkAdmin v6 is affected by a directory traversal vulnerability. An unauthorized attacker can read arbitrarily file on a remote server via GET reques… | Patch early | 7.5 high | 75.3% | 2020-09-14 |
| CVE-2007-4279 EXP | PHP remote file inclusion vulnerability in config.php in FrontAccounting 1.12 Build 31 allows remote attackers to execute arbitrary PHP code via a URL… | Patch early | 7.5 high | 75.3% | 2007-08-09 |
| CVE-2019-12255 EXP | Wind River VxWorks has a Buffer Overflow in the TCP component (issue 1 of 4). This is a IPNET security vulnerability: TCP Urgent Pointer = 0 that lead… | Patch early | 9.8 critical | 75.3% | 2019-08-09 |
| CVE-2004-0397 EXP | Stack-based buffer overflow during the apr_time_t data conversion in Subversion 1.0.2 and earlier allows remote attackers to execute arbitrary code vi… | Patch early | 7.5 high | 75.3% | 2004-07-07 |
| CVE-2005-2668 EXP | Multiple buffer overflows in Computer Associates (CA) Message Queuing (CAM / CAFT) 1.05, 1.07 before Build 220_13, and 1.11 before Build 29_13 allow r… | Patch early | 10.0 high | 75.2% | 2005-08-23 |
| CVE-2019-10267 EXP | An insecure file upload and code execution issue was discovered in Ahsay Cloud Backup Suite 8.1.0.50. It is possible to upload a file into any directo… | Patch early | 8.8 high | 75.2% | 2019-07-26 |
| CVE-2015-0318 EXP | Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to… | Patch early | 10.0 high | 75.2% | 2015-02-06 |
| CVE-2022-23178 EXP | An issue was discovered on Crestron HD-MD4X2-4K-E 1.0.0.2159 devices. When the administrative web interface of the HDMI switcher is accessed unauthent… | Patch early | 9.8 critical | 75.2% | 2022-01-15 |
| CVE-2015-2794 EXP | The installation wizard in DotNetNuke (DNN) before 7.4.1 allows remote attackers to reinstall the application and gain SuperUser access via a direct r… | Patch early | 9.8 critical | 75.1% | 2017-02-06 |
| CVE-2019-20215 EXP | D-Link DIR-859 1.05 and 1.06B01 Beta01 devices allow remote attackers to execute arbitrary OS commands via a urn: to the M-SEARCH method in ssdpcgi()… | Patch early | 9.8 critical | 75.1% | 2020-01-29 |
| CVE-2009-2629 EXP | Buffer underflow in src/http/ngx_http_parse.c in nginx 0.1.0 through 0.5.37, 0.6.x before 0.6.39, 0.7.x before 0.7.62, and 0.8.x before 0.8.15 allows… | Patch early | 7.5 high | 75.1% | 2009-09-15 |
| CVE-2006-3942 EXP | The server driver (srv.sys) in Microsoft Windows NT 4.0, 2000, XP, and Server 2003 allows remote attackers to cause a denial of service (system crash)… | Patch early | 7.8 high | 75% | 2006-07-31 |
| CVE-2006-4688 EXP | Buffer overflow in Client Service for NetWare (CSNW) in Microsoft Windows 2000 SP4, XP SP2, and Server 2003 up to SP1 allows remote attackers to execu… | Patch early | 7.5 high | 75% | 2006-11-14 |
| CVE-2016-1525 EXP | Directory traversal vulnerability in data/config/image.do in NETGEAR Management System NMS300 1.5.0.11 and earlier allows remote authenticated users t… | Patch early | 8.6 high | 75% | 2016-02-13 |
| CVE-2006-0476 EXP | Buffer overflow in Nullsoft Winamp 5.12 allows remote attackers to execute arbitrary code via a playlist (pls) file with a long file name (File1 field… | Patch early | 7.6 high | 75% | 2006-01-31 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt