CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
425,789 CVEs
1,781 on KEV
17,562 EPSS ≥ 10%
25,095 with exploits
synced 2026-11-14
338,154 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2017-11907 EXP | Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 G… | Patch early | 7.5 high | 64.7% | 2017-12-12 |
| CVE-2009-1978 EXP | Unspecified vulnerability in the Oracle Secure Backup component in Oracle Secure Backup 10.2.0.3 allows remote attackers to affect confidentiality, in… | Patch early | 9.0 high | 64.7% | 2009-07-14 |
| CVE-2007-4757 EXP | PHP remote file inclusion vulnerability in menu.php in phpMytourney allows remote attackers to execute arbitrary PHP code via a URL in the functions_f… | Patch early | 7.5 high | 64.7% | 2007-09-08 |
| CVE-2008-4779 EXP | Stack-based buffer overflow in TUGzip 3.5.0.0 allows remote attackers to denial of service (crash) or execute arbitrary code via a long filename in a… | Patch early | 10.0 high | 64.7% | 2008-10-29 |
| CVE-2005-4411 EXP | Buffer overflow in Mercury Mail Transport System 4.01b allows remote attackers to execute arbitrary code via a long request to TCP port 105. | Patch early | 7.5 high | 64.7% | 2005-12-20 |
| CVE-2011-3322 EXP | Core Server HMI Service (Coreservice.exe) in Scadatec Limited Procyon SCADA 1.06, and other versions before 1.14, allows remote attackers to cause a d… | Patch early | 10.0 high | 64.7% | 2011-09-15 |
| CVE-2015-0816 EXP | Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 do not properly restrict resource: URLs, which makes it easier… | Patch early | 5.0 medium | 64.6% | 2015-04-01 |
| CVE-2007-4440 EXP | Stack-based buffer overflow in the MercuryS SMTP server in Mercury Mail Transport System, possibly 4.51 and earlier, allows remote attackers to execut… | Patch early | 7.5 high | 64.5% | 2007-08-21 |
| CVE-2018-19422 EXP | /panel/uploads in Subrion CMS 4.2.1 allows remote attackers to execute arbitrary PHP code via a .pht or .phar file, because the .htaccess file omits t… | Patch early | 7.2 high | 64.5% | 2018-11-21 |
| CVE-2007-2793 EXP | PHP remote file inclusion vulnerability in ImageImageMagick.php in Geeklog 2.x allows remote attackers to execute arbitrary PHP code via a URL in the… | Patch early | 7.5 high | 64.5% | 2007-05-22 |
| CVE-2010-4094 EXP | The Tomcat server in IBM Rational Quality Manager and Rational Test Lab Manager has a default password for the ADMIN account, which makes it easier fo… | Patch early | 5.0 medium | 64.5% | 2010-10-26 |
| CVE-2017-11764 EXP | Microsoft Edge in Microsoft Windows 10 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current… | Patch early | 7.5 high | 64.4% | 2017-09-13 |
| CVE-2011-4789 EXP | Stack-based buffer overflow in magentservice.exe in the server in HP LoadRunner 11.00 before patch 4 allows remote attackers to execute arbitrary code… | Patch early | 10.0 high | 64.4% | 2012-01-13 |
| CVE-2007-2937 EXP | PHP remote file inclusion vulnerability in admin/admin.php in TROforum 0.1 allows remote attackers to execute arbitrary PHP code via a URL in the site… | Patch early | 7.5 high | 64.4% | 2007-05-31 |
| CVE-2007-2986 EXP | PHP remote file inclusion vulnerability in lib/live_status.lib.php in AdminBot MX 9.0.5 allows remote attackers to execute arbitrary PHP code via a UR… | Patch early | 7.5 high | 64.4% | 2007-06-01 |
| CVE-2007-3306 EXP | PHP remote file inclusion vulnerability in crontab/run_billing.php in MiniBill 1.2.5 allows remote attackers to execute arbitrary PHP code via a URL i… | Patch early | 7.5 high | 64.4% | 2007-06-21 |
| CVE-2007-3325 EXP | PHP remote file inclusion vulnerability in lib/language.php in LAN Management System (LMS) 1.9.6 and earlier allows remote attackers to execute arbitr… | Patch early | 7.5 high | 64.4% | 2007-06-21 |
| CVE-2022-44149 EXP | The web service on Nexxt Amp300 ARN02304U8 42.103.1.5095 and 80.103.2.5045 devices allows remote OS command execution by placing &telnetd in the JSON… | Patch early | 8.8 high | 64.4% | 2023-01-06 |
| CVE-2012-2020 EXP | Unspecified vulnerability in HP Operations Agent before 11.03.12 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-13… | Patch early | 10.0 high | 64.3% | 2012-07-11 |
| CVE-2014-7186 EXP | The redirection implementation in parse.y in GNU Bash through 4.3 bash43-026 allows remote attackers to cause a denial of service (out-of-bounds array… | Patch early | 10.0 high | 64.3% | 2014-09-28 |
| CVE-2011-4828 EXP | Unrestricted file upload vulnerability in includes/inline_image_upload.php in AutoSec Tools V-CMS 1.0 allows remote attackers to execute arbitrary cod… | Patch early | 7.5 high | 64.3% | 2011-12-15 |
| CVE-2014-6277 EXP | GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to… | Patch early | 10.0 high | 64.3% | 2014-09-27 |
| CVE-1999-0504 EXP | A Windows NT local user or administrator account has a default, null, blank, or missing password. | Patch early | 7.5 high | 64.3% | 1997-01-01 |
| CVE-2011-5010 EXP | apps/a3/cfg_ethping.cgi in the Ctek SkyRouter 4200 and 4300 allows remote attackers to execute arbitrary commands via shell metacharacters in the PING… | Patch early | 10.0 high | 64.3% | 2011-12-25 |
| CVE-2011-0922 EXP | The client in HP Data Protector allows remote attackers to execute arbitrary programs via an EXEC_SETUP command that references a UNC share pathname. | Patch early | 10.0 high | 64.2% | 2011-02-09 |
| CVE-2006-5216 EXP | Stack-based buffer overflow in Sergey Lyubka Simple HTTPD (shttpd) 1.34 allows remote attackers to execute arbitrary code via a long URI. | Patch early | 7.5 high | 64.2% | 2006-10-10 |
| CVE-2007-3524 EXP | Multiple PHP remote file inclusion vulnerabilities in Ripe Website Manager 0.8.9 and earlier allow remote attackers to execute arbitrary PHP code via… | Patch early | 6.8 medium | 64.2% | 2007-07-03 |
| CVE-2017-11861 EXP | Microsoft Edge in Windows 10 1607, 1703, 1709, Windows Server 2016 and Windows Server, version 1709 allows an attacker to gain the same user rights as… | Patch early | 7.5 high | 64.2% | 2017-11-15 |
| CVE-2016-1593 EXP | Directory traversal vulnerability in the import users feature in Micro Focus Novell Service Desk before 7.2 allows remote authenticated administrators… | Patch early | 7.2 high | 64.1% | 2016-04-22 |
| CVE-2018-8384 EXP | A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scri… | Patch early | 7.5 high | 64.1% | 2018-08-15 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt