CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
425,729 CVEs
1,781 on KEV
17,555 EPSS ≥ 10%
25,095 with exploits
synced 2026-11-14
179,241 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-1999-0060 EXP | Attackers can cause a denial of service in Ascend MAX and Pipeline routers with a malformed packet to the discard port, which is used by the Java Conf… | Patch early | 5.0 medium | 8.6% | 1998-03-16 |
| CVE-2008-3432 EXP | Heap-based buffer overflow in the mch_expand_wildcards function in os_unix.c in Vim 6.2 and 6.3 allows user-assisted attackers to execute arbitrary co… | Patch early | 6.8 medium | 8.6% | 2008-10-10 |
| CVE-2023-33145 EXP | Microsoft Edge (Chromium-based) Information Disclosure Vulnerability | Patch early | 6.5 medium | 8.6% | 2023-06-14 |
| CVE-2007-1521 EXP | Double free vulnerability in PHP before 4.4.7, and 5.x before 5.2.2, allows context-dependent attackers to execute arbitrary code by interrupting the… | Patch early | 6.8 medium | 8.6% | 2007-03-20 |
| CVE-2010-3039 EXP | /usr/local/cm/bin/pktCap_protectData in Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 6, 7, and 8 allows remote authenticated… | Patch early | 6.8 medium | 8.6% | 2010-11-09 |
| CVE-2010-2307 EXP | Multiple directory traversal vulnerabilities in the web server for Motorola SURFBoard cable modem SBV6120E running firmware SBV6X2X-1.0.0.5-SCM-02-SHP… | Patch early | 5.0 medium | 8.6% | 2010-06-16 |
| CVE-2000-0977 EXP | mailfile.cgi CGI program in MailFile 1.10 allows remote attackers to read arbitrary files by specifying the target file name in the "filename" paramet… | Patch early | 5.0 medium | 8.6% | 2000-12-19 |
| CVE-2005-4559 EXP | mail/include.html in IceWarp Web Mail 5.5.1, as used by Merak Mail Server 8.3.0r and VisNetic Mail Server version 8.3.0 build 1, does not properly ini… | Patch early | 5.0 medium | 8.6% | 2005-12-28 |
| CVE-2007-2482 EXP | Directory traversal vulnerability in wordtube-button.php in the wordTube 1.43 and earlier plugin for WordPress, when register_globals is enabled, allo… | Patch early | 6.8 medium | 8.6% | 2007-05-03 |
| CVE-2008-4323 EXP | Windows Explorer in Microsoft Windows XP SP3 allows user-assisted attackers to cause a denial of service (application crash) via a crafted .ZIP file. | Patch early | 4.3 medium | 8.6% | 2008-09-29 |
| CVE-2011-1143 EXP | epan/dissectors/packet-ntlmssp.c in the NTLMSSP dissector in Wireshark before 1.4.4 allows remote attackers to cause a denial of service (NULL pointer… | Patch early | 4.3 medium | 8.6% | 2011-03-03 |
| CVE-2000-0508 EXP | rpc.lockd in Red Hat Linux 6.1 and 6.2 allows remote attackers to cause a denial of service via a malformed request. | Patch early | 5.0 medium | 8.6% | 1994-12-19 |
| CVE-2018-10751 EXP | A malformed OMACP WAP push message can cause memory corruption on a Samsung S7 Edge device when processing the String Extension portion of the WbXml p… | Patch early | 5.3 medium | 8.6% | 2018-05-29 |
| CVE-2007-6584 EXP | Multiple directory traversal vulnerabilities in 1024 CMS 1.3.1 allow remote attackers to include and execute arbitrary local files via a .. (dot dot)… | Patch early | 6.4 medium | 8.6% | 2007-12-28 |
| CVE-2010-3306 EXP | Directory traversal vulnerability in the modURL function in instance.c in Weborf before 0.12.3 allows remote attackers to read arbitrary files via ..%… | Patch early | 5.0 medium | 8.6% | 2010-09-24 |
| CVE-2000-0906 EXP | Directory traversal vulnerability in Moreover.com cached_feed.cgi script version 4.July.00 allows remote attackers to read arbitrary files via a .. (d… | Patch early | 5.0 medium | 8.6% | 2000-12-19 |
| CVE-2015-1482 EXP | Ansible Tower (aka Ansible UI) before 2.0.5 allows remote attackers to bypass authentication and obtain sensitive information via a websocket connecti… | Patch early | 5.0 medium | 8.5% | 2015-02-04 |
| CVE-2002-2314 EXP | Mozilla 1.0 allows remote attackers to steal cookies from other domains via a javascript: URL with a leading "//" and ending in a newline, which cause… | Patch early | 5.0 medium | 8.5% | 2002-12-31 |
| CVE-2005-2455 EXP | Greasemonkey before 0.3.5 allows remote web servers to (1) read arbitrary files via a GET request to a file:// URL in the GM_xmlhttpRequest API functi… | Patch early | 5.0 medium | 8.5% | 2005-08-04 |
| CVE-2012-5329 EXP | Buffer overflow in TYPSoft FTP Server 1.1 allows remote authenticated users to cause a denial of service (application crash) via a long string in an A… | Patch early | 4.0 medium | 8.5% | 2012-10-08 |
| CVE-2001-0495 EXP | Directory traversal in DataWizard WebXQ server 1.204 allows remote attackers to view files outside of the web root via a .. (dot dot) attack. | Patch early | 5.0 medium | 8.5% | 2001-06-27 |
| CVE-2008-4409 EXP | libxml2 2.7.0 and 2.7.1 does not properly handle "predefined entities definitions" in entities, which allows context-dependent attackers to cause a de… | Patch early | 5.0 medium | 8.5% | 2008-10-03 |
| CVE-2009-4501 EXP | The zbx_get_next_field function in libs/zbxcommon/str.c in Zabbix Server before 1.6.8 allows remote attackers to cause a denial of service (crash) via… | Patch early | 5.0 medium | 8.5% | 2009-12-31 |
| CVE-2007-4976 EXP | Directory traversal vulnerability in viewlog.php in Coppermine Photo Gallery (CPG) 1.4.12 and earlier allows remote authenticated administrators to in… | Patch early | 6.5 medium | 8.5% | 2007-09-19 |
| CVE-2010-3203 EXP | Directory traversal vulnerability in the PicSell (com_picsell) component 1.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot… | Patch early | 5.0 medium | 8.5% | 2010-09-03 |
| CVE-2016-4004 EXP | Directory traversal vulnerability in Dell OpenManage Server Administrator (OMSA) 8.2 allows remote authenticated administrators to read arbitrary file… | Patch early | 4.9 medium | 8.5% | 2016-04-12 |
| CVE-2008-5715 EXP | Mozilla Firefox 3.0.5 on Windows Vista allows remote attackers to cause a denial of service (application crash) via JavaScript code with a long string… | Patch early | 5.0 medium | 8.5% | 2008-12-24 |
| CVE-2017-11664 EXP | The _WM_SetupMidiEvent function in internal_midi.c:2122 in WildMIDI 0.4.2 can cause a denial of service (invalid memory read and application crash) vi… | Patch early | 6.5 medium | 8.5% | 2017-08-17 |
| CVE-2008-4558 EXP | Array index error in VLC media player 0.9.2 allows remote attackers to overwrite arbitrary memory and execute arbitrary code via an XSPF playlist file… | Patch early | 6.8 medium | 8.5% | 2008-10-15 |
| CVE-2006-0891 EXP | Multiple directory traversal vulnerabilities in NOCC Webmail 1.0 allow remote attackers to include arbitrary files via .. (dot dot) sequences and a tr… | Patch early | 5.0 medium | 8.5% | 2006-02-25 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt