CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
425,729 CVEs
1,781 on KEV
17,555 EPSS ≥ 10%
25,095 with exploits
synced 2026-11-14
179,241 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2007-4533 EXP | Format string vulnerability in the Say command in sv_main.cpp in Vavoom 1.24 and earlier allows remote attackers to execute arbitrary code via format… | Patch early | 6.8 medium | 8.5% | 2007-08-25 |
| CVE-2019-10848 EXP | Computrols CBAS 18.0.0 allows Username Enumeration. | Patch early | 5.3 medium | 8.5% | 2019-05-24 |
| CVE-2009-1789 EXP | mod/server.mod/servmsg.c in Eggheads Eggdrop and Windrop 1.6.19 and earlier allows remote attackers to cause a denial of service (crash) via a crafted… | Patch early | 4.3 medium | 8.5% | 2009-05-26 |
| CVE-2000-1025 EXP | eWave ServletExec JSP/Java servlet engine, versions 3.0C and earlier, allows remote attackers to cause a denial of service via a URL that contains the… | Patch early | 5.0 medium | 8.5% | 2000-12-11 |
| CVE-2005-4558 EXP | IceWarp Web Mail 5.5.1, as used by Merak Mail Server 8.3.0r and VisNetic Mail Server version 8.3.0 build 1, does not properly restrict acceptable valu… | Patch early | 6.5 medium | 8.5% | 2005-12-28 |
| CVE-2018-7737 EXP | In Z-BlogPHP 1.5.1.1740, there is Web Site physical path leakage, as demonstrated by admin_footer.php or admin_footer.php. NOTE: the software maintain… | Patch early | 5.3 medium | 8.5% | 2018-03-06 |
| CVE-2010-1302 EXP | Directory traversal vulnerability in dwgraphs.php in the DecryptWeb DW Graphs (com_dwgraphs) component 1.0 for Joomla! allows remote attackers to read… | Patch early | 5.0 medium | 8.5% | 2010-04-07 |
| CVE-2013-3597 EXP | servlet/CollectionListServlet in SearchBlox before 7.5 build 1 allows remote attackers to read usernames and passwords via a getList action. | Patch early | 5.0 medium | 8.5% | 2013-08-28 |
| CVE-2005-4095 EXP | Directory traversal vulnerability in connector.php in the fckeditor2rc2 addon in DoceboLMS 2.0.4 allows remote attackers to list arbitrary files and d… | Patch early | 5.0 medium | 8.5% | 2005-12-08 |
| CVE-2009-0172 EXP | Unspecified vulnerability in IBM DB2 8 before FP17a, 9.1 before FP6a, and 9.5 before FP3a allows remote attackers to cause a denial of service (infini… | Patch early | 5.0 medium | 8.5% | 2009-01-16 |
| CVE-2011-1571 EXP | Unspecified vulnerability in the XSL Content portlet in Liferay Portal Community Edition (CE) 5.x and 6.x before 6.0.6 GA, when Apache Tomcat is used,… | Patch early | 6.8 medium | 8.5% | 2011-05-07 |
| CVE-2002-0769 EXP | The web-based configuration interface for the Cisco ATA 186 Analog Telephone Adaptor allows remote attackers to bypass authentication via an HTTP POST… | Patch early | 6.4 medium | 8.5% | 2002-08-12 |
| CVE-2007-1375 EXP | Integer overflow in the substr_compare function in PHP 5.2.1 and earlier allows context-dependent attackers to read sensitive memory via a large value… | Patch early | 5.0 medium | 8.5% | 2007-03-10 |
| CVE-2011-2132 EXP | Adobe Flash Media Server (FMS) before 3.5.7, and 4.x before 4.0.3, allows attackers to cause a denial of service (memory corruption) via unspecified v… | Patch early | 5.0 medium | 8.5% | 2011-08-11 |
| CVE-2012-4253 EXP | Multiple directory traversal vulnerabilities in MySQLDumper 1.24.4 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) langua… | Patch early | 4.3 medium | 8.5% | 2012-08-13 |
| CVE-2017-6020 EXP | Leao Consultoria e Desenvolvimento de Sistemas (LCDS) LTDA ME LAquis SCADA software versions prior to version 4.1.0.3237 do not neutralize external in… | Patch early | 5.3 medium | 8.5% | 2018-04-17 |
| CVE-2014-2880 EXP | Open redirect vulnerability in the Oracle Identity Manager component in Oracle Fusion Middleware 11.1.1.5, 11.1.1.7, 11.1.2.1, and 11.1.2.2 allows rem… | Patch early | 5.8 medium | 8.5% | 2014-04-17 |
| CVE-2011-2702 EXP | Integer signedness error in Glibc before 2.13 and eglibc before 2.13, when using Supplemental Streaming SIMD Extensions 3 (SSSE3) optimization, allows… | Patch early | 6.8 medium | 8.5% | 2014-10-27 |
| CVE-2006-3102 EXP | Race condition in articles/BitArticle.php in Bitweaver 1.3, when run on Apache with the mod_mime extension, allows remote attackers to execute arbitra… | Patch early | 5.1 medium | 8.5% | 2006-06-21 |
| CVE-2002-1483 EXP | db4web_c and db4web_c.exe programs in DB4Web 3.4 and 3.6 allow remote attackers to read arbitrary files via an HTTP request whose argument is a filena… | Patch early | 5.0 medium | 8.5% | 2003-04-22 |
| CVE-2002-0266 EXP | Thunderstone Texis CGI script allows remote attackers to obtain the full path of the web root via a request for a nonexistent file, which generates an… | Patch early | 5.0 medium | 8.5% | 2002-05-29 |
| CVE-2017-9640 EXP | A Path Traversal issue was discovered in Automated Logic Corporation (ALC) ALC WebCTRL, i-Vu, SiteScan Web prior to 6.5; ALC WebCTRL, SiteScan Web 6.1… | Patch early | 6.3 medium | 8.5% | 2017-08-25 |
| CVE-2010-4181 EXP | Directory traversal vulnerability in Yaws 1.89 allows remote attackers to read arbitrary files via ..\ (dot dot backslash) and other sequences. | Patch early | 5.0 medium | 8.5% | 2010-11-04 |
| CVE-2008-2292 EXP | Buffer overflow in the __snprint_value function in snmp_get in Net-SNMP 5.1.4, 5.2.4, and 5.4.1, as used in SNMP.xs for Perl, allows remote attackers… | Patch early | 6.8 medium | 8.4% | 2008-05-18 |
| CVE-2021-21337 EXP | Products.PluggableAuthService is a pluggable Zope authentication and authorization framework. In Products.PluggableAuthService before version 2.6.0 th… | Patch early | 5.7 medium | 8.4% | 2021-03-08 |
| CVE-1999-1557 EXP | Buffer overflow in the login functions in IMAP server (imapd) in Ipswitch IMail 5.0 and earlier allows remote attackers to cause a denial of service a… | Patch early | 5.0 medium | 8.4% | 2005-05-02 |
| CVE-2007-1308 EXP | ecma/kjs_html.cpp in KDE JavaScript (KJS), as used in Konqueror in KDE 3.5.5, allows remote attackers to cause a denial of service (crash) by accessin… | Patch early | 4.3 medium | 8.4% | 2007-03-07 |
| CVE-2014-8008 EXP | Absolute path traversal vulnerability in the Real-Time Monitoring Tool (RTMT) API in Cisco Unified Communications Manager (CUCM) allows remote authent… | Patch early | 6.8 medium | 8.4% | 2015-01-22 |
| CVE-2007-1001 EXP | Multiple integer overflows in the (1) createwbmp and (2) readwbmp functions in wbmp.c in the GD library (libgd) in PHP 4.0.0 through 4.4.6 and 5.0.0 t… | Patch early | 6.8 medium | 8.4% | 2007-04-06 |
| CVE-2009-2473 EXP | neon before 0.28.6, when expat is used, does not properly detect recursion during entity expansion, which allows context-dependent attackers to cause… | Patch early | 4.3 medium | 8.4% | 2009-08-21 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt