CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
399,105 CVEs
1,728 on KEV
17,272 EPSS ≥ 10%
25,086 with exploits
synced 2026-09-29
399,105 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2015-6922 EXP | Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.33, 8.x before 8.0.0.23, 9.0 before 9.0.0.19, and 9.1 before 9.1.0.9 does not properly requ… | Patch early | 9.8 critical | 82.1% | 2020-02-17 |
| CVE-2017-0038 EXP | gdi32.dll in Graphics Device Interface (GDI) in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows S… | Patch early | 5.5 medium | 82.1% | 2017-02-20 |
| CVE-2018-10660 EXP | An issue was discovered in multiple models of Axis IP Cameras. There is Shell Command Injection. | Patch early | 9.8 critical | 82.1% | 2018-06-26 |
| CVE-2003-0812 EXP | Stack-based buffer overflow in a logging function for Windows Workstation Service (WKSSVC.DLL) allows remote attackers to execute arbitrary code via R… | Patch early | 7.5 high | 82.1% | 2003-12-15 |
| CVE-2020-8163 EXP | The is a code injection vulnerability in versions of Rails prior to 5.0.1 that wouldallow an attacker who controlled the `locals` argument of a `rende… | Patch early | 8.8 high | 82% | 2020-07-02 |
| CVE-2022-1175 EXP | Improper neutralization of user input in GitLab CE/EE versions 14.4 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versions startin… | Patch early | 8.7 high | 82% | 2022-04-04 |
| CVE-2018-0886 EXP | The Credential Security Support Provider protocol (CredSSP) in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Wi… | Patch early | 7.0 high | 82% | 2018-03-14 |
| CVE-2014-8440 EXP | Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR before 15.0.0… | Patch early | 10.0 high | 81.9% | 2014-11-11 |
| CVE-2020-35578 EXP | An issue was discovered in the Manage Plugins page in Nagios XI before 5.8.0. Because the line-ending conversion feature is mishandled during a plugin… | Patch early | 7.2 high | 81.9% | 2021-01-13 |
| CVE-2009-2526 EXP | Microsoft Windows Vista Gold, SP1, and SP2 and Server 2008 Gold and SP2 do not properly validate fields in SMBv2 packets, which allows remote attacker… | Patch early | 7.8 high | 81.9% | 2009-10-14 |
| CVE-2015-6128 EXP | Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 mishandle library loading, which allows local users to gain privile… | Patch early | 7.2 high | 81.9% | 2015-12-09 |
| CVE-2016-3087 EXP | Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execu… | Patch early | 9.8 critical | 81.9% | 2016-06-07 |
| CVE-2004-0597 EXP | Multiple buffer overflows in libpng 1.2.5 and earlier, as used in multiple products, allow remote attackers to execute arbitrary code via malformed PN… | Patch early | 10.0 high | 81.9% | 2004-11-23 |
| CVE-2004-1172 EXP | Stack-based buffer overflow in the Agent Browser in Veritas Backup Exec 8.x before 8.60.3878 Hotfix 68, and 9.x before 9.1.4691 Hotfix 40, allows remo… | Patch early | 10.0 high | 81.8% | 2005-01-10 |
| CVE-2012-2763 EXP | Buffer overflow in the readstr_upto function in plug-ins/script-fu/tinyscheme/scheme.c in GIMP 2.6.12 and earlier, and possibly 2.6.13, allows remote… | Patch early | 7.5 high | 81.7% | 2012-07-12 |
| CVE-2023-5360 EXP | The Royal Elementor Addons and Templates WordPress plugin before 1.3.79 does not properly validate uploaded files, which could allow unauthenticated u… | Patch early | 9.8 critical | 81.7% | 2023-10-31 |
| CVE-2014-8516 EXP | Unrestricted file upload vulnerability in Visual Mining NetCharts Server allows remote attackers to execute arbitrary code by uploading a file with an… | Patch early | 9.8 critical | 81.7% | 2020-01-03 |
| CVE-2010-3971 EXP | Use-after-free vulnerability in the CSharedStyleSheet::Notify function in the Cascading Style Sheets (CSS) parser in mshtml.dll, as used in Microsoft… | Patch early | 9.3 high | 81.7% | 2010-12-22 |
| CVE-2007-0774 EXP | Stack-based buffer overflow in the map_uri_to_worker function (native/common/jk_uri_worker_map.c) in mod_jk.so for Apache Tomcat JK Web Server Connect… | Patch early | 7.5 high | 81.5% | 2007-03-04 |
| CVE-2017-17090 EXP | An issue was discovered in chan_skinny.c in Asterisk Open Source 13.18.2 and older, 14.7.2 and older, and 15.1.2 and older, and Certified Asterisk 13.… | Patch early | 7.5 high | 81.5% | 2017-12-02 |
| CVE-2019-10092 EXP | In Apache HTTP Server 2.4.0-2.4.39, a limited cross-site scripting issue was reported affecting the mod_proxy error page. An attacker could cause the… | Patch early | 6.1 medium | 81.5% | 2019-09-26 |
| CVE-2016-2098 EXP | Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by… | Patch early | 7.3 high | 81.4% | 2016-04-07 |
| CVE-2018-5955 EXP | An issue was discovered in GitStack through 2.3.10. User controlled input is not sufficiently filtered, allowing an unauthenticated attacker to add a… | Patch early | 9.8 critical | 81.4% | 2018-01-21 |
| CVE-2017-0290 EXP | The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows… | Patch early | 7.8 high | 81.4% | 2017-05-09 |
| CVE-2016-5734 EXP | phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 does not properly choose delimiters to prevent use of the preg_replac… | Patch early | 9.8 critical | 81.4% | 2016-07-03 |
| CVE-2019-1003002 EXP | A sandbox bypass vulnerability exists in Pipeline: Declarative Plugin 1.3.3 and earlier in pipeline-model-definition/src/main/groovy/org/jenkinsci/plu… | Patch early | 8.8 high | 81.4% | 2019-01-22 |
| CVE-2003-0344 EXP | Buffer overflow in Microsoft Internet Explorer 5.01, 5.5, and 6.0 allows remote attackers to execute arbitrary code via / (slash) characters in the Ty… | Patch early | 7.5 high | 81.3% | 2003-06-16 |
| CVE-2024-2054 EXP | The Artica-Proxy administrative web application will deserialize arbitrary PHP objects supplied by unauthenticated users and subsequently enable code… | Patch early | 9.8 critical | 81.3% | 2024-03-21 |
| CVE-2017-8779 EXP | rpcbind through 0.2.4, LIBTIRPC through 1.0.1 and 1.0.2-rc through 1.0.2-rc3, and NTIRPC through 1.4.3 do not consider the maximum RPC data size durin… | Patch early | 7.5 high | 81.2% | 2017-05-04 |
| CVE-2003-0719 EXP | Buffer overflow in the Private Communications Transport (PCT) protocol implementation in the Microsoft SSL library, as used in Microsoft Windows NT 4.… | Patch early | 7.5 high | 81.2% | 2004-06-01 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt