CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
399,451 CVEs
1,729 on KEV
17,272 EPSS ≥ 10%
25,086 with exploits
synced 2026-09-29
185,683 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2006-0992 EXP | Stack-based buffer overflow in Novell GroupWise Messenger before 2.0 Public Beta 2 allows remote attackers to execute arbitrary code via a long Accept… | Patch early | 10.0 high | 72.8% | 2006-04-14 |
| CVE-2021-24946 EXP | The Modern Events Calendar Lite WordPress plugin before 6.1.5 does not sanitise and escape the time parameter before using it in a SQL statement in th… | Patch early | 9.8 critical | 72.8% | 2021-12-13 |
| CVE-2017-6326 EXP | The Symantec Messaging Gateway can encounter an issue of remote code execution, which describes a situation whereby an individual may obtain the abili… | Patch early | 10.0 critical | 72.8% | 2017-06-26 |
| CVE-2014-6038 EXP | Zoho ManageEngine EventLog Analyzer versions 7 through 9.9 build 9002 have a database Information Disclosure Vulnerability. Fixed in EventLog Analyzer… | Patch early | 7.5 high | 72.8% | 2020-01-13 |
| CVE-2011-5007 EXP | Stack-based buffer overflow in the CmpWebServer component in 3S CoDeSys 3.4 SP4 Patch 2 and earlier, as used on the ABB AC500 PLC and possibly other p… | Patch early | 10.0 high | 72.7% | 2011-12-25 |
| CVE-2014-3828 EXP | Multiple SQL injection vulnerabilities in Centreon 2.5.1 and Centreon Enterprise Server 2.2 (fixed in Centreon web 2.5.3) allow remote attackers to ex… | Patch early | 10.0 high | 72.7% | 2014-10-23 |
| CVE-2014-9618 EXP | The Client Filter Admin portal in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to bypass authenticatio… | Patch early | 9.8 critical | 72.7% | 2017-09-19 |
| CVE-2018-6389 EXP | In WordPress through 4.9.2, unauthenticated attackers can cause a denial of service (resource consumption) by using the large list of registered .js f… | Patch early | 7.5 high | 72.7% | 2018-02-06 |
| CVE-2002-1337 EXP | Buffer overflow in Sendmail 5.79 to 8.12.7 allows remote attackers to execute arbitrary code via certain formatted address fields, related to sender a… | Patch early | 10.0 high | 72.6% | 2003-03-07 |
| CVE-2009-1977 EXP | Unspecified vulnerability in the Oracle Secure Backup component in Oracle Secure Backup 10.2.0.3 allows remote attackers to affect confidentiality, in… | Patch early | 10.0 high | 72.6% | 2009-07-14 |
| CVE-2005-1348 EXP | Buffer overflow in HTTPMail in MailEnable Enterprise 1.04 and earlier and Professional 1.54 and earlier allows remote attackers to execute arbitrary c… | Patch early | 7.5 high | 72.6% | 2005-05-02 |
| CVE-2014-3914 EXP | Directory traversal vulnerability in the Admin Center for Tivoli Storage Manager (TSM) in Rocket ServerGraph 1.2 allows remote attackers to (1) create… | Patch early | 10.0 high | 72.6% | 2014-08-07 |
| CVE-2000-0945 EXP | The web configuration interface for Catalyst 3500 XL switches allows remote attackers to execute arbitrary commands without authentication when the en… | Patch early | 10.0 high | 72.6% | 2000-12-19 |
| CVE-2025-6965 EXP | There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns available. This c… | Patch early | 7.7 high | 72.5% | 2025-07-15 |
| CVE-2013-5331 EXP | Adobe Flash Player before 11.7.700.257 and 11.8.x and 11.9.x before 11.9.900.170 on Windows and Mac OS X and before 11.2.202.332 on Linux, Adobe AIR b… | Patch early | 9.3 high | 72.5% | 2013-12-11 |
| CVE-2011-2653 EXP | Directory traversal vulnerability in the rtrlet component in Novell ZENworks Asset Management (ZAM) 7.5 allows remote attackers to execute arbitrary c… | Patch early | 10.0 high | 72.5% | 2011-12-08 |
| CVE-2004-1211 EXP | Multiple buffer overflows in the IMAP service in Mercury/32 4.01a allow remote authenticated users to cause a denial of service (application crash) an… | Patch early | 10.0 high | 72.5% | 2005-01-10 |
| CVE-2014-3804 EXP | The av-centerd SOAP service in AlienVault OSSIM before 4.7.0 allows remote attackers to execute arbitrary commands via a crafted (1) update_system_inf… | Patch early | 10.0 high | 72.4% | 2014-06-13 |
| CVE-2021-4045 EXP | TP-Link Tapo C200 IP camera, on its 1.1.15 firmware version and below, is affected by an unauthenticated RCE vulnerability, present in the uhttpd bina… | Patch early | 9.8 critical | 72.4% | 2022-03-10 |
| CVE-2013-3623 EXP | Multiple stack-based buffer overflows in cgi/close_window.cgi in the web interface in the Intelligent Platform Management Interface (IPMI) with firmwa… | Patch early | 10.0 high | 72.4% | 2013-12-10 |
| CVE-2004-0204 EXP | Directory traversal vulnerability in the web viewers for Business Objects Crystal Reports 9 and 10, and Crystal Enterprise 9 or 10, as used in Visual… | Patch early | 7.5 high | 72.4% | 2004-08-06 |
| CVE-2004-1134 EXP | Buffer overflow in the Microsoft W3Who ISAPI (w3who.dll) allows remote attackers to cause a denial of service and possibly execute arbitrary code via… | Patch early | 10.0 high | 72.3% | 2005-01-10 |
| CVE-2023-3460 EXP | The Ultimate Member WordPress plugin before 2.6.7 does not prevent visitors from creating user accounts with arbitrary capabilities, effectively allow… | Patch early | 9.8 critical | 72.3% | 2023-07-04 |
| CVE-2016-1560 EXP | ExaGrid appliances with firmware before 4.8 P26 have a default password of (1) inflection for the root shell account and (2) support for the support a… | Patch early | 9.8 critical | 72.3% | 2017-04-21 |
| CVE-2009-1943 EXP | Stack-based buffer overflow in the IKE service (ireIke.exe) in SafeNet SoftRemote before 10.8.6 allows remote attackers to execute arbitrary code via… | Patch early | 10.0 high | 72.2% | 2009-06-05 |
| CVE-2014-0514 EXP | The Adobe Reader Mobile application before 11.2 for Android does not properly restrict use of JavaScript, which allows remote attackers to execute arb… | Patch early | 9.3 high | 72.2% | 2014-04-15 |
| CVE-2017-8729 EXP | Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to execute arbitrary code in the context of the current user, due to the way that the M… | Patch early | 7.5 high | 72.2% | 2017-09-13 |
| CVE-2017-8740 EXP | Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to execute arbitrary code in the context of the current user, due to the way that the M… | Patch early | 7.5 high | 72.2% | 2017-09-13 |
| CVE-2019-16724 EXP | File Sharing Wizard 1.5.0 allows a remote attacker to obtain arbitrary code execution by exploiting a Structured Exception Handler (SEH) based buffer… | Patch early | 9.8 critical | 72.2% | 2019-09-24 |
| CVE-2017-8636 EXP | Microsoft browsers in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold… | Patch early | 7.5 high | 72.1% | 2017-08-08 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt