CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
425,731 CVEs
1,781 on KEV
17,555 EPSS ≥ 10%
25,095 with exploits
synced 2026-11-14
217,814 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2018-19126 EXP | PrestaShop 1.6.x before 1.6.1.23 and 1.7.x before 1.7.4.4 allows remote attackers to execute arbitrary code via a file upload. | Patch early | 9.8 critical | 22.5% | 2018-11-09 |
| CVE-2017-3623 EXP | Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Kernel RPC). For supported versions that are affected see n… | Patch early | 10.0 critical | 22.5% | 2017-04-24 |
| CVE-2004-0519 EXP | Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.2 allow remote attackers to execute arbitrary script as other users and possib… | Patch early | 6.8 medium | 22.5% | 2004-08-18 |
| CVE-2008-0090 EXP | A certain ActiveX control in npUpload.dll in DivX Player 6.6.0 allows remote attackers to cause a denial of service (Internet Explorer 7 crash) via a… | Patch early | 5.0 medium | 22.5% | 2008-01-04 |
| CVE-2003-0526 EXP | Cross-site scripting (XSS) vulnerability in Microsoft Internet Security and Acceleration (ISA) Server 2000 allows remote attackers to inject arbitrary… | Patch early | 6.8 medium | 22.5% | 2003-08-18 |
| CVE-2015-5116 EXP | Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18… | Patch early | 5.0 medium | 22.5% | 2015-07-09 |
| CVE-2017-8550 EXP | A remote code execution vulnerability exists in Skype for Business when the software fails to sanitize specially crafted content, aka "Skype for Busin… | Patch early | 5.4 medium | 22.4% | 2017-06-15 |
| CVE-2000-0581 EXP | Windows 2000 Telnet Server allows remote attackers to cause a denial of service by sending a continuous stream of binary zeros, which causes the serve… | Patch early | 5.0 medium | 22.4% | 2000-06-30 |
| CVE-2007-4058 EXP | Absolute path traversal vulnerability in a certain ActiveX control in vielib.dll 2.2.5.42958 in EMC VMware 6.0.0 allows remote attackers to execute ar… | Patch early | 4.3 medium | 22.4% | 2007-07-30 |
| CVE-2018-12596 EXP | Episerver Ektron CMS before 9.0 SP3 Site CU 31, 9.1 before SP3 Site CU 45, or 9.2 before SP2 Site CU 22 allows remote attackers to call aspx pages via… | Patch early | 9.8 critical | 22.4% | 2018-10-10 |
| CVE-2000-0942 EXP | The CiWebHitsFile component in Microsoft Indexing Services for Windows 2000 allows remote attackers to conduct a cross site scripting (CSS) attack via… | Patch early | 5.1 medium | 22.4% | 2000-12-19 |
| CVE-2017-3077 EXP | Adobe Flash Player versions 25.0.0.171 and earlier have an exploitable memory corruption vulnerability in the PNG image parser. Successful exploitatio… | Patch early | 9.8 critical | 22.3% | 2017-06-20 |
| CVE-2001-1055 EXP | The Microsoft Windows network stack allows remote attackers to cause a denial of service (CPU consumption) via a flood of malformed ARP request packet… | Patch early | 5.0 medium | 22.3% | 2001-07-30 |
| CVE-2002-1831 EXP | Microsoft MSN Messenger Service 1.0 through 4.6 allows remote attackers to cause a denial of service (crash) via an invite request that contains hex-e… | Patch early | 5.0 medium | 22.3% | 2002-12-31 |
| CVE-2014-6308 EXP | Directory traversal vulnerability in OSClass before 3.4.2 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter in… | Patch early | 5.0 medium | 22.3% | 2014-10-20 |
| CVE-2013-3179 EXP | Cross-site scripting (XSS) vulnerability in Microsoft SharePoint Server 2007 SP3, 2010 SP1 and SP2, and 2013 allows remote attackers to inject arbitra… | Patch early | 4.3 medium | 22.3% | 2013-09-11 |
| CVE-2015-8660 EXP | The ovl_setattr function in fs/overlayfs/inode.c in the Linux kernel through 4.3.3 attempts to merge distinct setattr operations, which allows local u… | Patch early | 6.7 medium | 22.2% | 2015-12-28 |
| CVE-2008-0139 EXP | Eval injection vulnerability in loudblog/inc/parse_old.php in Loudblog 0.8.0 and earlier allows remote attackers to execute arbitrary PHP code via the… | Patch early | 6.8 medium | 22.2% | 2008-01-08 |
| CVE-2003-0899 EXP | Buffer overflow in defang in libhttpd.c for thttpd 2.21 to 2.23b1 allows remote attackers to execute arbitrary code via requests that contain '<' or '… | Patch early | 9.8 critical | 22.2% | 2003-11-03 |
| CVE-2001-0137 EXP | Windows Media Player 7 allows remote attackers to execute malicious Java applets in Internet Explorer clients by enclosing the applet in a skin file n… | Patch early | 5.1 medium | 22.2% | 2001-03-12 |
| CVE-2011-1669 EXP | Directory traversal vulnerability in wp-download.php in the WP Custom Pages module 0.5.0.1 for WordPress allows remote attackers to read arbitrary fil… | Patch early | 5.0 medium | 22.2% | 2011-04-10 |
| CVE-2010-3325 EXP | Microsoft Internet Explorer 6 through 8 does not properly handle unspecified special characters in Cascading Style Sheets (CSS) documents, which allow… | Patch early | 4.3 medium | 22% | 2010-10-13 |
| CVE-2006-6296 EXP | The RpcGetPrinterData function in the Print Spooler (spoolsv.exe) service in Microsoft Windows 2000 SP4 and earlier, and possibly Windows XP SP1 and e… | Patch early | 6.1 medium | 22% | 2006-12-05 |
| CVE-2019-8016 EXP | Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015… | Patch early | 9.8 critical | 22% | 2019-08-20 |
| CVE-2012-1858 EXP | The toStaticHTML API (aka the SafeHTML component) in Microsoft Internet Explorer 8 and 9, Communicator 2007 R2, and Lync 2010 and 2010 Attendee does n… | Patch early | 4.3 medium | 22% | 2012-06-12 |
| CVE-2009-3431 EXP | Stack consumption vulnerability in Adobe Reader and Acrobat 9.1.3, 9.1.2, 9.1.1, and earlier 9.x versions; 8.1.6 and earlier 8.x versions; and possibl… | Patch early | 5.0 medium | 22% | 2009-09-25 |
| CVE-2002-0386 EXP | The administration module for Oracle Web Cache in Oracle9iAS (9i Application Suite) 9.0.2 allows remote attackers to cause a denial of service (crash)… | Patch early | 5.0 medium | 22% | 2002-11-04 |
| CVE-2001-1244 EXP | Multiple TCP implementations could allow remote attackers to cause a denial of service (bandwidth and CPU exhaustion) by setting the maximum segment s… | Patch early | 5.0 medium | 22% | 2001-07-07 |
| CVE-2006-2081 EXP | Oracle Database Server 10g Release 2 allows local users to execute arbitrary SQL queries via the GET_DOMAIN_INDEX_METADATA function in the DBMS_EXPORT… | Patch early | 4.6 medium | 21.9% | 2006-04-27 |
| CVE-2002-2164 EXP | Buffer overflow in Microsoft Outlook Express 5.0, 5.5, and 6.0 allows remote attackers to cause a denial of service (crash) via a long <A HREF> link. | Patch early | 5.0 medium | 21.9% | 2002-12-31 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt