CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
425,731 CVEs
1,781 on KEV
17,555 EPSS ≥ 10%
25,095 with exploits
synced 2026-11-14
197,461 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2005-0353 EXP | Buffer overflow in the Sentinel LM (Lservnt) service in the Sentinel License Manager 7.2.0.2 allows remote attackers to execute arbitrary code by send… | Patch early | 10.0 high | 71.1% | 2005-05-02 |
| CVE-2021-2109 EXP | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.… | Patch early | 7.2 high | 71.1% | 2021-01-20 |
| CVE-2004-1558 EXP | Multiple stack-based buffer overflows in YPOPs! (aka YahooPOPS) 0.4 through 0.6 allow remote attackers to cause a denial of service (crash) and possib… | Patch early | 7.5 high | 71.1% | 2004-12-31 |
| CVE-2026-26980 EXP | Ghost is a Node.js content management system. Versions 3.24.0 through 6.19.0 allow unauthenticated attackers to perform arbitrary reads from the datab… | Patch early | 9.4 critical | 71.1% | 2026-02-20 |
| CVE-2004-0541 EXP | Buffer overflow in the ntlm_check_auth (NTLM authentication) function for Squid Web Proxy Cache 2.5.x and 3.x, when compiled with NTLM handlers enable… | Patch early | 10.0 high | 71.1% | 2004-08-06 |
| CVE-2007-4636 EXP | Multiple PHP remote file inclusion vulnerabilities in phpBG 0.9.1 allow remote attackers to execute arbitrary PHP code via a URL in the rootdir parame… | Patch early | 7.5 high | 71.1% | 2007-08-31 |
| CVE-2021-4039 EXP | A command injection vulnerability in the web interface of the Zyxel NWA-1100-NH firmware could allow an attacker to execute arbitrary OS commands on t… | Patch early | 9.8 critical | 71% | 2022-03-01 |
| CVE-2019-10867 EXP | An issue was discovered in Pimcore before 5.7.1. An attacker with classes permission can send a POST request to /admin/class/bulk-commit, which will m… | Patch early | 8.8 high | 71% | 2019-04-04 |
| CVE-2015-2509 EXP | Windows Media Center in Microsoft Windows Vista SP2, Windows 7 SP1, Windows 8, and Windows 8.1 allows user-assisted remote attackers to execute arbitr… | Patch early | 9.3 high | 71% | 2015-09-09 |
| CVE-2013-1362 EXP | Incomplete blacklist vulnerability in nrpc.c in Nagios Remote Plug-In Executor (NRPE) before 2.14 might allow remote attackers to execute arbitrary sh… | Patch early | 7.5 high | 71% | 2013-07-09 |
| CVE-2017-8895 EXP | In Veritas Backup Exec 2014 before build 14.1.1187.1126, 15 before build 14.2.1180.3160, and 16 before FP1, there is a use-after-free vulnerability in… | Patch early | 9.8 critical | 71% | 2017-05-10 |
| CVE-2013-4835 EXP | The APISiteScopeImpl SOAP service in HP SiteScope 10.1x and 11.x before 11.22 allows remote attackers to bypass authentication and execute arbitrary c… | Patch early | 7.5 high | 71% | 2013-11-04 |
| CVE-2015-0096 EXP | Untrusted search path vulnerability in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Window… | Patch early | 9.3 high | 71% | 2015-03-11 |
| CVE-2003-0213 EXP | ctrlpacket.c in PoPToP PPTP server before 1.1.4-b3 allows remote attackers to cause a denial of service via a length field of 0 or 1, which causes a n… | Patch early | 7.5 high | 70.9% | 2003-05-12 |
| CVE-2016-6195 EXP | SQL injection vulnerability in forumrunner/includes/moderation.php in vBulletin before 4.2.2 Patch Level 5 and 4.2.3 before Patch Level 1 allows remot… | Patch early | 9.8 critical | 70.9% | 2016-08-30 |
| CVE-2011-3492 EXP | Stack-based buffer overflow in Azeotech DAQFactory 5.85 build 1853 and earlier allows remote attackers to cause a denial of service (crash) and execut… | Patch early | 10.0 high | 70.9% | 2011-09-16 |
| CVE-2005-2877 EXP | The history (revision control) function in TWiki 02-Sep-2004 and earlier allows remote attackers to execute arbitrary code via shell metacharacters, a… | Patch early | 7.5 high | 70.9% | 2005-09-16 |
| CVE-2011-0073 EXP | Mozilla Firefox before 3.5.19 and 3.6.x before 3.6.17, and SeaMonkey before 2.0.14, does not properly use nsTreeRange data structures, which allows re… | Patch early | 10.0 high | 70.9% | 2011-05-07 |
| CVE-2016-5675 EXP | handle_daylightsaving.php in NUUO NVRmini 2 1.7.5 through 3.0.0, NUUO NVRsolo 1.0.0 through 3.0.0, NUUO Crystal 2.2.1 through 3.2.0, and NETGEAR Ready… | Patch early | 9.8 critical | 70.9% | 2016-08-31 |
| CVE-2021-35064 EXP | KramerAV VIAWare, all tested versions, allow privilege escalation through misconfiguration of sudo. Sudoers permits running of multiple dangerous comm… | Patch early | 9.8 critical | 70.8% | 2021-07-12 |
| CVE-2005-2799 EXP | Buffer overflow in apply.cgi in Linksys WRT54G 3.01.03, 3.03.6, and possibly other versions before 4.20.7, allows remote attackers to execute arbitrar… | Patch early | 7.5 high | 70.8% | 2005-09-15 |
| CVE-2018-18323 EXP | CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.480 has Local File Inclusion via directory traversal with an admin/index.php?module=file_editor&f… | Patch early | 7.5 high | 70.7% | 2018-10-15 |
| CVE-2001-0168 EXP | Buffer overflow in AT&T WinVNC (Virtual Network Computing) server 3.3.3r7 and earlier allows remote attackers to execute arbitrary commands via a long… | Patch early | 10.0 high | 70.7% | 2001-05-03 |
| CVE-2018-8279 EXP | A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory Corruption Vulnerab… | Patch early | 7.5 high | 70.7% | 2018-07-11 |
| CVE-2008-0166 EXP | OpenSSL 0.9.8c-1 up to versions before 0.9.8g-9 on Debian-based operating systems uses a random number generator that generates predictable numbers, w… | Patch early | 7.5 high | 70.7% | 2008-05-13 |
| CVE-2006-2926 EXP | Stack-based buffer overflow in the WWW Proxy Server of Qbik WinGate 6.1.1.1077 allows remote attackers to cause a denial of service and possibly execu… | Patch early | 7.5 high | 70.7% | 2006-06-09 |
| CVE-2007-0169 EXP | Multiple buffer overflows in Computer Associates (CA) BrightStor ARCserve Backup 9.01 through 11.5, Enterprise Backup 10.5, and CA Server/Business Pro… | Patch early | 7.5 high | 70.7% | 2007-01-11 |
| CVE-2009-4195 EXP | Buffer overflow in Adobe Illustrator CS4 14.0.0, CS3 13.0.3 and earlier, and CS3 13.0.0 allows remote attackers to execute arbitrary code via a long D… | Patch early | 9.3 high | 70.7% | 2009-12-04 |
| CVE-2024-4367 EXP | A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. This vulnerability aff… | Patch early | 8.8 high | 70.7% | 2024-05-14 |
| CVE-2014-4880 EXP | Buffer overflow in Hikvision DVR DS-7204 Firmware 2.2.10 build 131009, and other models and versions, allows remote attackers to execute arbitrary cod… | Patch early | 7.5 high | 70.7% | 2014-12-08 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt