CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
425,731 CVEs
1,781 on KEV
17,555 EPSS ≥ 10%
25,095 with exploits
synced 2026-11-14
197,461 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2013-4211 EXP | A Code Execution Vulnerability exists in OpenX Ad Server 2.8.10 due to a backdoor in flowplayer-3.1.1.min.js library, which could let a remote malicio… | Patch early | 9.8 critical | 70.7% | 2020-02-14 |
| CVE-2007-2607 EXP | PHP remote file inclusion vulnerability in views/print/printbar.php in LaVague 0.3 and earlier allows remote attackers to execute arbitrary PHP code v… | Patch early | 7.5 high | 70.6% | 2007-05-11 |
| CVE-2007-2676 EXP | PHP remote file inclusion vulnerability in skins/header.php in Open Translation Engine (OTE) 0.7.8 allows remote attackers to execute arbitrary PHP co… | Patch early | 7.5 high | 70.6% | 2007-05-14 |
| CVE-2018-8229 EXP | A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scri… | Patch early | 7.5 high | 70.6% | 2018-06-14 |
| CVE-2010-1553 EXP | Stack-based buffer overflow in getnnmdata.exe in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allows remote attackers to execute arb… | Patch early | 10.0 high | 70.6% | 2010-05-13 |
| CVE-2019-11231 EXP | An issue was discovered in GetSimple CMS through 3.3.15. insufficient input sanitation in the theme-edit.php file allows upload of files with arbitrar… | Patch early | 9.8 critical | 70.4% | 2019-05-22 |
| CVE-2007-3798 EXP | Integer overflow in print-bgp.c in the BGP dissector in tcpdump 3.9.6 and earlier allows remote attackers to execute arbitrary code via crafted TLVs i… | Patch early | 9.8 critical | 70.4% | 2007-07-16 |
| CVE-2006-6183 EXP | Multiple stack-based buffer overflows in 3Com 3CTftpSvc 2.0.1, and possibly earlier, allow remote attackers to cause a denial of service (crash) or ex… | Patch early | 10.0 high | 70.4% | 2006-12-01 |
| CVE-2016-7288 EXP | The scripting engines in Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafte… | Patch early | 7.5 high | 70.4% | 2016-12-20 |
| CVE-2011-3658 EXP | The SVG implementation in Mozilla Firefox 8.0, Thunderbird 8.0, and SeaMonkey 2.5 does not properly interact with DOMAttrModified event handlers, whic… | Patch early | 7.5 high | 70.3% | 2011-12-21 |
| CVE-2005-0045 EXP | The Server Message Block (SMB) implementation for Windows NT 4.0, 2000, XP, and Server 2003 does not properly validate certain SMB packets, which allo… | Patch early | 7.5 high | 70.3% | 2005-05-02 |
| CVE-2017-8634 EXP | Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to execute arbitrary code in the context of the current user due to the way that Micros… | Patch early | 7.5 high | 70.3% | 2017-08-08 |
| CVE-2006-1185 EXP | Unspecified vulnerability in Microsoft Internet Explorer 5.01 through 6 allows remote attackers to execute arbitrary code via certain invalid HTML tha… | Patch early | 7.5 high | 70.3% | 2006-04-11 |
| CVE-2012-4869 EXP | The callme_startcall function in recordings/misc/callme_page.php in FreePBX 2.9, 2.10, and earlier allows remote attackers to execute arbitrary comman… | Patch early | 7.5 high | 70.3% | 2012-09-06 |
| CVE-2013-2134 EXP | Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted action name that is not properly h… | Patch early | 9.3 high | 70.2% | 2013-07-16 |
| CVE-2008-3656 EXP | Algorithmic complexity vulnerability in the WEBrick::HTTPUtils.split_header_value function in WEBrick::HTTP::DefaultFileHandler in WEBrick in Ruby 1.8… | Patch early | 7.8 high | 70.2% | 2008-08-13 |
| CVE-2011-0105 EXP | Microsoft Excel 2002 SP3, Office 2004 and 2008 for Mac, and Open XML File Format Converter for Mac obtain a certain length value from an uninitialized… | Patch early | 9.3 high | 70.2% | 2011-04-13 |
| CVE-2013-6117 EXP | Dahua DVR 2.608.0000.0 and 2.608.GV00.0 allows remote attackers to bypass authentication and obtain sensitive information including user credentials,… | Patch early | 7.5 high | 70.2% | 2014-07-11 |
| CVE-2006-2370 EXP | Buffer overflow in the Routing and Remote Access service (RRAS) in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 and earlier allows… | Patch early | 7.5 high | 70.1% | 2006-06-13 |
| CVE-2007-0584 EXP | PHP remote file inclusion vulnerability in membres/membreManager.php in PhP Generic Library & Framework for comm (g-neric) allows remote attackers to… | Patch early | 7.5 high | 70.1% | 2007-01-30 |
| CVE-2008-1491 EXP | Stack-based buffer overflow in the DPC Proxy server (DpcProxy.exe) in ASUS Remote Console (aka ARC or ASMB3) 2.0.0.19 and 2.0.0.24 allows remote attac… | Patch early | 10.0 high | 70.1% | 2008-03-25 |
| CVE-2010-0822 EXP | Stack-based buffer overflow in Microsoft Office Excel 2002 SP3, Office 2004 for Mac, Office 2008 for Mac, and Open XML File Format Converter for Mac a… | Patch early | 9.3 high | 70.1% | 2010-06-08 |
| CVE-2011-0266 EXP | Buffer overflow in nnmRptConfig.exe in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53 allows remote attackers to execute arbitrary code via a… | Patch early | 10.0 high | 70.1% | 2011-01-13 |
| CVE-2021-45010 EXP | A path traversal vulnerability in the file upload functionality in tinyfilemanager.php in Tiny File Manager before 2.4.7 allows remote attackers (with… | Patch early | 8.8 high | 70.1% | 2022-03-15 |
| CVE-2011-3176 EXP | Stack-based buffer overflow in the Preboot Service in Novell ZENworks Configuration Management (ZCM) 11.1 and 11.1a allows remote attackers to execute… | Patch early | 10.0 high | 70.1% | 2012-04-09 |
| CVE-2004-1373 EXP | Format string vulnerability in SHOUTcast 1.9.4 allows remote attackers to cause a denial of service (application crash) and execute arbitrary code via… | Patch early | 7.5 high | 70.1% | 2004-12-23 |
| CVE-2013-2460 EXP | Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, and OpenJDK 7, allows remote atta… | Patch early | 9.3 high | 70% | 2013-06-18 |
| CVE-2007-3614 EXP | Multiple stack-based buffer overflows in waHTTP.exe (aka the SAP DB Web Server) in SAP DB, possibly 7.3 through 7.5, allow remote attackers to execute… | Patch early | 7.5 high | 70% | 2007-07-06 |
| CVE-2019-7257 EXP | Linear eMerge E3-Series devices allow Unrestricted File Upload. | Patch early | 10.0 critical | 70% | 2019-07-02 |
| CVE-2011-2039 EXP | The helper application in Cisco AnyConnect Secure Mobility Client (formerly AnyConnect VPN Client) before 2.3.185 on Windows, and on Windows Mobile, d… | Patch early | 7.6 high | 70% | 2011-06-02 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt