CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
425,731 CVEs
1,781 on KEV
17,555 EPSS ≥ 10%
25,095 with exploits
synced 2026-11-14
217,814 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2018-6583 EXP | SQL Injection exists in the Timetable Responsive Schedule 1.5 component for Joomla! via a view=event&alias= request. | Patch early | 9.8 critical | 19.2% | 2018-02-17 |
| CVE-2018-7313 EXP | SQL Injection exists in the CW Tags 2.0.6 component for Joomla! via the searchtext array parameter. | Patch early | 9.8 critical | 19.2% | 2018-02-22 |
| CVE-1999-0386 EXP | Microsoft Personal Web Server and FrontPage Personal Web Server in some Windows systems allows a remote attacker to read files on the server by using… | Patch early | 5.0 medium | 19.1% | 1999-03-01 |
| CVE-2006-0187 EXP | By design, Microsoft Visual Studio 2005 automatically executes code in the Load event of a user-defined control (UserControl1_Load function), which al… | Patch early | 5.1 medium | 19.1% | 2006-01-12 |
| CVE-2015-5995 EXP | Mediabridge Medialink MWN-WAPR300N devices with firmware 5.07.50 and Tenda N3 Wireless N150 devices allow remote attackers to obtain administrative ac… | Patch early | 9.8 critical | 19.1% | 2015-12-31 |
| CVE-2011-3833 EXP | Unrestricted file upload vulnerability in ftp_upload_file.php in Support Incident Tracker (aka SiT!) 3.65 allows remote authenticated users to execute… | Patch early | 6.0 medium | 19% | 2012-01-29 |
| CVE-2017-17849 EXP | A buffer overflow vulnerability in GetGo Download Manager 5.3.0.2712 and earlier could allow remote HTTP servers to execute arbitrary code on NAS devi… | Patch early | 9.8 critical | 19% | 2017-12-27 |
| CVE-2024-6298 EXP | Unauthorized file access in WEB Server in ABB ASPECT - Enterprise v3.08.01; NEXUS Series v3.08.01 ; MATRIX Series v3.08.01 allows Attacker to ex… | Patch early | 10.0 critical | 19% | 2024-07-05 |
| CVE-2009-2433 EXP | Stack-based buffer overflow in the AddFavorite method in Microsoft Internet Explorer allows remote attackers to cause a denial of service (application… | Patch early | 4.3 medium | 18.9% | 2009-07-10 |
| CVE-2017-1000375 EXP | NetBSD maps the run-time link-editor ld.so directly below the stack region, even if ASLR is enabled, this allows attackers to more easily manipulate m… | Patch early | 9.8 critical | 18.9% | 2017-06-19 |
| CVE-2010-4409 EXP | Integer overflow in the NumberFormatter::getSymbol (aka numfmt_get_symbol) function in PHP 5.3.3 and earlier allows context-dependent attackers to cau… | Patch early | 5.0 medium | 18.9% | 2010-12-06 |
| CVE-2015-4414 EXP | Directory traversal vulnerability in download_audio.php in the SE HTML5 Album Audio Player (se-html5-album-audio-player) plugin 1.1.0 and earlier for… | Patch early | 5.0 medium | 18.8% | 2015-06-17 |
| CVE-2004-0526 EXP | Unknown versions of Internet Explorer and Outlook allow remote attackers to spoof a legitimate URL in the status bar via A HREF tags with modified "al… | Patch early | 5.0 medium | 18.8% | 2004-08-06 |
| CVE-2015-6908 EXP | The ber_get_next function in libraries/liblber/io.c in OpenLDAP 2.4.42 and earlier allows remote attackers to cause a denial of service (reachable ass… | Patch early | 5.0 medium | 18.8% | 2015-09-11 |
| CVE-2013-1861 EXP | MariaDB 5.5.x before 5.5.30, 5.3.x before 5.3.13, 5.2.x before 5.2.15, and 5.1.x before 5.1.68, and Oracle MySQL 5.1.69 and earlier, 5.5.31 and earlie… | Patch early | 5.0 medium | 18.8% | 2013-03-28 |
| CVE-2014-5368 EXP | Directory traversal vulnerability in the file_get_contents function in downloadfiles/download.php in the WP Content Source Control (wp-source-control)… | Patch early | 5.0 medium | 18.8% | 2014-08-22 |
| CVE-2008-2650 EXP | Directory traversal vulnerability in cmsimple/cms.php in CMSimple 3.1, when register_globals is enabled, allows remote attackers to include and execut… | Patch early | 6.8 medium | 18.8% | 2008-06-10 |
| CVE-2005-0199 EXP | Integer underflow in the Lists_MakeMask() function in lists.c in ngIRCd before 0.8.2 allows remote attackers to cause a denial of service (application… | Patch early | 9.8 critical | 18.8% | 2005-05-02 |
| CVE-2001-0348 EXP | Microsoft Windows 2000 telnet service allows attackers to cause a denial of service (crash) via a long logon command that contains a backspace. | Patch early | 5.0 medium | 18.8% | 2001-07-21 |
| CVE-2019-13294 EXP | AROX School-ERP Pro has a command execution vulnerability. import_stud.php and upload_fille.php do not have session control. Therefore an unauthentica… | Patch early | 9.8 critical | 18.8% | 2019-07-04 |
| CVE-2004-0501 EXP | Outlook 2003 allows remote attackers to bypass intended access restrictions and cause Outlook to request a URL from a remote site via an HTML e-mail m… | Patch early | 5.0 medium | 18.7% | 2004-08-18 |
| CVE-2005-1279 EXP | tcpdump 3.8.3 and earlier allows remote attackers to cause a denial of service (infinite loop) via a crafted (1) BGP packet, which is not properly han… | Patch early | 5.0 medium | 18.7% | 2005-05-02 |
| CVE-2018-5782 EXP | A vulnerability in the conferencing component of Mitel Connect ONSITE, versions R1711-PREM and earlier, and Mitel ST 14.2, release GA28 and earlier, c… | Patch early | 9.8 critical | 18.7% | 2018-03-14 |
| CVE-2010-1353 EXP | Directory traversal vulnerability in the LoginBox Pro (com_loginbox) component for Joomla! allows remote attackers to read arbitrary files via a .. (d… | Patch early | 5.0 medium | 18.7% | 2010-04-12 |
| CVE-2010-1657 EXP | Directory traversal vulnerability in the SmartSite (com_smartsite) component 1.0.0 for Joomla! allows remote attackers to read arbitrary files via a .… | Patch early | 5.0 medium | 18.7% | 2010-05-03 |
| CVE-2010-1714 EXP | Directory traversal vulnerability in the Arcade Games (com_arcadegames) component 1.0 for Joomla! allows remote attackers to read arbitrary files via… | Patch early | 5.0 medium | 18.7% | 2010-05-04 |
| CVE-2023-5702 EXP | A vulnerability was found in Viessmann Vitogate 300 up to 2.1.3.0 and classified as problematic. Affected by this issue is some unknown functionality… | Patch early | 4.3 medium | 18.7% | 2023-10-23 |
| CVE-2009-4098 EXP | Unrestricted file upload vulnerability in banner-edit.php in OpenX adserver 2.8.1 and earlier allows remote authenticated users with banner / file upl… | Patch early | 6.0 medium | 18.7% | 2009-11-29 |
| CVE-2002-1148 EXP | The default servlet (org.apache.catalina.servlets.DefaultServlet) in Tomcat 4.0.4 and 4.1.10 and earlier allows remote attackers to read source code f… | Patch early | 5.0 medium | 18.6% | 2002-10-11 |
| CVE-2012-6495 EXP | Multiple directory traversal vulnerabilities in the (1) twikidraw (action/twikidraw.py) and (2) anywikidraw (action/anywikidraw.py) actions in MoinMoi… | Patch early | 6.0 medium | 18.6% | 2013-01-03 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt