CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
425,751 CVEs
1,781 on KEV
17,555 EPSS ≥ 10%
25,095 with exploits
synced 2026-11-14
425,751 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2017-0070 EXP | A remote code execution vulnerability exists in the way affected Microsoft scripting engines render when handling objects in memory in Microsoft brows… | Patch early | 7.5 high | 76.7% | 2017-03-17 |
| CVE-2017-9554 EXP | An information exposure vulnerability in forget_passwd.cgi in Synology DiskStation Manager (DSM) before 6.1.3-15152 allows remote attackers to enumera… | Patch early | 5.3 medium | 76.7% | 2017-07-24 |
| CVE-2009-2685 EXP | Stack-based buffer overflow in the login form in the management web server in HP Power Manager allows remote attackers to execute arbitrary code via t… | Patch early | 10.0 high | 76.7% | 2009-11-06 |
| CVE-2010-3600 EXP | Unspecified vulnerability in the Client System Analyzer component in Oracle Database Server 11.1.0.7 and 11.2.0.1 and Enterprise Manager Grid Control… | Patch early | 7.5 high | 76.7% | 2011-01-19 |
| CVE-2007-5423 EXP | tiki-graph_formula.php in TikiWiki 1.9.8 allows remote attackers to execute arbitrary code via PHP sequences in the f array parameter, which are proce… | Patch early | 7.5 high | 76.7% | 2007-10-12 |
| CVE-2005-3081 EXP | wzdftpd 0.5.4 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the SITE command. | Patch early | 4.6 medium | 76.6% | 2005-09-27 |
| CVE-2022-44267 EXP | ImageMagick 7.1.0-49 is vulnerable to Denial of Service. When it parses a PNG image (e.g., for resize), the convert process could be left waiting for… | Patch early | 6.5 medium | 76.6% | 2023-02-06 |
| CVE-2000-0649 EXP | IIS 4.0 allows remote attackers to obtain the internal IP address of the server via an HTTP 1.0 request for a web page which is protected by basic aut… | Patch early | 2.6 low | 76.6% | 2000-07-13 |
| CVE-2014-3936 EXP | Stack-based buffer overflow in the do_hnap function in www/my_cgi.cgi in D-Link DSP-W215 (Rev. A1) with firmware 1.01b06 and earlier, DIR-505 with fir… | Patch early | 10.0 high | 76.6% | 2014-06-02 |
| CVE-2018-12710 EXP | An issue was discovered on D-Link DIR-601 2.02NA devices. Being local to the network and having only "User" account (which is a low privilege account)… | Patch early | 8.0 high | 76.5% | 2018-08-29 |
| CVE-2011-3556 EXP | Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7, 6 Update 27 and earlier, 5.0 Update 31 and earlie… | Patch early | 7.5 high | 76.4% | 2011-10-19 |
| CVE-2013-0229 EXP | The ProcessSSDPRequest function in minissdp.c in the SSDP handler in MiniUPnP MiniUPnPd before 1.4 allows remote attackers to cause a denial of servic… | Patch early | 7.8 high | 76.4% | 2013-01-31 |
| CVE-2009-1979 EXP | Unspecified vulnerability in the Network Authentication component in Oracle Database 10.1.0.5 and 10.2.0.4 allows remote attackers to affect confident… | Patch early | 10.0 high | 76.4% | 2009-10-22 |
| CVE-2010-4417 EXP | Unspecified vulnerability in the Services for Beehive component in Oracle Fusion Middleware 2.0.1.0, 2.0.1.1, 2.0.1.2, 2.0.1.2.1, and 2.0.1.3 allows r… | Patch early | 7.5 high | 76.3% | 2011-01-19 |
| CVE-2014-5073 EXP | vmtadmin.cgi in VMTurbo Operations Manager before 4.6 build 28657 allows remote attackers to execute arbitrary commands via shell metacharacters in th… | Patch early | 7.5 high | 76.3% | 2014-08-29 |
| CVE-2018-14728 EXP | upload.php in Responsive FileManager 9.13.1 allows SSRF via the url parameter. | Patch early | 9.8 critical | 76.3% | 2018-08-03 |
| CVE-2021-22145 EXP | A memory disclosure vulnerability was identified in Elasticsearch 7.10.0 to 7.13.3 error reporting. A user with the ability to submit arbitrary querie… | Patch early | 6.5 medium | 76.2% | 2021-07-21 |
| CVE-2022-2884 EXP | A vulnerability in GitLab CE/EE affecting all versions from 11.3.4 prior to 15.1.5, 15.2 to 15.2.3, 15.3 to 15.3 to 15.3.1 allows an an authenticated… | Patch early | 9.9 critical | 76.2% | 2022-10-17 |
| CVE-2010-2156 EXP | ISC DHCP 4.1 before 4.1.1-P1 and 4.0 before 4.0.2-P1 allows remote attackers to cause a denial of service (server exit) via a zero-length client ID. | Patch early | 5.0 medium | 76.2% | 2010-06-07 |
| CVE-2007-0042 EXP | Interpretation conflict in ASP.NET in Microsoft .NET Framework 1.0, 1.1, and 2.0 for Windows 2000, XP, Server 2003, and Vista allows remote attackers… | Patch early | 7.8 high | 76.2% | 2007-07-10 |
| CVE-2013-1391 EXP | Authentication bypass vulnerability in the the web interface in Hunt CCTV, Capture CCTV, Hachi CCTV, NoVus CCTV, and Well-Vision Inc DVR systems allow… | Patch early | 7.5 high | 76.1% | 2019-10-30 |
| CVE-2023-4220 EXP | Unrestricted file upload in big file upload functionality in `/main/inc/lib/javascript/bigupload/inc/bigUpload.php` in Chamilo LMS <= v1.11.24 allows… | Patch early | 8.1 high | 76.1% | 2023-11-28 |
| CVE-2023-38836 EXP | File Upload vulnerability in BoidCMS v.2.0.0 allows a remote attacker to execute arbitrary code by adding a GIF header to bypass MIME type checks. | Patch early | 8.8 high | 76% | 2023-08-21 |
| CVE-2002-1142 EXP | Heap-based buffer overflow in the Remote Data Services (RDS) component of Microsoft Data Access Components (MDAC) 2.1 through 2.6, and Internet Explor… | Patch early | 7.5 high | 76% | 2002-11-29 |
| CVE-2018-9160 EXP | SickRage before v2018.03.09-1 includes cleartext credentials in HTTP responses. | Patch early | 9.8 critical | 76% | 2018-03-31 |
| CVE-2013-5486 EXP | Directory traversal vulnerability in processImageSave.jsp in DCNM-SAN Server in Cisco Prime Data Center Network Manager (DCNM) before 6.2(1) allows re… | Patch early | 10.0 high | 76% | 2013-09-23 |
| CVE-2007-4880 EXP | Buffer overflow in the Client Acceptor Daemon (CAD), dsmcad.exe, in certain IBM Tivoli Storage Manager (TSM) clients 5.1 before 5.1.8.1, 5.2 before 5.… | Patch early | 10.0 high | 75.9% | 2007-09-28 |
| CVE-2018-8065 EXP | An issue was discovered in the web server in Flexense SyncBreeze Enterprise 10.6.24. There is a user mode write access violation on the syncbrs.exe me… | Patch early | 7.5 high | 75.9% | 2018-03-12 |
| CVE-2008-1232 EXP | Cross-site scripting (XSS) vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16 allows remote attackers… | Patch early | 4.3 medium | 75.9% | 2008-08-04 |
| CVE-2019-1937 EXP | A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Di… | Patch early | 9.8 critical | 75.9% | 2019-08-21 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt