CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
425,763 CVEs
1,781 on KEV
17,555 EPSS ≥ 10%
25,095 with exploits
synced 2026-11-14
425,763 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2000-0979 EXP | File and Print Sharing service in Windows 95, Windows 98, and Windows Me does not properly check the password for a file share, which allows remote at… | Patch early | 6.4 medium | 75.1% | 2000-12-19 |
| CVE-2006-3942 EXP | The server driver (srv.sys) in Microsoft Windows NT 4.0, 2000, XP, and Server 2003 allows remote attackers to cause a denial of service (system crash)… | Patch early | 7.8 high | 75% | 2006-07-31 |
| CVE-2016-1525 EXP | Directory traversal vulnerability in data/config/image.do in NETGEAR Management System NMS300 1.5.0.11 and earlier allows remote authenticated users t… | Patch early | 8.6 high | 75% | 2016-02-13 |
| CVE-2006-0476 EXP | Buffer overflow in Nullsoft Winamp 5.12 allows remote attackers to execute arbitrary code via a playlist (pls) file with a long file name (File1 field… | Patch early | 7.6 high | 75% | 2006-01-31 |
| CVE-2012-0002 EXP | The Remote Desktop Protocol (RDP) implementation in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008… | Patch early | 9.3 high | 75% | 2012-03-13 |
| CVE-2013-0803 EXP | A PHP File Upload Vulnerability exists in PolarBear CMS 2.5 via upload.php, which could let a malicious user execute arbitrary code. | Patch early | 9.8 critical | 75% | 2020-02-11 |
| CVE-2005-0116 EXP | AWStats 6.1, and other versions before 6.3, allows remote attackers to execute arbitrary commands via shell metacharacters in the configdir parameter… | Patch early | 7.5 high | 74.9% | 2005-01-18 |
| CVE-2009-0920 EXP | Stack-based buffer overflow in OvCgi/Toolbar.exe in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allows remote attackers to execute… | Patch early | 7.5 high | 74.9% | 2009-03-25 |
| CVE-2014-4977 EXP | Multiple SQL injection vulnerabilities in Dell SonicWall Scrutinizer 11.0.1 allow remote authenticated users to execute arbitrary SQL commands via the… | Patch early | 6.5 medium | 74.9% | 2014-07-16 |
| CVE-2018-16167 EXP | LogonTracer 1.2.0 and earlier allows remote attackers to execute arbitrary OS commands via unspecified vectors. | Patch early | 9.8 critical | 74.9% | 2019-01-09 |
| CVE-2015-1592 EXP | Movable Type Pro, Open Source, and Advanced before 5.2.12 and Pro and Advanced 6.0.x before 6.0.7 does not properly use the Perl Storable::thaw functi… | Patch early | 7.5 high | 74.8% | 2015-02-19 |
| CVE-2025-30208 EXP | Vite, a provider of frontend development tooling, has a vulnerability in versions prior to 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10. `@fs` denies acce… | Patch early | 5.3 medium | 74.8% | 2025-03-24 |
| CVE-2018-17128 EXP | A Persistent XSS issue was discovered in the Visual Editor in MyBB before 1.8.19 via a Video MyCode. | Patch early | 5.4 medium | 74.8% | 2018-09-17 |
| CVE-2002-1643 EXP | Multiple buffer overflows in RealNetworks Helix Universal Server 9.0 (9.0.2.768) allow remote attackers to execute arbitrary code via (1) a long Trans… | Patch early | 7.5 high | 74.7% | 2002-12-19 |
| CVE-2004-2466 EXP | chat.ghp in Easy Chat Server 1.2 allows remote attackers to cause a denial of service (server crash) via a long username parameter, possibly due to a… | Patch early | 5.0 medium | 74.7% | 2004-12-31 |
| CVE-2004-1060 EXP | Multiple TCP/IP and ICMP implementations, when using Path MTU (PMTU) discovery (PMTUD), allow remote attackers to cause a denial of service (network t… | Patch early | 5.0 medium | 74.7% | 2004-04-12 |
| CVE-2004-0206 EXP | Network Dynamic Data Exchange (NetDDE) services for Microsoft Windows 98, Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 allows att… | Patch early | 7.5 high | 74.7% | 2004-11-03 |
| CVE-1999-0874 EXP | Buffer overflow in IIS 4.0 allows remote attackers to cause a denial of service via a malformed request for files with .HTR, .IDC, or .STM extensions. | Patch early | 10.0 high | 74.7% | 1999-06-16 |
| CVE-2000-1089 EXP | Buffer overflow in Microsoft Phone Book Service allows local users to execute arbitrary commands, aka the "Phone Book Service Buffer Overflow" vulnera… | Patch early | 10.0 high | 74.6% | 2001-01-09 |
| CVE-2011-1563 EXP | Multiple stack-based buffer overflows in the HMI application in DATAC RealFlex RealWin 2.1 (Build 6.1.10.10) and earlier allow remote attackers to exe… | Patch early | 10.0 high | 74.6% | 2011-04-05 |
| CVE-2013-2115 EXP | Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using t… | Patch early | 8.1 high | 74.6% | 2013-07-10 |
| CVE-2023-6019 EXP | A command injection existed in Ray's cpu_profile URL parameter allowing attackers to execute os commands on the system running the ray dashboard remot… | Patch early | 9.8 critical | 74.6% | 2023-11-16 |
| CVE-2010-3653 EXP | The Director module (dirapi.dll) in Adobe Shockwave Player before 11.5.9.615 allows remote attackers to execute arbitrary code or cause a denial of se… | Patch early | 9.3 high | 74.6% | 2010-10-26 |
| CVE-2016-1542 EXP | The RPC API in RSCD agent in BMC BladeLogic Server Automation (BSA) 8.2.x, 8.3.x, 8.5.x, 8.6.x, and 8.7.x on Linux and UNIX allows remote attackers to… | Patch early | 7.5 high | 74.6% | 2016-06-13 |
| CVE-2008-4193 EXP | Stack-based buffer overflow in SecurityGateway.dll in Alt-N Technologies SecurityGateway 1.0.1 allows remote attackers to execute arbitrary code via a… | Patch early | 10.0 high | 74.6% | 2008-09-24 |
| CVE-2020-35848 EXP | Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php newpassword function. | Patch early | 9.8 critical | 74.6% | 2020-12-30 |
| CVE-2017-8046 EXP | Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay SR1) and Spri… | Patch early | 9.8 critical | 74.5% | 2018-01-04 |
| CVE-2013-7390 EXP | Unrestricted file upload vulnerability in AgentLogUploadServlet in ManageEngine DesktopCentral 7.x and 8.0.0 before build 80293 allows remote attacker… | Patch early | 9.8 critical | 74.5% | 2020-01-27 |
| CVE-2007-3370 EXP | Multiple PHP remote file inclusion vulnerabilities in Sun Board 1.00.00 Alpha allow remote attackers to execute arbitrary PHP code via a URL in (1) th… | Patch early | 7.5 high | 74.5% | 2007-06-22 |
| CVE-2012-5159 EXP | phpMyAdmin 3.5.2.2, as distributed by the cdnetworks-kr-1 mirror during an unspecified time frame in 2012, contains an externally introduced modificat… | Patch early | 7.5 high | 74.5% | 2012-09-25 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt