CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
425,791 CVEs
1,781 on KEV
17,562 EPSS ≥ 10%
25,095 with exploits
synced 2026-11-14
338,154 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2009-1730 EXP | Multiple directory traversal vulnerabilities in NetMechanica NetDecision TFTP Server 4.2 allow remote attackers to read or modify arbitrary files via… | Patch early | 10.0 high | 54.5% | 2009-05-20 |
| CVE-2016-2056 EXP | xymond in Xymon 4.1.x, 4.2.x, and 4.3.x before 4.3.25 allow remote authenticated users to execute arbitrary commands via shell metacharacters in the a… | Patch early | 8.8 high | 54.5% | 2016-04-13 |
| CVE-2012-0202 EXP | Multiple stack-based buffer overflows in tm1admsd.exe in the Admin Server in IBM Cognos TM1 9.4.x and 9.5.x before 9.5.2 FP2 allow remote attackers to… | Patch early | 10.0 high | 54.5% | 2012-05-04 |
| CVE-2002-0371 EXP | Buffer overflow in gopher client for Microsoft Internet Explorer 5.1 through 6.0, Proxy Server 2.0, or ISA Server 2000 allows remote attackers to exec… | Patch early | 7.5 high | 54.4% | 2002-07-03 |
| CVE-2007-3040 EXP | Stack-based buffer overflow in agentdpv.dll 2.0.0.3425 in Microsoft Agent on Windows 2000 SP4 allows remote attackers to execute arbitrary code via a… | Patch early | 9.3 high | 54.4% | 2007-09-12 |
| CVE-2011-0027 EXP | Microsoft Data Access Components (MDAC) 2.8 SP1 and SP2, and Windows Data Access Components (WDAC) 6.0, does not properly validate memory allocation f… | Patch early | 9.3 high | 54.4% | 2011-01-12 |
| CVE-2018-10956 EXP | IPConfigure Orchid Core VMS 2.0.5 allows Directory Traversal. | Patch early | 7.5 high | 54.3% | 2018-06-25 |
| CVE-2018-18326 EXP | DNN (aka DotNetNuke) 9.2 through 9.2.2 incorrectly converts encryption key source values, resulting in lower than expected entropy. NOTE: this issue e… | Patch early | 7.5 high | 54.3% | 2019-07-03 |
| CVE-1999-0661 EXP | A system is running a version of software that was replaced with a Trojan Horse at one of its distribution points, such as (1) TCP Wrappers 7.6, (2) u… | Patch early | 10.0 high | 54.2% | 1999-01-01 |
| CVE-2022-33098 EXP | Magnolia CMS v6.2.19 was discovered to contain a cross-site scripting (XSS) vulnerability via the Edit Contact function. This vulnerability allows att… | Patch early | 6.1 medium | 54.1% | 2022-07-07 |
| CVE-2006-2502 EXP | Stack-based buffer overflow in pop3d in Cyrus IMAPD (cyrus-imapd) 2.3.2, when the popsubfolders option is enabled, allows remote attackers to execute… | Patch early | 5.1 medium | 54.1% | 2006-05-22 |
| CVE-2001-0800 EXP | lpsched in IRIX 6.5.13f and earlier allows remote attackers to execute arbitrary commands via shell metacharacters. | Patch early | 10.0 high | 54.1% | 2001-12-06 |
| CVE-2019-19609 EXP | The Strapi framework before 3.0.0-beta.17.8 is vulnerable to Remote Code Execution in the Install and Uninstall Plugin components of the Admin panel,… | Patch early | 7.2 high | 54.1% | 2019-12-05 |
| CVE-2010-1663 EXP | The Google URL Parsing Library (aka google-url or GURL) in Google Chrome before 4.1.249.1064 allows remote attackers to bypass the Same Origin Policy… | Patch early | 10.0 high | 54.1% | 2010-05-03 |
| CVE-2006-2379 EXP | Buffer overflow in the TCP/IP Protocol driver in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 and earlier allows remote attackers t… | Patch early | 9.3 high | 54.1% | 2006-06-13 |
| CVE-2006-6133 EXP | Stack-based buffer overflow in Visual Studio Crystal Reports for Microsoft Visual Studio .NET 2002 and 2002 SP1, .NET 2003 and 2003 SP1, and 2005 and… | Patch early | 7.6 high | 54% | 2006-11-28 |
| CVE-2006-1993 EXP | Mozilla Firefox 1.5.0.2, when designMode is enabled, allows remote attackers to cause a denial of service and possibly execute arbitrary code via cert… | Patch early | 5.1 medium | 54% | 2006-04-25 |
| CVE-2005-0455 EXP | Stack-based buffer overflow in the CSmil1Parser::testAttributeFailed function in smlparse.cpp for RealNetworks RealPlayer 10.5 (6.0.12.1056 and earlie… | Patch early | 5.1 medium | 54% | 2005-05-02 |
| CVE-2008-6221 EXP | PHP remote file inclusion vulnerability in config.dadamail.php in the Dada Mail Manager (com_dadamail) component 2.6 for Joomla! allows remote attacke… | Patch early | 7.5 high | 54% | 2009-02-20 |
| CVE-2016-5312 EXP | Directory traversal vulnerability in the charting component in Symantec Messaging Gateway before 10.6.2 allows remote authenticated users to read arbi… | Patch early | 6.5 medium | 54% | 2017-04-14 |
| CVE-2008-1610 EXP | Stack-based buffer overflow in TallSoft Quick TFTP Server Pro 2.1 allows remote attackers to cause a denial of service or execute arbitrary code via a… | Patch early | 7.5 high | 53.9% | 2008-04-01 |
| CVE-2007-3896 EXP | The URL handling in Shell32.dll in the Windows shell in Microsoft Windows XP and Server 2003, with Internet Explorer 7 installed, allows remote attack… | Patch early | 9.3 high | 53.8% | 2007-10-11 |
| CVE-2018-4233 EXP | An issue was discovered in certain Apple products. iOS before 11.4 is affected. Safari before 11.1.1 is affected. iCloud before 7.5 on Windows is affe… | Patch early | 8.8 high | 53.8% | 2018-06-08 |
| CVE-2008-0550 EXP | Off-by-one error in Steamcast 0.9.75 and earlier allows remote attackers to cause a denial of service (daemon crash) or execute arbitrary code via a c… | Patch early | 10.0 high | 53.8% | 2008-02-01 |
| CVE-2016-5676 EXP | cgi-bin/cgi_system in NUUO NVRmini 2 1.7.5 through 2.x, NUUO NVRsolo 1.7.5 through 2.x, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 allows r… | Patch early | 7.5 high | 53.7% | 2016-08-31 |
| CVE-2013-3502 EXP | monarch_scan.cgi in the MONARCH component in GroundWork Monitor Enterprise 6.7.0 allows remote authenticated users to execute arbitrary commands, and… | Patch early | 6.5 medium | 53.7% | 2013-05-08 |
| CVE-2008-4255 EXP | Heap-based buffer overflow in mscomct2.ocx (aka Windows Common ActiveX control or Microsoft Animation ActiveX control) in Microsoft Visual Basic 6.0,… | Patch early | 9.3 high | 53.7% | 2008-12-10 |
| CVE-2016-3209 EXP | Graphics Device Interface (aka GDI or GDI+) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Se… | Patch early | 5.5 medium | 53.7% | 2016-10-14 |
| CVE-2017-7310 EXP | A buffer overflow vulnerability in Import Command in SyncBreeze before 10.6, DiskSorter before 10.6, DiskBoss before 8.9, DiskPulse before 10.6, DiskS… | Patch early | 7.8 high | 53.7% | 2017-03-29 |
| CVE-2002-1143 EXP | Microsoft Word and Excel allow remote attackers to steal sensitive information via certain field codes that insert the information when the document i… | Patch early | 5.0 medium | 53.6% | 2003-04-11 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt