CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
399,810 CVEs
1,729 on KEV
17,272 EPSS ≥ 10%
25,086 with exploits
synced 2026-09-30
149,285 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2012-0284 EXP | Stack-based buffer overflow in the SetSource method in the Cisco Linksys PlayerPT ActiveX control 1.0.0.15 in PlayerPT.ocx on the Cisco WVC200 Wireles… | Patch early | 9.3 high | 36.3% | 2012-07-19 |
| CVE-2009-0215 EXP | Stack-based buffer overflow in the GetXMLValue method in the IBM Access Support ActiveX control in IbmEgath.dll, as distributed on IBM and Lenovo comp… | Patch early | 9.3 high | 36.3% | 2009-03-25 |
| CVE-2022-26965 EXP | In Pluck 4.7.16, an admin user can use the theme upload functionality at /admin.php?action=themeinstall to perform remote code execution. | Patch early | 7.2 high | 36.3% | 2022-03-18 |
| CVE-2008-3878 EXP | Stack-based buffer overflow in the Ultra.OfficeControl ActiveX control in OfficeCtrl.ocx 2.0.2008.801 in Ultra Shareware Ultra Office Control allows r… | Patch early | 9.3 high | 36.2% | 2008-09-02 |
| CVE-2008-5664 EXP | Stack-based buffer overflow in Realtek Media Player (aka Realtek Sound Manager, RtlRack, or rtlrack.exe) 1.15.0.0 allows remote attackers to execute a… | Patch early | 9.3 high | 36.2% | 2008-12-19 |
| CVE-2007-2884 EXP | Multiple stack-based buffer overflows in Microsoft Visual Basic 6 allow user-assisted remote attackers to cause a denial of service (CPU consumption)… | Patch early | 9.3 high | 36.2% | 2007-05-30 |
| CVE-2011-2763 EXP | The web interface on the LifeSize Room appliance LS_RM1_3.5.3 (11) and 4.7.18 allows remote attackers to execute arbitrary commands via a modified req… | Patch early | 7.5 high | 36.1% | 2011-09-02 |
| CVE-2021-42697 EXP | Akka HTTP 10.1.x before 10.1.15 and 10.2.x before 10.2.7 can encounter stack exhaustion while parsing HTTP headers, which allows a remote attacker to… | Patch early | 7.5 high | 36.1% | 2021-11-02 |
| CVE-2007-3410 EXP | Stack-based buffer overflow in the SmilTimeValue::parseWallClockValue function in smlprstime.cpp in RealNetworks RealPlayer 10, 10.1, and possibly 10.… | Patch early | 9.3 high | 36.1% | 2007-06-26 |
| CVE-2012-3752 EXP | Multiple buffer overflows in Apple QuickTime before 7.7.3 allow remote attackers to execute arbitrary code or cause a denial of service (application c… | Patch early | 9.3 high | 36% | 2012-11-09 |
| CVE-2010-1527 EXP | Stack-based buffer overflow in Novell iPrint Client before 5.44 allows remote attackers to execute arbitrary code via a long call-back-url parameter i… | Patch early | 9.3 high | 36% | 2010-08-23 |
| CVE-2008-5518 EXP | Multiple directory traversal vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 on Windows allo… | Patch early | 9.4 high | 35.9% | 2009-04-17 |
| CVE-2014-0784 EXP | Stack-based buffer overflow in BKBCopyD.exe in Yokogawa CENTUM CS 3000 R3.09.50 and earlier allows remote attackers to execute arbitrary code via a cr… | Patch early | 8.3 high | 35.9% | 2014-03-14 |
| CVE-2012-5975 EXP | The SSH USERAUTH CHANGE REQUEST feature in SSH Tectia Server 6.0.4 through 6.0.20, 6.1.0 through 6.1.12, 6.2.0 through 6.2.5, and 6.3.0 through 6.3.2… | Patch early | 9.3 high | 35.9% | 2012-12-04 |
| CVE-2007-5107 EXP | Stack-based buffer overflow in the AskJeevesToolBar.SettingsPlugin.1 ActiveX control in askBar.dll in IAC Search & Media ask.com Ask Toolbar 4.0.2.53… | Patch early | 9.3 high | 35.9% | 2007-09-26 |
| CVE-2018-16288 EXP | LG SuperSign CMS allows reading of arbitrary files via signEzUI/playlist/edit/upload/..%2f URIs. | Patch early | 8.6 high | 35.8% | 2018-09-14 |
| CVE-2005-0511 EXP | misc.php for vBulletin 3.0.6 and earlier, when "Add Template Name in HTML Comments" is enabled, allows remote attackers to execute arbitrary PHP code… | Patch early | 7.5 high | 35.8% | 2005-02-21 |
| CVE-2021-22146 EXP | All versions of Elastic Cloud Enterprise has the Elasticsearch “anonymous” user enabled by default in deployed clusters. While in the default setting… | Patch early | 7.5 high | 35.8% | 2021-07-21 |
| CVE-2007-1658 EXP | Windows Mail in Microsoft Windows Vista might allow user-assisted remote attackers to execute certain programs via a link to a (1) local file or (2) U… | Patch early | 9.3 high | 35.8% | 2007-03-24 |
| CVE-2015-3783 EXP | SceneKit in Apple OS X before 10.10.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and applicatio… | Patch early | 7.5 high | 35.8% | 2015-08-16 |
| CVE-2008-3571 EXP | The Xerox Phaser 8400 allows remote attackers to cause a denial of service (reboot) via an empty UDP packet to port 1900. | Patch early | 7.8 high | 35.7% | 2008-08-10 |
| CVE-2022-47878 EXP | Incorrect input validation for the default-storage-path in the settings page in Jedox 2020.2.5 allows remote, authenticated users to specify the locat… | Patch early | 8.8 high | 35.7% | 2023-05-02 |
| CVE-2003-1336 EXP | Buffer overflow in mIRC before 6.11 allows remote attackers to execute arbitrary code via a long irc:// URL. | Patch early | 9.3 high | 35.7% | 2003-12-31 |
| CVE-2010-2746 EXP | Heap-based buffer overflow in Comctl32.dll (aka the common control library) in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vist… | Patch early | 7.6 high | 35.7% | 2010-10-13 |
| CVE-2015-2510 EXP | Buffer overflow in the Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2, Office 2007 SP3, Office 2010 SP2, Lync 2010… | Patch early | 9.3 high | 35.6% | 2015-09-09 |
| CVE-2013-6420 EXP | The asn1_time_to_time_t function in ext/openssl/openssl.c in PHP before 5.3.28, 5.4.x before 5.4.23, and 5.5.x before 5.5.7 does not properly parse (1… | Patch early | 7.5 high | 35.6% | 2013-12-17 |
| CVE-2021-43405 EXP | An issue was discovered in FusionPBX before 4.5.30. The fax_extension may have risky characters (it is not constrained to be numeric). | Patch early | 8.8 high | 35.6% | 2021-11-05 |
| CVE-2015-2456 EXP | Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Go… | Patch early | 9.3 high | 35.6% | 2015-08-15 |
| CVE-2015-2462 EXP | ATMFD.DLL in the Windows Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Wind… | Patch early | 9.3 high | 35.6% | 2015-08-15 |
| CVE-2015-2464 EXP | Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Go… | Patch early | 9.3 high | 35.6% | 2015-08-15 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt