CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
399,661 CVEs
1,729 on KEV
17,272 EPSS ≥ 10%
25,086 with exploits
synced 2026-09-30
318,585 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2016-0015 EXP | DirectShow in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2,… | Patch early | 7.8 high | 49.4% | 2016-01-13 |
| CVE-2018-16323 EXP | ReadXBMImage in coders/xbm.c in ImageMagick before 7.0.8-9 leaves data uninitialized when processing an XBM file that has a negative pixel value. If t… | Patch early | 6.5 medium | 49.3% | 2018-09-01 |
| CVE-2015-6967 EXP | Unrestricted file upload vulnerability in the My Image plugin in Nibbleblog before 4.0.5 allows remote administrators to execute arbitrary code by upl… | Patch early | 6.5 medium | 49.3% | 2015-09-16 |
| CVE-2011-3230 EXP | Apple Safari before 5.1.1 on Mac OS X does not enforce an intended policy for file: URLs, which allows remote attackers to execute arbitrary code via… | Patch early | 6.8 medium | 49.3% | 2011-10-14 |
| CVE-2008-4114 EXP | srv.sys in the Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 allows remot… | Patch early | 7.1 high | 49.3% | 2008-09-16 |
| CVE-2020-6010 EXP | LearnPress Wordpress plugin version prior and including 3.2.6.7 is vulnerable to SQL Injection | Patch early | 8.8 high | 49.2% | 2020-04-30 |
| CVE-2006-2685 EXP | PHP remote file inclusion vulnerability in Basic Analysis and Security Engine (BASE) 1.2.4 and earlier, with register_globals enabled, allows remote a… | Patch early | 4.0 medium | 49.2% | 2006-05-31 |
| CVE-2008-1311 EXP | The TFTP server in PacketTrap pt360 Tool Suite PRO 2.0.3901.0 and earlier allows remote attackers to cause a denial of service (daemon hang) by upload… | Patch early | 5.0 medium | 49.2% | 2008-03-12 |
| CVE-2004-0200 EXP | Buffer overflow in the JPEG (JPG) parsing engine in the Microsoft Graphic Device Interface Plus (GDI+) component, GDIPlus.dll, allows remote attackers… | Patch early | 9.3 high | 49% | 2004-09-28 |
| CVE-2016-0736 EXP | In Apache HTTP Server versions 2.4.0 to 2.4.23, mod_session_crypto was encrypting its data/cookie using the configured ciphers with possibly either CB… | Patch early | 7.5 high | 49% | 2017-07-27 |
| CVE-2012-1803 EXP | RuggedCom Rugged Operating System (ROS) 3.10.x and earlier has a factory account with a password derived from the MAC Address field in the banner, whi… | Patch early | 8.5 high | 49% | 2012-04-28 |
| CVE-2007-4776 EXP | Buffer overflow in Microsoft Visual Basic 6.0 and Enterprise Edition 6.0 SP6 allows user-assisted remote attackers to execute arbitrary code via a Vis… | Patch early | 9.3 high | 49% | 2007-09-10 |
| CVE-2007-0015 EXP | Buffer overflow in Apple QuickTime 7.1.3 allows remote attackers to execute arbitrary code via a long rtsp:// URI. | Patch early | 6.8 medium | 48.9% | 2007-01-01 |
| CVE-2005-3388 EXP | Cross-site scripting (XSS) vulnerability in the phpinfo function in PHP 4.x up to 4.4.0 and 5.x up to 5.0.5 allows remote attackers to inject arbitrar… | Patch early | 4.3 medium | 48.9% | 2005-11-01 |
| CVE-2009-0517 EXP | Eval injection vulnerability in index.php in phpSlash 0.8.1.1 and earlier allows remote attackers to execute arbitrary PHP code via the fields paramet… | Patch early | 10.0 high | 48.9% | 2009-02-11 |
| CVE-2011-0514 EXP | The RDS service (rds.exe) in HP Data Protector Manager 6.11 allows remote attackers to cause a denial of service (crash) via a packet with a large dat… | Patch early | 5.0 medium | 48.9% | 2011-01-20 |
| CVE-2020-11798 EXP | A Directory Traversal vulnerability in the web conference component of Mitel MiCollab AWV before 8.1.2.4 and 9.x before 9.1.3 could allow an attacker… | Patch early | 5.3 medium | 48.8% | 2020-06-10 |
| CVE-2006-1315 EXP | The Server Service (SRV.SYS driver) in Microsoft Windows 2000 SP4, XP SP1 and SP2, Server 2003 up to SP1, and other products, allows remote attackers… | Patch early | 5.0 medium | 48.8% | 2006-07-11 |
| CVE-2004-0841 EXP | Internet Explorer 6.x allows remote attackers to install arbitrary programs via mousedown events that call the Popup.show method and use drag-and-drop… | Patch early | 5.0 medium | 48.7% | 2004-12-23 |
| CVE-2007-2223 EXP | Microsoft XML Core Services (MSXML) 3.0 through 6.0 allows remote attackers to execute arbitrary code via the substringData method on a (1) TextNode o… | Patch early | 9.3 high | 48.7% | 2007-08-14 |
| CVE-2022-31188 EXP | CVAT is an opensource interactive video and image annotation tool for computer vision. Versions prior to 2.0.0 were found to be subject to a Server-si… | Patch early | 8.6 high | 48.6% | 2022-08-01 |
| CVE-2003-1339 EXP | Stack-based buffer overflow in eZnet.exe, as used in eZ (a) eZphotoshare, (b) eZmeeting, (c) eZnetwork, and (d) eZshare allows remote attackers to cau… | Patch early | 10.0 high | 48.6% | 2003-12-31 |
| CVE-2008-1043 EXP | PHP remote file inclusion vulnerability in templates/default/header.inc.php in Linux Web Shop (LWS) php User Base 1.3 BETA allows remote attackers to… | Patch early | 7.5 high | 48.6% | 2008-02-27 |
| CVE-2016-0170 EXP | GDI in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, a… | Patch early | 8.8 high | 48.6% | 2016-05-11 |
| CVE-2003-0725 EXP | Buffer overflow in the RTSP protocol parser for the View Source plug-in (vsrcplin.so or vsrcplin3260.dll) for RealNetworks Helix Universal Server 9 an… | Patch early | 7.5 high | 48.6% | 2003-10-20 |
| CVE-2017-11855 EXP | Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows… | Patch early | 7.5 high | 48.6% | 2017-11-15 |
| CVE-2018-14392 EXP | The New Threads plugin before 1.2 for MyBB has XSS. | Patch early | 6.1 medium | 48.6% | 2018-07-19 |
| CVE-1999-0209 EXP | The SunView (SunTools) selection_svc facility allows remote users to read files. | Patch early | 5.0 medium | 48.5% | 1990-08-14 |
| CVE-2005-1990 EXP | Internet Explorer 5.0, 5.5, and 6.0 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a… | Patch early | 5.1 medium | 48.5% | 2005-08-10 |
| CVE-2019-0768 EXP | A security feature bypass vulnerability exists when Internet Explorer VBScript execution policy does not properly restrict VBScript under specific con… | Patch early | 4.3 medium | 48.5% | 2019-04-09 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt