CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
425,794 CVEs
1,781 on KEV
17,562 EPSS ≥ 10%
25,095 with exploits
synced 2026-11-15
338,154 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2015-6127 EXP | Windows Media Center in Microsoft Windows Vista SP2, Windows 7 SP1, Windows 8, and Windows 8.1 allows remote attackers to read arbitrary files via a c… | Patch early | 4.3 medium | 46% | 2015-12-09 |
| CVE-2023-4168 EXP | A vulnerability was found in Templatecookie Adlisting 2.14.0. It has been classified as problematic. Affected is an unknown function of the file /ad-l… | Patch early | 4.3 medium | 46% | 2023-08-05 |
| CVE-2007-5098 EXP | Multiple PHP remote file inclusion vulnerabilities in DFD Cart 1.1.4 and earlier, when register_globals is enabled, allow remote attackers to execute… | Patch early | 6.8 medium | 46% | 2007-09-26 |
| CVE-2008-1309 EXP | The RealAudioObjects.RealAudio ActiveX control in rmoc3260.dll in RealNetworks RealPlayer Enterprise, RealPlayer 10, RealPlayer 10.5 before build 6.0.… | Patch early | 9.3 high | 46% | 2008-03-12 |
| CVE-2021-39608 EXP | Remote Code Execution (RCE) vulnerabilty exists in FlatCore-CMS 2.0.7 via the upload addon plugin, which could let a remote malicious user exeuct arbi… | Patch early | 7.2 high | 45.9% | 2021-08-23 |
| CVE-2014-9013 EXP | The ajaxinit function in wpmarketplace/libs/cart.php in the WP Marketplace plugin 2.4.0 for WordPress allows remote authenticated users to create arbi… | Patch early | 8.8 high | 45.9% | 2019-11-06 |
| CVE-2019-9692 EXP | class.showtime2_image.php in CMS Made Simple (CMSMS) before 2.2.10 does not ensure that a watermark file has a standard image file extension (GIF, JPG… | Patch early | 6.5 medium | 45.9% | 2019-03-11 |
| CVE-2007-3901 EXP | Stack-based buffer overflow in the DirectShow Synchronized Accessible Media Interchange (SAMI) parser in quartz.dll for Microsoft DirectX 7.0 through… | Patch early | 8.5 high | 45.9% | 2007-12-12 |
| CVE-2008-0387 EXP | Integer overflow in Firebird SQL 1.0.3 and earlier, 1.5.x before 1.5.6, 2.0.x before 2.0.4, and 2.1.x before 2.1.0 RC1 might allow remote attackers to… | Patch early | 7.8 high | 45.9% | 2008-01-29 |
| CVE-2007-2141 EXP | Direct static code injection vulnerability in shoutbox.php in ShoutPro 1.5.2 allows remote attackers to inject arbitrary PHP code into shouts.php via… | Patch early | 7.5 high | 45.8% | 2007-04-19 |
| CVE-2007-1435 EXP | Buffer overflow in D-Link TFTP Server 1.0 allows remote attackers to cause a denial of service (crash) via a long (1) GET or (2) PUT request, which tr… | Patch early | 10.0 high | 45.8% | 2007-03-13 |
| CVE-2015-5563 EXP | Use-after-free vulnerability in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199… | Patch early | 10.0 high | 45.8% | 2015-08-14 |
| CVE-2011-5171 EXP | Multiple stack-based buffer overflows in CyberLink Power2Go 7 (build 196) and 8 (build 1031) allow remote attackers to execute arbitrary code via the… | Patch early | 9.3 high | 45.8% | 2012-09-15 |
| CVE-2005-2373 EXP | Buffer overflow in SlimFTPd 3.15 and 3.16 allows remote authenticated users to execute arbitrary code via a long directory name to (1) LIST, (2) DELE… | Patch early | 7.2 high | 45.7% | 2005-07-26 |
| CVE-2008-4696 EXP | Cross-site scripting (XSS) vulnerability in Opera.dll in Opera before 9.61 allows remote attackers to inject arbitrary web script or HTML via the anch… | Patch early | 4.3 medium | 45.7% | 2008-10-23 |
| CVE-2007-4814 EXP | Buffer overflow in the SQLServer ActiveX control in the Distributed Management Objects OLE DLL (sqldmo.dll) 2000.085.2004.00 in Microsoft SQL Server E… | Patch early | 7.5 high | 45.7% | 2007-09-11 |
| CVE-2005-1989 EXP | Unknown vulnerability in Internet Explorer 5.0, 5.5, and 6.0 allows remote attackers to obtain information and possibly execute code when browsing fro… | Patch early | 7.5 high | 45.7% | 2005-08-10 |
| CVE-2000-0126 EXP | Sample Internet Data Query (IDQ) scripts in IIS 3 and 4 allow remote attackers to read files via a .. (dot dot) attack. | Patch early | 5.0 medium | 45.7% | 2000-01-26 |
| CVE-2017-0202 EXP | A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory. The vulnerability could corrupt memory in s… | Patch early | 7.5 high | 45.6% | 2017-04-12 |
| CVE-2018-8736 EXP | A privilege escalation vulnerability in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to leverage an RCE vulnerability escalating to… | Patch early | 8.8 high | 45.6% | 2018-04-18 |
| CVE-2005-1988 EXP | Unknown vulnerability in Internet Explorer 5.0, 5.5, and 6.0 allows remote attackers to execute arbitrary code via a web site or an HTML e-mail contai… | Patch early | 5.1 medium | 45.6% | 2005-08-10 |
| CVE-2006-4704 EXP | Cross-zone scripting vulnerability in the WMI Object Broker (WMIScriptUtils.WMIObjectBroker2) ActiveX control (WmiScriptUtils.dll) in Microsoft Visual… | Patch early | 6.8 medium | 45.6% | 2006-11-01 |
| CVE-2007-2238 EXP | Multiple stack-based buffer overflows in the Whale Client Components ActiveX control (WhlMgr.dll), as used in Microsoft Intelligent Application Gatewa… | Patch early | 9.3 high | 45.5% | 2009-04-16 |
| CVE-2017-11885 EXP | Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703 and 1709, Win… | Patch early | 6.6 medium | 45.5% | 2017-12-12 |
| CVE-2015-5539 EXP | Use-after-free vulnerability in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199… | Patch early | 10.0 high | 45.5% | 2015-08-14 |
| CVE-2015-5540 EXP | Use-after-free vulnerability in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199… | Patch early | 10.0 high | 45.5% | 2015-08-14 |
| CVE-2015-5574 EXP | Use-after-free vulnerability in Adobe Flash Player before 18.0.0.241 and 19.x before 19.0.0.185 on Windows and OS X and before 11.2.202.521 on Linux,… | Patch early | 10.0 high | 45.5% | 2015-09-22 |
| CVE-2015-7245 EXP | Directory traversal vulnerability in D-Link DVG-N5402SP with firmware W1000CN-00, W1000CN-03, or W2000EN-00 allows remote attackers to read sensitive… | Patch early | 7.5 high | 45.5% | 2017-04-24 |
| CVE-2009-3031 EXP | Stack-based buffer overflow in the BrowseAndSaveFile method in the Altiris eXpress NS ConsoleUtilities ActiveX control 6.0.0.1846 in AeXNSConsoleUtili… | Patch early | 9.3 high | 45.4% | 2009-11-03 |
| CVE-2022-22909 EXP | HotelDruid v3.0.3 was discovered to contain a remote code execution (RCE) vulnerability which is exploited via an attacker inserting a crafted payload… | Patch early | 8.8 high | 45.4% | 2022-03-03 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt