CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
400,165 CVEs
1,730 on KEV
17,275 EPSS ≥ 10%
25,087 with exploits
synced 2026-10-01
149,467 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2005-1344 EXP | Buffer overflow in htdigest in Apache 2.0.52 may allow attackers to execute arbitrary code via a long realm argument. NOTE: since htdigest is normall… | Patch early | 7.5 high | 29.1% | 2005-05-02 |
| CVE-2015-1730 EXP | Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web sit… | Patch early | 9.3 high | 29.1% | 2015-06-10 |
| CVE-2007-1211 EXP | Unspecified kernel GDI functions in Microsoft Windows 2000 SP4; XP SP2; and Server 2003 Gold, SP1, and SP2 allows user-assisted remote attackers to ca… | Patch early | 7.1 high | 29.1% | 2007-04-04 |
| CVE-1999-0009 EXP | Inverse query buffer overflow in BIND 4.9 and BIND 8 Releases. | Patch early | 10.0 high | 29% | 1998-04-08 |
| CVE-2006-0287 EXP | Unspecified vulnerability in the Oracle HTTP Server component of Oracle Database Server 10.1.0.5 and Application Server 10.1.2.0.2 has unspecified imp… | Patch early | 10.0 high | 29% | 2006-01-18 |
| CVE-2010-4538 EXP | Buffer overflow in the sect_enttec_dmx_da function in epan/dissectors/packet-enttec.c in Wireshark 1.4.2 allows remote attackers to cause a denial of… | Patch early | 9.3 high | 29% | 2011-01-07 |
| CVE-2018-7182 EXP | The ctl_getitem method in ntpd in ntp-4.2.8p6 before 4.2.8p11 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted… | Patch early | 7.5 high | 28.8% | 2018-03-06 |
| CVE-2009-0950 EXP | Stack-based buffer overflow in Apple iTunes before 8.2 allows remote attackers to execute arbitrary code or cause a denial of service (application cra… | Patch early | 9.3 high | 28.8% | 2009-06-02 |
| CVE-2014-6035 EXP | Directory traversal vulnerability in the FileCollector servlet in ZOHO ManageEngine OpManager 11.4, 11.3, and earlier allows remote attackers to write… | Patch early | 7.5 high | 28.8% | 2014-12-04 |
| CVE-2003-0990 EXP | The parseAddress code in (1) SquirrelMail 1.4.0 and (2) GPG Plugin 1.1 allows remote attackers to execute commands via shell metacharacters in the "To… | Patch early | 7.5 high | 28.8% | 2004-01-20 |
| CVE-2019-6225 EXP | A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 12.1.3, macOS Mojave 10.14.3, tvOS 12.1.2. A malicious ap… | Patch early | 7.8 high | 28.8% | 2019-03-05 |
| CVE-2017-0901 EXP | RubyGems version 2.6.12 and earlier fails to validate specification names, allowing a maliciously crafted gem to potentially overwrite any file on the… | Patch early | 7.5 high | 28.7% | 2017-08-31 |
| CVE-2006-0058 EXP | Signal handler race condition in Sendmail 8.13.x before 8.13.6 allows remote attackers to execute arbitrary code by triggering timeouts in a way that… | Patch early | 7.6 high | 28.7% | 2006-03-22 |
| CVE-2008-4384 EXP | Multiple stack-based buffer overflows in MGI Software LPViewer ActiveX control (LPControl.dll), as acquired by Roxio and iseemedia, allow remote attac… | Patch early | 9.3 high | 28.7% | 2008-10-07 |
| CVE-2006-1540 EXP | MSO.DLL in Microsoft Office 2000, Office XP (2002), and Office 2003 allows user-assisted attackers to cause a denial of service and execute arbitrary… | Patch early | 9.3 high | 28.6% | 2006-03-30 |
| CVE-2011-2950 EXP | Heap-based buffer overflow in qcpfformat.dll in RealNetworks RealPlayer 11.0 through 11.1 and 14.0.0 through 14.0.5 and RealPlayer SP 1.0 through 1.1.… | Patch early | 9.3 high | 28.6% | 2011-08-18 |
| CVE-2004-1782 EXP | athenareg.php in Athena Web Registration allows remote attackers to execute arbitrary commands via shell metacharacters in the pass parameter. | Patch early | 7.5 high | 28.6% | 2004-12-31 |
| CVE-2011-5164 EXP | Stack-based buffer overflow in VanDyke Software AbsoluteFTP 1.9.6 through 2.2.10 allows remote FTP servers to execute arbitrary code via a crafted fil… | Patch early | 9.3 high | 28.6% | 2012-09-15 |
| CVE-2015-0008 EXP | The UNC implementation in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows… | Patch early | 8.3 high | 28.6% | 2015-02-11 |
| CVE-2016-0999 EXP | Use-after-free vulnerability in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.5… | Patch early | 8.8 high | 28.6% | 2016-03-12 |
| CVE-2016-1000 EXP | Use-after-free vulnerability in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.5… | Patch early | 8.8 high | 28.6% | 2016-03-12 |
| CVE-2023-0084 EXP | The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via text areas on forms in versions up to… | Patch early | 7.2 high | 28.6% | 2023-03-02 |
| CVE-2012-1592 EXP | A local code execution issue exists in Apache Struts2 when processing malformed XSLT files, which could let a malicious user upload and execute arbitr… | Patch early | 8.8 high | 28.6% | 2019-12-05 |
| CVE-2013-0946 EXP | Buffer overflow in the Library Control Program (LCP) in EMC AlphaStor 4.0 before build 910 allows remote attackers to execute arbitrary code via craft… | Patch early | 9.3 high | 28.5% | 2013-05-10 |
| CVE-2014-1789 EXP | Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web si… | Patch early | 9.3 high | 28.5% | 2014-06-11 |
| CVE-2016-0997 EXP | Use-after-free vulnerability in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.5… | Patch early | 8.8 high | 28.5% | 2016-03-12 |
| CVE-2022-28079 EXP | College Management System v1.0 was discovered to contain a SQL injection vulnerability via the course_code parameter. | Patch early | 8.8 high | 28.5% | 2022-05-05 |
| CVE-2009-0520 EXP | Adobe Flash Player 9.x before 9.0.159.0 and 10.x before 10.0.22.87 does not properly remove references to destroyed objects during Shockwave Flash fil… | Patch early | 9.3 high | 28.5% | 2009-02-26 |
| CVE-2014-6363 EXP | vbscript.dll in Microsoft VBScript 5.6 through 5.8, as used with Internet Explorer 6 through 11 and other products, allows remote attackers to execute… | Patch early | 9.3 high | 28.4% | 2014-12-11 |
| CVE-2010-0269 EXP | The SMB client in Microsoft Windows 2000 SP4, Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista Gold, SP1, and SP2, Windows Server 2008 G… | Patch early | 10.0 high | 28.4% | 2010-04-14 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt