CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
401,121 CVEs
1,733 on KEV
17,292 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-04
10,149 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2006-1219 EXP | Directory traversal vulnerability in Gallery 2.0.3 and earlier, and 2.1 before RC-2a, allows remote attackers to include arbitrary PHP files via ".."… | Patch early | 5.0 medium | 3.8% | 2006-03-14 |
| CVE-2006-3396 EXP | PHP remote file inclusion vulnerability in galleria.html.php in Galleria Mambo Module 1.0 and earlier for Mambo allows remote attackers to execute arb… | Patch early | 6.8 medium | 3.8% | 2006-07-06 |
| CVE-2018-11339 EXP | An XSS issue was discovered in Frappe ERPNext v11.x.x-develop b1036e5 via a comment. | Patch early | 6.1 medium | 3.8% | 2018-05-22 |
| CVE-2019-12460 EXP | Web Port 1.19.1 allows XSS via the /access/setup type parameter. | Patch early | 6.1 medium | 3.8% | 2019-05-30 |
| CVE-2006-2144 EXP | PHP remote file inclusion vulnerability in kopf.php in DMCounter 0.9.2-b allows remote attackers to execute arbitrary PHP code via a URL in the rootdi… | Patch early | 6.4 medium | 3.8% | 2006-05-02 |
| CVE-2007-5772 EXP | Direct static code injection vulnerability in the download module in Flatnuke 3 allows remote authenticated administrators to inject arbitrary PHP cod… | Patch early | 6.0 medium | 3.8% | 2007-11-01 |
| CVE-2017-9123 EXP | The lqt_frame_duration function in lqt_quicktime.c in libquicktime 1.2.4 allows remote attackers to cause a denial of service (invalid memory read and… | Patch early | 6.5 medium | 3.8% | 2017-06-12 |
| CVE-2017-9124 EXP | The quicktime_match_32 function in util.c in libquicktime 1.2.4 allows remote attackers to cause a denial of service (NULL pointer dereference and app… | Patch early | 6.5 medium | 3.8% | 2017-06-12 |
| CVE-2017-9128 EXP | The quicktime_video_width function in lqt_quicktime.c in libquicktime 1.2.4 allows remote attackers to cause a denial of service (heap-based buffer ov… | Patch early | 6.5 medium | 3.8% | 2017-06-12 |
| CVE-2006-1497 EXP | Directory traversal vulnerability in index.php in ViHor Design allows remote attackers to read arbitrary files via the page parameter. | Patch early | 5.0 medium | 3.8% | 2006-03-30 |
| CVE-2007-2048 EXP | Directory traversal vulnerability in /console in the Management Console in webMethods Glue 6.5.1 and earlier allows remote attackers to read arbitrary… | Patch early | 5.0 medium | 3.8% | 2007-04-16 |
| CVE-2004-2617 EXP | Directory traversal vulnerability in Pegasi Web Server (PWS) 0.2.2 allows remote attackers to read files outside of the web root via a .. (dot dot) di… | Patch early | 5.0 medium | 3.8% | 2004-12-31 |
| CVE-2015-4064 EXP | SQL injection vulnerability in modules/module.ab-testing.php in the Landing Pages plugin before 1.8.5 for WordPress allows remote authenticated users… | Patch early | 6.5 medium | 3.8% | 2015-05-27 |
| CVE-2007-4482 EXP | Cross-site scripting (XSS) vulnerability in index.php in the Pool 1.0.7 theme for WordPress allows remote attackers to inject arbitrary web script or… | Patch early | 4.3 medium | 3.8% | 2007-08-22 |
| CVE-2007-4032 EXP | Buffer overflow in CrystalPlayer Pro 1.98 allows user-assisted remote attackers to execute arbitrary code via a long string in a .mls Playlist file. | Patch early | 6.8 medium | 3.8% | 2007-07-27 |
| CVE-2006-2141 EXP | Cross-site scripting (XSS) vulnerability in popup_image in Collaborative Portal Server (CPS) 3.4.0 and earlier allows remote attackers to inject arbit… | Patch early | 4.3 medium | 3.8% | 2006-05-02 |
| CVE-2006-2892 EXP | Cross-site scripting (XSS) vulnerability in index.php in GANTTy 1.0.3 allows remote attackers to inject arbitrary HTML and web script via the message… | Patch early | 4.3 medium | 3.8% | 2006-06-07 |
| CVE-2010-1131 EXP | JavaScriptCore.dll, as used in Apple Safari 4.0.5 on Windows XP SP3, allows remote attackers to cause a denial of service (application crash) via an H… | Patch early | 4.3 medium | 3.8% | 2010-03-27 |
| CVE-2010-0475 EXP | Cross-site scripting (XSS) vulnerability in esp/editUser.esp in the Palo Alto Networks firewall 3.0.x before 3.0.9 and 3.1.x before 3.1.1 allows remot… | Patch early | 4.3 medium | 3.8% | 2010-05-14 |
| CVE-2004-1395 EXP | The Lithtech engine, as used in (1) Contract Jack 1.1 and earlier, (2) No one lives forever 2 1.3 and earlier, (3) Tron 2.0 1.042 and earlier, (4) F.E… | Patch early | 5.0 medium | 3.8% | 2004-12-31 |
| CVE-2004-1887 EXP | Ada Image Server (ImgSvr) 0.4 allows remote attackers to view directories or download files via an HTTP request with a trailing %00 (null). | Patch early | 5.0 medium | 3.8% | 2004-12-31 |
| CVE-2007-5290 EXP | Multiple cross-site scripting (XSS) vulnerabilities in MailBee WebMail Pro 3.4 and earlier; and possibly MailBee WebMail Pro ASP before 3.4.64, WebMai… | Patch early | 4.3 medium | 3.8% | 2007-10-09 |
| CVE-2005-0438 EXP | awstats.pl in AWStats 6.3 and 6.4 allows remote attackers to obtain sensitive information by setting the debug parameter. | Patch early | 5.0 medium | 3.8% | 2005-05-02 |
| CVE-2015-4425 EXP | Directory traversal vulnerability in pimcore before build 3473 allows remote authenticated users with the "assets" permission to create or write to ar… | Patch early | 4.9 medium | 3.8% | 2015-08-18 |
| CVE-2004-2366 EXP | Buffer overflow in GlobalSCAPE Secure FTP Server 2.0 B03.11.2004.2 allows remote attackers to cause a denial of service (crash) via a SITE command wit… | Patch early | 5.0 medium | 3.8% | 2004-12-31 |
| CVE-2012-4344 EXP | Cross-site scripting (XSS) vulnerability in Ipswitch WhatsUp Gold 15.02 allows remote attackers to inject arbitrary web script or HTML via unspecified… | Patch early | 4.3 medium | 3.8% | 2012-08-15 |
| CVE-2008-4671 EXP | Cross-site scripting (XSS) vulnerability in wp-admin/wp-blogs.php in Wordpress MU (WPMU) before 2.6 allows remote attackers to inject arbitrary web sc… | Patch early | 4.3 medium | 3.8% | 2008-10-22 |
| CVE-2003-0624 EXP | Cross-site scripting (XSS) vulnerability in InteractiveQuery.jsp for BEA WebLogic 8.1 and earlier allows remote attackers to inject malicious web scri… | Patch early | 4.3 medium | 3.8% | 2003-12-01 |
| CVE-2015-0060 EXP | The font mapper in win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1,… | Patch early | 4.7 medium | 3.8% | 2015-02-11 |
| CVE-2006-2635 EXP | Multiple cross-site scripting (XSS) vulnerabilities in Tikiwiki (aka Tiki CMS/Groupware) 1.9.x allow remote attackers to inject arbitrary web script o… | Patch early | 4.3 medium | 3.8% | 2006-05-30 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt