CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
401,133 CVEs
1,734 on KEV
17,292 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-05
10,149 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2005-3236 EXP | Multiple SQL injection vulnerabilities in Cyphor 0.19 allow remote attackers to execute arbitrary SQL and obtain administrative access via (1) the fid… | Patch early | 6.8 medium | 3.7% | 2005-10-14 |
| CVE-2007-0347 EXP | The is_eow function in format.c in CVSTrac before 2.0.1 does not properly check for the "'" (quote) character, which allows remote authenticated users… | Patch early | 4.3 medium | 3.7% | 2007-01-29 |
| CVE-2003-1369 EXP | Buffer overflow in ByteCatcher FTP client 1.04b allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a… | Patch early | 6.8 medium | 3.7% | 2003-12-31 |
| CVE-2011-4045 EXP | Buffer overflow in an unspecified ActiveX control in aipgctl.ocx in ARC Informatique PcVue 6.0 through 10.0, FrontVue, and PlantVue allows remote atta… | Patch early | 4.3 medium | 3.7% | 2012-04-03 |
| CVE-2002-2192 EXP | Cross-site scripting (XSS) vulnerability in Perception LiteServe 2.0.1 allows remote attackers to execute arbitrary web script via (1) a Host: header… | Patch early | 4.3 medium | 3.7% | 2002-12-31 |
| CVE-2020-14943 EXP | The Firstname and Lastname parameters in Global RADAR BSA Radar 1.6.7234.24750 and earlier are vulnerable to stored cross-site scripting (XSS) via Upd… | Patch early | 5.4 medium | 3.7% | 2020-06-22 |
| CVE-2007-3227 EXP | Cross-site scripting (XSS) vulnerability in the to_json (ActiveRecord::Base#to_json) function in Ruby on Rails before edge 9606 allows remote attacker… | Patch early | 4.3 medium | 3.7% | 2007-06-14 |
| CVE-2004-1380 EXP | Firefox before 1.0 and Mozilla before 1.7.5 allows inactive (background) tabs to launch dialog boxes, which can allow remote attackers to spoof the di… | Patch early | 5.0 medium | 3.7% | 2004-10-20 |
| CVE-1999-1170 EXP | IPswitch IMail allows local users to gain additional privileges and modify or add mail accounts by setting the "flags" registry key to 1920. | Patch early | 4.6 medium | 3.7% | 1999-01-02 |
| CVE-2018-14888 EXP | inc/plugins/thankyoulike.php in the Eldenroot Thank You/Like plugin before 3.1.0 for MyBB allows XSS via a post or thread subject. | Patch early | 6.1 medium | 3.7% | 2018-08-14 |
| CVE-2013-3739 EXP | Directory traversal vulnerability in editor.php in Network Weathermap 0.97c and earlier allows remote attackers to read arbitrary files via a .. (dot… | Patch early | 5.0 medium | 3.7% | 2014-06-05 |
| CVE-2019-16116 EXP | EnterpriseDT CompleteFTP Server prior to version 12.1.3 is vulnerable to information exposure in the Bootstrap.log file. This allows an attacker to ob… | Patch early | 4.3 medium | 3.7% | 2019-10-02 |
| CVE-2017-8708 EXP | The Windows kernel component on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT… | Patch early | 4.7 medium | 3.7% | 2017-09-13 |
| CVE-2007-6457 EXP | Stack-based buffer overflow in the webmail feature in SurgeMail 38k4 allows remote attackers to cause a denial of service (crash) via a long Host head… | Patch early | 5.0 medium | 3.7% | 2007-12-20 |
| CVE-2008-6997 EXP | Google Chrome 0.2.149.27 allows user-assisted remote attackers to cause a denial of service (browser crash) via an IMG tag with a long src attribute,… | Patch early | 4.3 medium | 3.7% | 2009-08-19 |
| CVE-2011-3862 EXP | Cross-site scripting (XSS) vulnerability in the Morning Coffee theme before 3.6 for WordPress allows remote attackers to inject arbitrary web script o… | Patch early | 4.3 medium | 3.7% | 2011-09-28 |
| CVE-2000-0648 EXP | WFTPD and WFTPD Pro 2.41 allows local users to cause a denial of service by executing the RENAME TO (RNTO) command before a RENAME FROM (RNFR) command… | Patch early | 5.0 medium | 3.7% | 2000-07-11 |
| CVE-2019-16173 EXP | LimeSurvey before v3.17.14 allows reflected XSS for escalating privileges from a low-privileged account to, for example, SuperAdmin. This occurs in ap… | Patch early | 5.4 medium | 3.7% | 2019-09-09 |
| CVE-2001-0574 EXP | Directory traversal vulnerability in MP3Mystic prior to 1.04b3 allows a remote attacker to download arbitrary files via a '..' (dot dot) in the URL. | Patch early | 5.0 medium | 3.7% | 2001-08-14 |
| CVE-2001-0615 EXP | Directory traversal vulnerability in Faust Informatics Freestyle Chat server prior to 4.1 SR3 allows a remote attacker to read arbitrary files via a s… | Patch early | 5.0 medium | 3.7% | 2001-08-14 |
| CVE-2001-0630 EXP | Directory traversal vulnerability in MIMAnet viewsrc.cgi 2.0 allows a remote attacker to read arbitrary files via a '..' (dot dot) attack in the 'loc'… | Patch early | 5.0 medium | 3.7% | 2001-08-22 |
| CVE-2001-0804 EXP | Directory traversal vulnerability in story.pl in Interactive Story 1.3 allows a remote attacker to read arbitrary files via a .. (dot dot) attack on t… | Patch early | 5.0 medium | 3.7% | 2001-12-06 |
| CVE-2000-1005 EXP | Directory traversal vulnerability in html_web_store.cgi and web_store.cgi CGI programs in eXtropia WebStore allows remote attackers to read arbitrary… | Patch early | 5.0 medium | 3.7% | 2000-12-11 |
| CVE-2018-14840 EXP | uploads/.htaccess in Subrion CMS 4.2.1 allows XSS because it does not block .html file uploads (but does block, for example, .htm file uploads). | Patch early | 6.1 medium | 3.7% | 2018-08-02 |
| CVE-2013-4241 EXP | Multiple cross-site scripting (XSS) vulnerabilities in the HMS Testimonials plugin before 2.0.11 for WordPress allow remote attackers to inject arbitr… | Patch early | 6.1 medium | 3.7% | 2020-01-30 |
| CVE-2017-9095 EXP | XXE in Diving Log 6.0 allows attackers to remotely view local files through a crafted dive.xml file that is mishandled during a Subsurface import. | Patch early | 5.5 medium | 3.7% | 2017-09-08 |
| CVE-2023-33580 EXP | Phpgurukul Student Study Center Management System V1.0 is vulnerable to Cross Site Scripting (XSS) in the "Admin Name" field on Admin Profile page. | Patch early | 4.8 medium | 3.7% | 2023-06-26 |
| CVE-2006-0976 EXP | Directory traversal vulnerability in scan_lang_insert.php in Boris Herbiniere-Seve SPiD 1.3.1 allows remote attackers to read arbitrary files via the… | Patch early | 5.0 medium | 3.7% | 2006-03-03 |
| CVE-2005-4245 EXP | Cross-site scripting (XSS) vulnerability in search.php in Snipe Gallery 3.1.4 and earlier allows remote attackers to inject arbitrary web script or HT… | Patch early | 4.3 medium | 3.7% | 2005-12-14 |
| CVE-2010-2627 EXP | Multiple directory traversal vulnerabilities in the Refractor 2 engine, as used in Battlefield 2 1.50 (1.5.3153-802.0) and earlier, and Battlefield 21… | Patch early | 6.8 medium | 3.7% | 2010-07-02 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt