CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
401,178 CVEs
1,734 on KEV
17,292 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-05
10,149 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2016-3411 EXP | Cross-site scripting (XSS) vulnerability in Zimbra Collaboration before 8.7.0 allows remote attackers to inject arbitrary web script or HTML via unspe… | Patch early | 6.1 medium | 3.7% | 2017-01-18 |
| CVE-2003-1278 EXP | Cross-site scripting vulnerability (XSS) in OpenTopic 2.3.1 allows remote attackers to execute arbitrary script as other users and possibly steal auth… | Patch early | 4.3 medium | 3.7% | 2003-12-31 |
| CVE-2000-0922 EXP | Directory traversal vulnerability in Bytes Interactive Web Shopper shopping cart program (shopper.cgi) 2.0 and earlier allows remote attackers to read… | Patch early | 5.0 medium | 3.7% | 2000-12-19 |
| CVE-2006-5125 EXP | Directory traversal vulnerability in window.php, possibly used by home.php, in Joshua Muheim phpMyWebmin 1.0 allows remote attackers to obtain sensiti… | Patch early | 5.0 medium | 3.7% | 2006-10-03 |
| CVE-2012-6007 EXP | Cross-site scripting (XSS) vulnerability in screens/base/web_auth_custom.html on Cisco Wireless LAN Controller (WLC) devices with software 7.2.110.0 a… | Patch early | 4.3 medium | 3.7% | 2012-12-19 |
| CVE-2006-5244 EXP | Multiple PHP remote file inclusion vulnerabilities in OpenDock Easy Blog 1.4 and earlier, when register_globals is enabled, allow remote attackers to… | Patch early | 5.1 medium | 3.7% | 2006-10-12 |
| CVE-2017-0058 EXP | A Win32k information disclosure vulnerability exists in Microsoft Windows when the win32k component improperly provides kernel information. An attacke… | Patch early | 4.7 medium | 3.7% | 2017-04-12 |
| CVE-2013-6976 EXP | Cross-site request forgery (CSRF) vulnerability in goform/Quick_setup on Cisco EPC3925 devices allows remote attackers to hijack the authentication of… | Patch early | 6.8 medium | 3.7% | 2013-12-19 |
| CVE-2012-6041 EXP | Double free vulnerability in GreenBrowser before 6.0.1002, when the keyword search bar (F6) is activated, allows remote attackers to execute arbitrary… | Patch early | 6.8 medium | 3.7% | 2012-11-26 |
| CVE-2005-1613 EXP | Cross-site scripting (XSS) vulnerability in member.php in Open Bulletin Board (OpenBB) 1.0.8 allows remote attackers to inject arbitrary web script or… | Patch early | 6.8 medium | 3.7% | 2005-05-16 |
| CVE-2005-1614 EXP | Cross-site scripting (XSS) vulnerability in viewforum.php in Ultimate PHP Board (UPB) 1.8 through 1.9.6 allows remote attackers to inject arbitrary we… | Patch early | 6.8 medium | 3.7% | 2005-05-16 |
| CVE-2005-3411 EXP | Cross-site scripting (XSS) vulnerability in post.asp in Snitz Forums 2000 3.4.05 allows remote attackers to inject arbitrary web script or HTML via th… | Patch early | 4.3 medium | 3.7% | 2005-11-01 |
| CVE-2014-0870 EXP | Multiple cross-site scripting (XSS) vulnerabilities in RICOS in IBM Algo Credit Limits (aka ACLM) 4.5.0 through 4.7.0 before 4.7.0.03 FP5 in IBM Algor… | Patch early | 4.3 medium | 3.7% | 2014-07-07 |
| CVE-1999-1488 EXP | sdrd daemon in IBM SP2 System Data Repository (SDR) allows remote attackers to read files without authentication. | Patch early | 5.0 medium | 3.7% | 1999-12-31 |
| CVE-2007-5018 EXP | Stack-based buffer overflow in IMAPD in Mercury/32 4.52 allows remote authenticated users to execute arbitrary code via a long argument in a SEARCH ON… | Patch early | 6.0 medium | 3.6% | 2007-09-20 |
| CVE-2024-0723 EXP | A vulnerability was found in freeSSHd 1.0.9 on Windows. It has been classified as problematic. This affects an unknown part. The manipulation leads to… | Patch early | 5.3 medium | 3.6% | 2024-01-19 |
| CVE-2024-0725 EXP | A vulnerability was found in ProSSHD 1.2 on Windows. It has been declared as problematic. This vulnerability affects unknown code. The manipulation le… | Patch early | 5.3 medium | 3.6% | 2024-01-19 |
| CVE-2018-18308 EXP | In the 4.2.23 version of BigTree, a Stored XSS vulnerability has been discovered in /admin/ajax/file-browser/upload/ (aka the image upload area). | Patch early | 6.1 medium | 3.6% | 2018-10-16 |
| CVE-2005-3981 EXP | NOTE: this issue has been disputed by third parties. Microsoft Windows XP, 2000, and 2003 allows local users to kill a writable process by using the… | Patch early | 4.9 medium | 3.6% | 2005-12-04 |
| CVE-2019-15999 EXP | A vulnerability in the application environment of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker to gain unaut… | Patch early | 6.3 medium | 3.6% | 2020-01-06 |
| CVE-2004-1645 EXP | Cross-site scripting (XSS) vulnerability in Xedus 1.0 allows remote attackers to execute arbitrary web script or HTML via the (1) username parameter t… | Patch early | 4.3 medium | 3.6% | 2004-08-30 |
| CVE-2005-1823 EXP | Multiple cross-site scripting (XSS) vulnerabilities in Qualiteam X-Cart 4.0.8 allow remote attackers to inject arbitrary web script or HTML via the (1… | Patch early | 4.3 medium | 3.6% | 2005-06-01 |
| CVE-2005-3131 EXP | Multiple cross-site scripting (XSS) vulnerabilities in MERAK Mail Server 8.2.4r with Icewarp Web Mail 5.5.1, and possibly earlier versions, allow remo… | Patch early | 4.3 medium | 3.6% | 2005-10-04 |
| CVE-2015-6809 EXP | Multiple cross-site scripting (XSS) vulnerabilities in BEdita before 3.6.0 allow remote attackers to inject arbitrary web script or HTML via the (1) c… | Patch early | 4.3 medium | 3.6% | 2015-09-04 |
| CVE-2011-3390 EXP | Multiple cross-site scripting (XSS) vulnerabilities in index.php in IBM OpenAdmin Tool (OAT) before 2.72 for Informix allow remote attackers to inject… | Patch early | 4.3 medium | 3.6% | 2011-09-06 |
| CVE-2000-0912 EXP | MultiHTML CGI script allows remote attackers to read arbitrary files and possibly execute arbitrary commands by specifying the file name to the "multi… | Patch early | 5.0 medium | 3.6% | 2000-12-19 |
| CVE-2002-0115 EXP | Snort 1.8.3 does not properly define the minimum ICMP header size, which allows remote attackers to cause a denial of service (crash and core dump) vi… | Patch early | 5.0 medium | 3.6% | 2002-03-25 |
| CVE-2005-3556 EXP | Multiple cross-site scripting (XSS) vulnerabilities in PHPlist 2.10.1 and earlier allow remote attackers to inject arbitrary web script or HTML via th… | Patch early | 4.3 medium | 3.6% | 2005-11-16 |
| CVE-2009-4563 EXP | Cross-site request forgery (CSRF) vulnerability in zp-core/admin-options.php in Zenphoto 1.2.5 allows remote attackers to hijack the authentication of… | Patch early | 4.3 medium | 3.6% | 2010-01-04 |
| CVE-2018-9844 EXP | The Iptanus WordPress File Upload plugin before 4.3.4 for WordPress mishandles Settings attributes, leading to XSS. | Patch early | 6.1 medium | 3.6% | 2018-04-07 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt