CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
401,267 CVEs
1,734 on KEV
17,292 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-05
10,149 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2006-2280 EXP | Directory traversal vulnerability in website.php in openEngine 1.8 Beta 2 and earlier allows remote attackers to list arbitrary directories and read a… | Patch early | 5.0 medium | 3.5% | 2006-05-10 |
| CVE-2007-3139 EXP | config/general.php in Quick.Cart 2.2 and earlier uses a default username and password, which allows remote attackers to access the application via a l… | Patch early | 6.8 medium | 3.5% | 2007-06-08 |
| CVE-2009-1447 EXP | Unrestricted file upload vulnerability in admin/editor/image.php in e-cart.biz Free Shopping Cart allows remote attackers to execute arbitrary code by… | Patch early | 6.8 medium | 3.5% | 2009-04-27 |
| CVE-2004-2170 EXP | Directory traversal vulnerability in sample_showcode.html in Caravan 2.00/03d and earlier allows remote attackers to read arbitrary files via the fnam… | Patch early | 5.0 medium | 3.5% | 2004-12-31 |
| CVE-2004-2464 EXP | Directory traversal vulnerability in ADA Image Server (ImgSvr) 0.4 allows remote attackers to read arbitrary files or list directories via hex-encoded… | Patch early | 5.0 medium | 3.5% | 2004-12-31 |
| CVE-1999-1084 EXP | The "AEDebug" registry key is installed with insecure permissions, which allows local users to modify the key to specify a Trojan Horse debugger which… | Patch early | 4.6 medium | 3.5% | 1999-12-31 |
| CVE-2010-4747 EXP | Cross-site scripting (XSS) vulnerability in wordpress-processing-embed/data/popup.php in the Processing Embed plugin 0.5 for WordPress allows remote a… | Patch early | 4.3 medium | 3.5% | 2011-03-01 |
| CVE-2006-6779 EXP | Cross-site scripting (XSS) vulnerability in Jelsoft vBulletin allows remote attackers to inject arbitrary web script or HTML via an SWF file that uses… | Patch early | 6.8 medium | 3.5% | 2006-12-28 |
| CVE-2011-3860 EXP | Cross-site scripting (XSS) vulnerability in the Cover WP theme before 1.6.6 for WordPress allows remote attackers to inject arbitrary web script or HT… | Patch early | 4.3 medium | 3.5% | 2011-09-28 |
| CVE-2008-6750 EXP | Unrestricted file upload vulnerability in add.php in FlexPHPDirectory 0.0.1 allows remote attackers to execute arbitrary code by uploading a file with… | Patch early | 6.8 medium | 3.5% | 2009-04-24 |
| CVE-2009-2238 EXP | Unrestricted file upload vulnerability in includes/shared_scripts/wysiwyg_editor/assetmanager/assetmanager.asp in DMXReady Registration Manager 1.1 al… | Patch early | 6.8 medium | 3.5% | 2009-06-27 |
| CVE-2006-1151 EXP | Cross-site scripting vulnerability in index.php in M-Phorum 0.2 allows remote attackers to inject arbitrary web script or HTML via the go parameter. | Patch early | 5.0 medium | 3.5% | 2006-03-10 |
| CVE-2022-1163 EXP | Cross-site Scripting (XSS) - Stored in GitHub repository mineweb/minewebcms prior to next. | Patch early | 4.8 medium | 3.5% | 2022-03-30 |
| CVE-2005-1164 EXP | Yager 5.24 and earlier allows remote attackers to cause a denial of service (application hang) via a packet with a game header that provides less data… | Patch early | 5.0 medium | 3.5% | 2005-05-02 |
| CVE-2005-1741 EXP | Gearbox Software Halo: Combat Evolved 1.6 allows remote attackers to cause a denial of service (infinite loop) via malformed data. | Patch early | 5.0 medium | 3.5% | 2005-05-24 |
| CVE-2005-3492 EXP | FlatFrag 0.3 and earlier allows remote attackers to cause a denial of service (crash) by sending an NT_CONN_OK command from a client that is not conne… | Patch early | 5.0 medium | 3.5% | 2005-11-04 |
| CVE-2017-11356 EXP | The application distribution export functionality in PEGA Platform 7.2 ML0 and earlier allows remote authenticated users with certain privileges to ob… | Patch early | 6.5 medium | 3.5% | 2017-08-02 |
| CVE-2013-7054 EXP | D-Link DIR-100 4.03B07: cli.cgi XSS | Patch early | 6.1 medium | 3.5% | 2020-02-04 |
| CVE-2005-2176 EXP | Novell NetMail automatically processes HTML in an attachment without prompting the user to save or open it, which makes it easier for remote attackers… | Patch early | 6.4 medium | 3.5% | 2005-07-09 |
| CVE-2009-5087 EXP | Directory traversal vulnerability in geohttpserver in Geovision Digital Video Surveillance System 8.2 allows remote attackers to read arbitrary files… | Patch early | 5.0 medium | 3.5% | 2011-09-12 |
| CVE-2001-1184 EXP | wrshdsp.exe in Denicomp Winsock RSHD/NT 2.21.00 and earlier allows remote attackers to cause a denial of service (CPU consumption) via (1) in 2.20.00… | Patch early | 5.0 medium | 3.5% | 2001-12-08 |
| CVE-2006-2226 EXP | Buffer overflow in XM Easy Personal FTP Server 4.2 and 5.0.1 allows remote authenticated users to cause a denial of service via a long argument to the… | Patch early | 5.0 medium | 3.5% | 2006-05-05 |
| CVE-2014-8653 EXP | Cross-site scripting (XSS) vulnerability in Compal Broadband Networks (CBN) CH6640E and CG6640E Wireless Gateway 1.0 with firmware CH6640-3.5.11.7-NOS… | Patch early | 4.3 medium | 3.5% | 2014-11-06 |
| CVE-2014-9522 EXP | Multiple cross-site scripting (XSS) vulnerabilities in CMS Papoo Light 6.0.0 (Rev 4701) allow remote attackers to inject arbitrary web script or HTML… | Patch early | 4.3 medium | 3.5% | 2015-01-05 |
| CVE-2019-6263 EXP | An issue was discovered in Joomla! before 3.9.2. Inadequate checks of the Global Configuration Text Filter settings allowed stored XSS. | Patch early | 4.8 medium | 3.5% | 2019-01-16 |
| CVE-2003-0400 EXP | Vignette StoryServer and Vignette V/5 does not properly calculate the size of text variables, which causes Vignette to return unauthorized portions of… | Patch early | 5.0 medium | 3.5% | 2003-06-30 |
| CVE-2015-7902 EXP | Infinite Automation Mango Automation 2.5.x and 2.6.x before 2.6.0 build 430 provides different error messages for failed login attempts in unspecified… | Patch early | 5.0 medium | 3.5% | 2015-10-28 |
| CVE-2002-0918 EXP | CGIScript.net csPassword.cgi leaks sensitive information such as the pathname of the server in debug messages that are presented when the script fails… | Patch early | 5.0 medium | 3.5% | 2002-10-04 |
| CVE-2007-3333 EXP | Stack-based buffer overflow in capture in IBM AIX 5.3 SP6 and 5.2.0 allows remote attackers to execute arbitrary code via a large number of terminal c… | Patch early | 6.9 medium | 3.5% | 2007-07-26 |
| CVE-2006-6651 EXP | Race condition in W29N51.SYS in the Intel 2200BG wireless driver 9.0.3.9 allows remote attackers to cause memory corruption and execute arbitrary code… | Patch early | 6.8 medium | 3.5% | 2006-12-20 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt