CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
401,317 CVEs
1,734 on KEV
17,292 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-05
10,149 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2008-6930 EXP | Unrestricted file upload vulnerability in PHPStore Real Estate allows remote authenticated users to execute arbitrary code by uploading a file with an… | Patch early | 6.5 medium | 3.4% | 2009-08-11 |
| CVE-2008-6931 EXP | Unrestricted file upload vulnerability in PHPStore Job Search (aka PHPCareers) allows remote authenticated users to execute arbitrary code by uploadin… | Patch early | 6.5 medium | 3.4% | 2009-08-11 |
| CVE-2008-7076 EXP | Unrestricted file upload vulnerability in user.modify.profile.php in Kalptaru Infotech Ltd. Star Articles 6.0 allows remote authenticated users to exe… | Patch early | 6.5 medium | 3.4% | 2009-08-25 |
| CVE-2002-1566 EXP | netris 0.5, and possibly other versions before 0.52, when running with the -w (wait) option, allows remote attackers to cause a denial of service (cra… | Patch early | 5.0 medium | 3.4% | 2003-08-27 |
| CVE-2009-2917 EXP | Stack-based buffer overflow in ImTOO MPEG Encoder 3.1.53 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary co… | Patch early | 4.3 medium | 3.4% | 2009-08-21 |
| CVE-2008-3148 EXP | Stack-based buffer overflow in (1) OllyDBG 1.10 and (2) ImpREC 1.7f allows user-assisted attackers to execute arbitrary code via a crafted DLL file th… | Patch early | 6.8 medium | 3.4% | 2008-07-11 |
| CVE-2007-0843 EXP | The ReadDirectoryChangesW API function on Microsoft Windows 2000, XP, Server 2003, and Vista does not check permissions for child objects, which allow… | Patch early | 4.6 medium | 3.4% | 2007-02-23 |
| CVE-2007-5625 EXP | Cross-site scripting (XSS) vulnerability in filename.asp in ASP Site Search SearchSimon Lite 1.0 allows remote attackers to inject arbitrary web scrip… | Patch early | 4.3 medium | 3.4% | 2007-10-23 |
| CVE-2010-4930 EXP | Cross-site scripting (XSS) vulnerability in index.php in @mail Webmail before 6.2.0 allows remote attackers to inject arbitrary web script or HTML via… | Patch early | 4.3 medium | 3.4% | 2011-10-09 |
| CVE-2005-2141 EXP | TCP Chat 1.0 allows remote attackers to cause a denial of service (crash) via a long string to the chat service, possibly triggering a buffer overflow… | Patch early | 5.0 medium | 3.4% | 2005-07-05 |
| CVE-2007-4375 EXP | The administrative interface (aka DkService.exe) in Diskeeper 9 Professional, 2007 Pro Premier, and probably other versions exposes a memory compariso… | Patch early | 5.8 medium | 3.4% | 2007-08-16 |
| CVE-2006-2767 EXP | PHP remote file inclusion vulnerability in Ottoman 1.1.2, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via… | Patch early | 5.1 medium | 3.4% | 2006-06-02 |
| CVE-2002-1101 EXP | Cisco VPN 3000 Concentrator 2.2.x, 3.6(Rel), and 3.x before 3.5.5, allows remote attackers to cause a denial of service via a long user name. | Patch early | 5.0 medium | 3.4% | 2002-10-04 |
| CVE-2003-1342 EXP | Trend Micro Virus Control System (TVCS) 1.8 running with IIS allows remote attackers to cause a denial of service (memory consumption) in IIS via mult… | Patch early | 5.0 medium | 3.4% | 2003-12-31 |
| CVE-2008-2859 EXP | Unspecified vulnerability in the IMAP service in NetWin SurgeMail before 3.9g2 allows remote attackers to cause a denial of service (daemon crash) via… | Patch early | 5.0 medium | 3.4% | 2008-06-25 |
| CVE-2019-20204 EXP | The Postie plugin 1.9.40 for WordPress allows XSS, as demonstrated by a certain payload with jaVasCript:/* at the beginning and a crafted SVG element. | Patch early | 5.4 medium | 3.4% | 2020-01-02 |
| CVE-2004-1539 EXP | Halo: Combat Evolved 1.05 and earlier allows remote game servers to cause a denial of service (client crash) via a long value in a game server reply,… | Patch early | 5.0 medium | 3.4% | 2004-12-31 |
| CVE-2008-6612 EXP | Unrestricted file upload vulnerability in admin/uploader.php in Minimal ABlog 0.4 allows remote attackers to execute arbitrary code by uploading a fil… | Patch early | 6.8 medium | 3.4% | 2009-04-06 |
| CVE-2009-4817 EXP | Unrestricted file upload vulnerability in Element-IT Ultimate Uploader 1.3 allows remote attackers to execute arbitrary code by uploading a file with… | Patch early | 6.8 medium | 3.4% | 2010-04-27 |
| CVE-2010-0279 EXP | Unrestricted file upload vulnerability in upload.php in BTS-GI Read excel 1.1 allows remote attackers to execute arbitrary code by uploading a file wi… | Patch early | 6.8 medium | 3.4% | 2010-01-13 |
| CVE-2010-2144 EXP | Cross-site scripting (XSS) vulnerability in signinform.php in Zeeways eBay Clone Auction Script allows remote attackers to inject arbitrary web script… | Patch early | 4.3 medium | 3.4% | 2010-06-03 |
| CVE-2006-6855 EXP | AIDeX Mini-WebServer 1.1 early release 3 allows remote attackers to cause a denial of service (daemon crash) via a flood of HTTP GET requests, possibl… | Patch early | 5.0 medium | 3.4% | 2006-12-31 |
| CVE-2018-10110 EXP | D-Link DIR-615 T1 devices allow XSS via the Add User feature. | Patch early | 4.8 medium | 3.4% | 2018-04-18 |
| CVE-2015-3986 EXP | Cross-site request forgery (CSRF) vulnerability in the TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin) plugin f… | Patch early | 4.3 medium | 3.4% | 2015-05-14 |
| CVE-2008-6590 EXP | Multiple directory traversal vulnerabilities in LightNEasy "no database" (aka flat) version 1.2.2, and possibly SQLite version 1.2.2, allow remote att… | Patch early | 5.0 medium | 3.4% | 2009-04-03 |
| CVE-2009-4699 EXP | Multiple cross-site scripting (XSS) vulnerabilities in SkaDate Dating allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO… | Patch early | 4.3 medium | 3.4% | 2010-03-15 |
| CVE-2006-2405 EXP | Directory traversal vulnerability in unb_lib/abbc.conf.php in Unclassified NewsBoard (UNB) 1.6.1 patch 1 and earlier, when register_globals is enabled… | Patch early | 6.8 medium | 3.4% | 2006-05-16 |
| CVE-1999-0470 EXP | A weak encryption algorithm is used for passwords in Novell Remote.NLM, allowing them to be easily decrypted. | Patch early | 5.0 medium | 3.4% | 1999-04-09 |
| CVE-2003-1456 EXP | Album.pl 6.1 allows remote attackers to execute arbitrary commands, when an alternative configuration file is used, via unknown attack vectors. | Patch early | 5.0 medium | 3.4% | 2003-12-31 |
| CVE-2005-4194 EXP | Buffer overflow in MediaServerList.exe in Sights 'n Sounds Streaming Media Server 2.0.3.a allows remote attackers to cause a denial of service (applic… | Patch early | 5.0 medium | 3.4% | 2005-12-13 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt