CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
402,593 CVEs
1,734 on KEV
17,294 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-07
10,149 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2008-1799 EXP | Directory traversal vulnerability in thumbnails.php in sabros.us 1.75 allows remote attackers to read arbitrary files via a .. (dot dot) in the img pa… | Patch early | 5.0 medium | 2.7% | 2008-04-15 |
| CVE-2008-1849 EXP | Directory traversal vulnerability in index.php in the joomlaXplorer (com_joomlaxplorer) Mambo/Joomla! component 1.6.2 and earlier allows remote attack… | Patch early | 5.0 medium | 2.7% | 2008-04-16 |
| CVE-2008-2342 EXP | Directory traversal vulnerability in attachments.php in News Manager 2.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the id… | Patch early | 5.0 medium | 2.7% | 2008-05-19 |
| CVE-2008-2838 EXP | Directory traversal vulnerability in index.php in Traindepot 0.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the module para… | Patch early | 5.0 medium | 2.7% | 2008-06-24 |
| CVE-2008-2961 EXP | Multiple directory traversal vulnerabilities in view/index.php in CMS Mini 0.2.2 allow remote attackers to read arbitrary local files via a .. (dot do… | Patch early | 5.0 medium | 2.7% | 2008-07-02 |
| CVE-2008-4707 EXP | Directory traversal vulnerability in index.php in BbZL.PhP 0.92 allows remote attackers to access unauthorized directories via a .. (dot dot) in the l… | Patch early | 5.0 medium | 2.7% | 2008-10-23 |
| CVE-2008-4773 EXP | Directory traversal vulnerability in main/main.php in QuestCMS allows remote attackers to read arbitrary local files via a .. (dot dot) in the theme p… | Patch early | 5.0 medium | 2.7% | 2008-10-28 |
| CVE-2008-6010 EXP | Multiple directory traversal vulnerabilities in SG Real Estate Portal 2.0 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1)… | Patch early | 5.0 medium | 2.7% | 2009-01-30 |
| CVE-2008-6139 EXP | Directory traversal vulnerability in faqsupport/wce.download.php in WebBiscuits Modules Controller 1.1 allows remote attackers to read arbitrary files… | Patch early | 5.0 medium | 2.7% | 2009-02-14 |
| CVE-2008-6933 EXP | Directory traversal vulnerability in index.php in MiniGal b13 (aka MG2) allows remote attackers to read the source code of .php files, and possibly th… | Patch early | 5.0 medium | 2.7% | 2009-08-11 |
| CVE-2019-14804 EXP | studio/polyglot.php?page=etemplates in UNA 10.0.0-RC1 allows XSS via the System Name field under Emails during template editing. | Patch early | 4.8 medium | 2.7% | 2019-08-09 |
| CVE-2020-10596 EXP | OpenCart 3.0.3.2 allows remote authenticated users to conduct XSS attacks via a crafted filename in the users' image upload section. | Patch early | 5.4 medium | 2.7% | 2020-03-17 |
| CVE-2006-4418 EXP | Directory traversal vulnerability in index.php for Wikepage 2006.2a Opus 10 allows remote attackers to include arbitrary local files via the lng param… | Patch early | 4.0 medium | 2.7% | 2006-08-28 |
| CVE-2008-3607 EXP | The IMAP server in NoticeWare Email Server NG 4.6.3 and earlier allows remote attackers to cause a denial of service (daemon crash) via multiple long… | Patch early | 5.0 medium | 2.7% | 2008-08-12 |
| CVE-2006-6755 EXP | Ixprim 1.2 allows remote attackers to obtain sensitive information via a direct request for kernel/plugins/fckeditor2/ixprim_api.php, which reveals th… | Patch early | 5.0 medium | 2.7% | 2006-12-27 |
| CVE-2006-0496 EXP | Cross-site scripting (XSS) vulnerability in Mozilla 1.7.12 and possibly earlier, Mozilla Firefox 1.0.7 and possibly earlier, and Netscape 8.1 and poss… | Patch early | 4.3 medium | 2.7% | 2006-02-01 |
| CVE-2006-1508 EXP | Multiple cross-site scripting (XSS) vulnerabilities in MH Software Connect Daily Web Calendar Software 3.2.9 and earlier allow remote attackers to inj… | Patch early | 4.3 medium | 2.7% | 2006-03-30 |
| CVE-2004-2447 EXP | Cross-site scripting (XSS) vulnerability in 1st Class Mail Server 4.01 allows remote attackers to inject arbitrary web script or HTML via the Mailbox… | Patch early | 4.3 medium | 2.7% | 2004-12-31 |
| CVE-2007-4641 EXP | Directory traversal vulnerability in index.php in Pakupaku CMS 0.4 and earlier allows remote attackers to include and execute arbitrary local files vi… | Patch early | 6.4 medium | 2.7% | 2007-08-31 |
| CVE-2007-6271 EXP | Absolute News Manager.NET 5.1 allows remote attackers to obtain sensitive information via a direct request to getpath.aspx, which reveals the installa… | Patch early | 5.0 medium | 2.7% | 2007-12-07 |
| CVE-2022-4944 EXP | A vulnerability, which was classified as problematic, has been found in kalcaddle KodExplorer up to 4.49. Affected by this issue is some unknown funct… | Patch early | 4.3 medium | 2.7% | 2023-04-22 |
| CVE-2003-1480 EXP | MySQL 3.20 through 4.1.0 uses a weak algorithm for hashed passwords, which makes it easier for attackers to decrypt the password via brute force metho… | Patch early | 4.3 medium | 2.7% | 2003-12-31 |
| CVE-2007-6488 EXP | Multiple PHP remote file inclusion vulnerabilities in Falcon Series One CMS 1.4.3 allow remote attackers to execute arbitrary PHP code via a URL in (1… | Patch early | 6.8 medium | 2.7% | 2007-12-20 |
| CVE-2002-2403 EXP | Directory traversal vulnerability in KeyFocus web server 1.0.8 allows remote attackers to read arbitrary files for recognized MIME type files via "...… | Patch early | 5.0 medium | 2.7% | 2002-12-31 |
| CVE-2008-5579 EXP | Absolute path traversal vulnerability in mini-pub.php/front-end/cat.php in mini-pub 0.3 allows remote attackers to read arbitrary files via a full pat… | Patch early | 5.0 medium | 2.7% | 2008-12-15 |
| CVE-2006-4448 EXP | Multiple PHP remote file inclusion vulnerabilities in interact 2.2, when register_globals is enabled, allow remote attackers to execute arbitrary PHP… | Patch early | 5.1 medium | 2.7% | 2006-08-30 |
| CVE-2011-5025 EXP | Multiple cross-site scripting (XSS) vulnerabilities in the wiki application in Yaws 1.88 allow remote attackers to inject arbitrary web script or HTML… | Patch early | 4.3 medium | 2.7% | 2011-12-29 |
| CVE-2007-3492 EXP | Conti FtpServer 1.0 allows remote authenticated users to cause a denial of service (daemon crash) via a certain string containing "//A:" in the argume… | Patch early | 6.8 medium | 2.7% | 2007-06-29 |
| CVE-2002-2335 EXP | Killer Protection 1.0 stores the vars.inc include file under the web root with insufficient access control, which allows remote attackers to obtain us… | Patch early | 5.0 medium | 2.7% | 2002-12-31 |
| CVE-2005-1008 EXP | Cross-site scripting (XSS) vulnerability in posts.asp for ASP-DEv XM Forum RC3 allows remote attackers to inject arbitrary web script or HTML via a "j… | Patch early | 4.3 medium | 2.7% | 2005-05-02 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt