CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
402,999 CVEs
1,734 on KEV
17,293 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-08
10,149 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2007-6597 EXP | Multiple cross-site scripting (XSS) vulnerabilities in IPortalX before Build 033 allow remote attackers to inject arbitrary web script or HTML via the… | Patch early | 4.3 medium | 2.2% | 2007-12-31 |
| CVE-2017-8918 EXP | XXE in Dive Assistant - Template Builder in Blackwave Dive Assistant - Desktop Edition 8.0 allows attackers to remotely view local files via a crafted… | Patch early | 5.5 medium | 2.2% | 2017-09-12 |
| CVE-2013-1509 EXP | Unspecified vulnerability in the Oracle WebCenter Sites component in Oracle Fusion Middleware 7.6.2, 11.1.1.6.0, and 11.1.1.6.1 allows remote authenti… | Patch early | 4.0 medium | 2.2% | 2013-04-17 |
| CVE-2008-0814 EXP | Directory traversal vulnerability in download.php in Tracking Requirements & Use Cases (TRUC) 0.11.0 allows remote attackers to read arbitrary files v… | Patch early | 6.4 medium | 2.2% | 2008-02-19 |
| CVE-2008-2889 EXP | Directory traversal vulnerability in the FTP client in AceBIT WISE-FTP 4.1.0 and 5.5.8 allows remote FTP servers to create or overwrite arbitrary file… | Patch early | 6.8 medium | 2.2% | 2008-06-27 |
| CVE-2004-2756 EXP | Cross-site scripting (XSS) vulnerability in viewtopic.php in Xoops 2.x, possibly 2 through 2.0.5, allows remote attackers to inject arbitrary web scri… | Patch early | 4.3 medium | 2.2% | 2004-12-31 |
| CVE-2005-3412 EXP | Cross-site scripting (XSS) vulnerability in Elite Forum 1.0.0.0 allows remote attackers to inject arbitrary web script or HTML via a Post Reply to a t… | Patch early | 4.3 medium | 2.2% | 2005-11-01 |
| CVE-2010-4347 EXP | The ACPI subsystem in the Linux kernel before 2.6.36.2 uses 0222 permissions for the debugfs custom_method file, which allows local users to gain priv… | Patch early | 6.9 medium | 2.2% | 2010-12-22 |
| CVE-2008-6336 EXP | Directory traversal vulnerability in download.php in Text Lines Rearrange Script 1.0, when register_globals is enabled, allows remote attackers to rea… | Patch early | 4.3 medium | 2.2% | 2009-02-27 |
| CVE-2006-1645 EXP | Cross-site scripting (XSS) vulnerability in Anton Vlasov and Rostislav Gaitkuloff ReloadCMS 1.2.5 and earlier allows remote attackers to inject arbitr… | Patch early | 6.8 medium | 2.2% | 2006-04-06 |
| CVE-2006-5219 EXP | SQL injection vulnerability in blog/index.php in the blog module in Moodle 1.6.2 allows remote attackers to execute arbitrary SQL commands via a doubl… | Patch early | 5.1 medium | 2.2% | 2006-10-10 |
| CVE-2014-7176 EXP | SQL injection vulnerability in Enalean Tuleap before 7.5.99.4 allows remote authenticated users to execute arbitrary SQL commands via the lobal_txt pa… | Patch early | 6.5 medium | 2.2% | 2014-11-04 |
| CVE-2006-3909 EXP | Cross-site scripting (XSS) vulnerability in calendar.php in WWWthreads allows remote attackers to inject arbitrary web script or HTML via the week par… | Patch early | 6.8 medium | 2.2% | 2006-07-27 |
| CVE-2006-4540 EXP | Cross-site scripting (XSS) vulnerability in learncenter.asp in Learn.com LearnCenter allows remote attackers to inject arbitrary web script or HTML vi… | Patch early | 6.8 medium | 2.2% | 2006-09-05 |
| CVE-2013-4881 EXP | Cross-site request forgery (CSRF) vulnerability in core/admin/modules/users/create.php in BigTree CMS 4.0 RC2 and earlier allows remote attackers to h… | Patch early | 6.8 medium | 2.2% | 2013-08-19 |
| CVE-2006-6929 EXP | Multiple cross-site scripting (XSS) vulnerabilities in Rapid Classified 3.1 allow remote attackers to inject arbitrary web script or HTML via the (1)… | Patch early | 6.8 medium | 2.2% | 2007-01-13 |
| CVE-2008-6736 EXP | Flat Calendar 1.1 does not properly restrict access to administrative functions, which allows remote attackers to (1) add new events via calAdd.php, a… | Patch early | 6.4 medium | 2.2% | 2009-04-21 |
| CVE-2008-6065 EXP | Oracle Database Server 10.1, 10.2, and 11g grants directory WRITE permissions for arbitrary pathnames that are aliased in a CREATE OR REPLACE DIRECTOR… | Patch early | 5.1 medium | 2.2% | 2009-02-05 |
| CVE-2006-5137 EXP | Multiple direct static code injection vulnerabilities in Groupee UBB.threads 6.5.1.1 allow remote attackers to (1) inject PHP code via a theme[] array… | Patch early | 5.1 medium | 2.2% | 2006-10-03 |
| CVE-2008-4146 EXP | Addalink 1.0 beta 4 and earlier allows remote attackers to (1) approve web-site additions via a modified approved field and (2) change the visit-count… | Patch early | 5.0 medium | 2.2% | 2008-09-24 |
| CVE-2010-3026 EXP | Cross-site request forgery (CSRF) vulnerability in application/modules/admin/controllers/users.php in Tomaz Muraus Open Blog 1.2.1, and possibly earli… | Patch early | 4.3 medium | 2.2% | 2010-08-16 |
| CVE-2006-4960 EXP | Cross-site scripting (XSS) vulnerability in index.php Php Blue Dragon 2.9.1 and earlier allows remote attackers to inject arbitrary web script or HTML… | Patch early | 6.8 medium | 2.2% | 2006-09-23 |
| CVE-2013-3083 EXP | Cross-site request forgery (CSRF) vulnerability in cgi-bin/system_setting.exe in Belkin F5D8236-4 v2 allows remote attackers to hijack the authenticat… | Patch early | 6.8 medium | 2.2% | 2014-09-29 |
| CVE-2024-55889 EXP | phpMyFAQ is an open source FAQ web application. Prior to version 3.2.10, a vulnerability exists in the FAQ Record component where a privileged attacke… | Patch early | 4.9 medium | 2.2% | 2024-12-13 |
| CVE-2006-0650 EXP | Cross-site scripting (XSS) vulnerability in cpaint2.inc.php in the CPAINT library before 2.0.3, as used in multiple scripts, allows remote attackers t… | Patch early | 4.3 medium | 2.2% | 2006-02-13 |
| CVE-2004-1655 EXP | Cross-site scripting (XSS) vulnerability in phpWebsite 0.9.3-4 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1)… | Patch early | 4.3 medium | 2.2% | 2004-09-01 |
| CVE-2004-2411 EXP | The CleanseMessage function in shop$db.asp for VP-ASP Shopping Cart 4.0 through 5.0 does not sufficiently cleanse inputs, which allows remote attacker… | Patch early | 4.3 medium | 2.2% | 2004-12-31 |
| CVE-2004-2618 EXP | Cross-site scripting (XSS) vulnerability in Pegasi Web Server (PWS) 0.2.2 allows remote attackers to inject arbitrary web script or HTML via the URI,… | Patch early | 4.3 medium | 2.2% | 2004-12-31 |
| CVE-2005-3902 EXP | Cross-site scripting (XSS) vulnerability in gui/errordocs/index.php in Virtual Hosting Control System (VHCS) 2.2.0 through 2.4.6.2 allows remote attac… | Patch early | 4.3 medium | 2.2% | 2005-11-29 |
| CVE-2007-6504 EXP | Unspecified vulnerability in IIS/iibind.asp in Hosting Controller 6.1 Hot fix 3.3 and earlier allows remote authenticated users to change the headers… | Patch early | 5.5 medium | 2.2% | 2007-12-20 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt