CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
403,891 CVEs
1,739 on KEV
17,300 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-10
10,149 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2007-3991 EXP | Multiple cross-site scripting (XSS) vulnerabilities in cv.asp in Asp cvmatik 1.1 and earlier allow remote attackers to inject arbitrary web script or… | Patch early | 4.3 medium | 1.5% | 2007-07-25 |
| CVE-2009-3171 EXP | Multiple cross-site scripting (XSS) vulnerabilities in Anantasoft Gazelle CMS 1.0 and earlier allow remote attackers to inject arbitrary web script or… | Patch early | 4.3 medium | 1.5% | 2009-09-11 |
| CVE-2009-3368 EXP | Cross-site scripting (XSS) vulnerability in the Hotel Booking Reservation System (aka HBS or com_hbssearch) component for Joomla! allows remote attack… | Patch early | 4.3 medium | 1.5% | 2009-09-24 |
| CVE-2009-4478 EXP | Multiple cross-site scripting (XSS) vulnerabilities in Xstate Real Estate 1.0 allow remote attackers to inject arbitrary web script or HTML via the PA… | Patch early | 4.3 medium | 1.5% | 2009-12-30 |
| CVE-2009-4522 EXP | Cross-site scripting (XSS) vulnerability in search.5.html in BloofoxCMS 0.3.5 allows remote attackers to inject arbitrary web script or HTML via the s… | Patch early | 4.3 medium | 1.5% | 2009-12-31 |
| CVE-2009-4678 EXP | Cross-site scripting (XSS) vulnerability in index.php in Winn Guestbook 2.4 allows remote attackers to inject arbitrary web script or HTML via the PAT… | Patch early | 4.3 medium | 1.5% | 2010-03-08 |
| CVE-2009-2551 EXP | Multiple cross-site scripting (XSS) vulnerabilities in ScriptsEz Easy Image Downloader allow remote attackers to inject arbitrary web script or HTML v… | Patch early | 4.3 medium | 1.5% | 2009-07-20 |
| CVE-2010-4913 EXP | Cross-site scripting (XSS) vulnerability in the search feature in ColdGen ColdUserGroup 1.06 allows remote attackers to inject arbitrary web script or… | Patch early | 4.3 medium | 1.5% | 2011-10-08 |
| CVE-2010-4971 EXP | Cross-site scripting (XSS) vulnerability in VideoWhisper PHP 2 Way Video Chat component for Joomla! allows remote attackers to inject arbitrary web sc… | Patch early | 4.3 medium | 1.5% | 2011-11-02 |
| CVE-2010-5051 EXP | Cross-site scripting (XSS) vulnerability in admin/core/admin_func.php in razorCMS 1.0 stable allows remote attackers to inject arbitrary web script or… | Patch early | 4.3 medium | 1.5% | 2011-11-23 |
| CVE-2012-0900 EXP | Multiple cross-site scripting (XSS) vulnerabilities in Beehive Forum 1.0.1 allow remote attackers to inject arbitrary web script or HTML via the PATH_… | Patch early | 4.3 medium | 1.5% | 2012-01-20 |
| CVE-2012-1021 EXP | Cross-site scripting (XSS) vulnerability in admin/categories.php in 4images 1.7.10 allows remote attackers to inject arbitrary web script or HTML via… | Patch early | 4.3 medium | 1.5% | 2012-02-08 |
| CVE-2007-3134 EXP | Multiple cross-site scripting (XSS) vulnerabilities in atomPhotoBlog.php in Atom PhotoBlog 1.0.9 and earlier allow remote attackers to inject arbitrar… | Patch early | 4.3 medium | 1.5% | 2007-06-08 |
| CVE-2010-4837 EXP | Cross-site scripting (XSS) vulnerability in the JSupport (com_jsupport) component 1.5.6 for Joomla! allows remote attackers to inject arbitrary web sc… | Patch early | 4.3 medium | 1.5% | 2011-09-14 |
| CVE-2011-4572 EXP | Cross-site scripting (XSS) vulnerability in inc/tesmodrewite.php in CF Image Hosting Script 1.3.82, 1.4.1, and probably other versions before 1.4.2 al… | Patch early | 4.3 medium | 1.5% | 2011-11-29 |
| CVE-2008-2566 EXP | Multiple cross-site scripting (XSS) vulnerabilities in PHP Address Book 3.1.5 and earlier allow remote attackers to inject arbitrary web script or HTM… | Patch early | 4.3 medium | 1.5% | 2008-06-06 |
| CVE-2007-6474 EXP | Multiple cross-site scripting (XSS) vulnerabilities in GF-3XPLORER 2.4 allow remote attackers to inject arbitrary web script or HTML via the newdir pa… | Patch early | 4.3 medium | 1.5% | 2007-12-20 |
| CVE-2008-1470 EXP | Incomplete blacklist vulnerability in IISWebAgentIF.dll in the WebID RSA Authentication Agent 5.3, and possibly earlier, allows remote attackers to co… | Patch early | 4.3 medium | 1.5% | 2008-03-24 |
| CVE-2008-6629 EXP | Cross-site scripting (XSS) vulnerability in detail.php in WEBBDOMAIN Multi Languages WebShop Online 1.02 allows remote attackers to inject arbitrary w… | Patch early | 4.3 medium | 1.5% | 2009-04-06 |
| CVE-2009-1228 EXP | Cross-site scripting (XSS) vulnerability in register.php in Arcadwy Arcade Script CMS allows remote attackers to inject arbitrary web script or HTML v… | Patch early | 4.3 medium | 1.5% | 2009-04-02 |
| CVE-2009-3153 EXP | Multiple cross-site scripting (XSS) vulnerabilities in x10 MP3 Search engine 1.6.5 allow remote attackers to inject arbitrary web script or HTML via t… | Patch early | 4.3 medium | 1.5% | 2009-09-10 |
| CVE-2009-3195 EXP | Multiple cross-site scripting (XSS) vulnerabilities in JCE-Tech Auction RSS Content Script 3.0 allow remote attackers to inject arbitrary web script o… | Patch early | 4.3 medium | 1.5% | 2009-09-15 |
| CVE-2009-3539 EXP | Multiple cross-site scripting (XSS) vulnerabilities in YourFreeWorld Ultra Classifieds Pro allow remote attackers to inject arbitrary web script or HT… | Patch early | 4.3 medium | 1.5% | 2009-10-02 |
| CVE-2009-4366 EXP | Cross-site scripting (XSS) vulnerability in index.php in ScriptsEz Ez Blog 1.0 allows remote attackers to inject arbitrary web script or HTML via the… | Patch early | 4.3 medium | 1.5% | 2009-12-21 |
| CVE-2010-0936 EXP | Cross-site scripting (XSS) vulnerability in auth.asp on the D-LINK DKVM-IP8 with firmware 2282_dlinkA4_p8_20071213 allows remote attackers to inject a… | Patch early | 4.3 medium | 1.5% | 2010-03-08 |
| CVE-2006-5924 EXP | Cross-site scripting (XSS) vulnerability in index.php in Efficient IP iPmanager (IPm) 2.3 allows remote attackers to inject arbitrary web script or HT… | Patch early | 5.8 medium | 1.5% | 2006-11-15 |
| CVE-2018-10365 EXP | An XSS issue was discovered in the Threads to Link plugin 1.3 for MyBB. When editing a thread, the user is given the option to convert the thread to a… | Patch early | 5.4 medium | 1.5% | 2018-05-01 |
| CVE-2009-2778 EXP | Cross-site scripting (XSS) vulnerability in visitor/view.php in GarageSales Script allows remote attackers to inject arbitrary web script or HTML via… | Patch early | 4.3 medium | 1.5% | 2009-08-14 |
| CVE-2009-4743 EXP | Multiple cross-site scripting (XSS) vulnerabilities in history-storage.aspx in AfterLogic WebMail Pro 4.7.10 and earlier allow remote attackers to inj… | Patch early | 4.3 medium | 1.5% | 2010-03-26 |
| CVE-2008-0186 EXP | Cross-site scripting (XSS) vulnerability in index.php in NetRisk 1.9.7 and possibly earlier allows remote attackers to inject arbitrary web script or… | Patch early | 4.3 medium | 1.5% | 2008-01-09 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt