CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
404,381 CVEs
1,739 on KEV
17,299 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-12
25,091 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2007-1933 EXP | Multiple directory traversal vulnerabilities in PcP-Guestbook (PcP-Book) 3.0 allow remote attackers to include and execute arbitrary local files via a… | Patch early | 7.5 high | 6.3% | 2007-04-10 |
| CVE-2008-6535 EXP | admin/settings.php in PayPal eStores allows remote attackers to bypass intended access restrictions and change the administrative password via a direc… | Patch early | 7.5 high | 6.3% | 2009-03-26 |
| CVE-2007-3932 EXP | uploadimg.php in the Expose RC35 and earlier (com_expose) component for Joomla! sends an error message but does not exit when it detects an attempt to… | Patch early | 7.5 high | 6.3% | 2007-07-21 |
| CVE-2004-1535 EXP | PHP remote file inclusion vulnerability in admin_cash.php for the Cash Mod module for phpBB allows remote attackers to execute arbitrary PHP code by m… | Patch early | 7.5 high | 6.3% | 2004-12-31 |
| CVE-2005-0513 EXP | PHP remote file inclusion vulnerability in mail_autocheck.php in the Email This Entry add-on for pMachine Pro 2.4, and possibly other versions includi… | Patch early | 7.5 high | 6.3% | 2005-02-19 |
| CVE-2007-6041 EXP | Buffer overflow in the Sequencer::queueMessage function in sequencer.cpp in the server in Rigs of Rods (RoR) before 0.33d SP1 allows remote attackers… | Patch early | 7.5 high | 6.3% | 2007-11-20 |
| CVE-2006-6690 EXP | rtehtmlarea/pi1/class.tx_rtehtmlarea_pi1.php in Typo3 4.0.0 through 4.0.3, 3.7 and 3.8 with the rtehtmlarea extension, and 4.1 beta allows remote auth… | Patch early | 7.5 high | 6.3% | 2006-12-21 |
| CVE-2013-1402 EXP | DigiLIBE 3.4 and possibly other versions sends a redirect but does not exit, which allows remote attackers to obtain sensitive configuration informati… | Patch early | 5.0 medium | 6.3% | 2013-02-14 |
| CVE-2011-4810 EXP | Multiple directory traversal vulnerabilities in WHMCompleteSolution (WHMCS) 3.x and 4.x allow remote attackers to read arbitrary files via the templat… | Patch early | 5.0 medium | 6.3% | 2011-12-14 |
| CVE-2007-2777 EXP | Unrestricted file upload vulnerability in admin/addsptemplate.php in AlstraSoft Template Seller Pro 3.25 and earlier allows remote attackers to execut… | Patch early | 7.5 high | 6.3% | 2007-05-21 |
| CVE-2013-1937 EXP | Multiple cross-site scripting (XSS) vulnerabilities in tbl_gis_visualization.php in phpMyAdmin 3.5.x before 3.5.8 might allow remote attackers to inje… | Patch early | 6.1 medium | 6.3% | 2013-04-16 |
| CVE-2008-6761 EXP | Static code injection vulnerability in admin/install.php in Flexcustomer 0.0.6 might allow remote attackers to inject arbitrary PHP code into const.in… | Patch early | 10.0 high | 6.3% | 2009-04-28 |
| CVE-2004-2491 EXP | A race condition in Opera web browser 7.53 Build 3850 causes Opera to fill in the address bar before the page has been loaded, which allows remote att… | Patch early | 2.6 low | 6.3% | 2004-12-31 |
| CVE-2008-5919 EXP | Directory traversal vulnerability in rss.php in WebSVN 2.0 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to overwrite arbitr… | Patch early | 6.8 medium | 6.3% | 2009-01-21 |
| CVE-2012-4057 EXP | Buffer overflow in the Player in Remote-Anything 5.60.15 allows remote attackers to execute arbitrary code via a crafted flm file. | Patch early | 9.3 high | 6.3% | 2012-07-25 |
| CVE-2022-39195 EXP | A cross-site scripting (XSS) vulnerability in the LISTSERV 17 web interface allows remote attackers to inject arbitrary JavaScript or HTML via the c p… | Patch early | 6.1 medium | 6.3% | 2023-01-17 |
| CVE-2013-1636 EXP | Cross-site scripting (XSS) vulnerability in open-flash-chart.swf in Open Flash Chart (aka Open-Flash Chart), as used in the Pretty Link Lite plugin be… | Patch early | 4.3 medium | 6.3% | 2014-03-12 |
| CVE-2017-7039 EXP | An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. iCloud before 6.2.2 on Windows is… | Patch early | 8.8 high | 6.3% | 2017-07-20 |
| CVE-2017-7040 EXP | An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. iCloud before 6.2.2 on Windows is… | Patch early | 8.8 high | 6.3% | 2017-07-20 |
| CVE-2017-7043 EXP | An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. iCloud before 6.2.2 on Windows is… | Patch early | 8.8 high | 6.3% | 2017-07-20 |
| CVE-2007-3168 EXP | A certain ActiveX control in the EDraw Office Viewer Component (edrawofficeviewer.ocx) 4.0.5.20, and other versions before 5.0, allows remote attacker… | Patch early | 7.8 high | 6.3% | 2007-06-11 |
| CVE-2019-8926 EXP | An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2. XSS exists in the Administration zone /netflow/jspui/popup1.jsp fi… | Patch early | 6.1 medium | 6.3% | 2019-05-17 |
| CVE-2019-8928 EXP | An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2. XSS exists in /netflow/jspui/userManagementForm.jsp via these GET… | Patch early | 6.1 medium | 6.3% | 2019-05-17 |
| CVE-2006-1495 EXP | SQL injection vulnerability in general/sendpassword.php in (1) PHPCollab 2.4 and 2.5.rc3, and (2) NetOffice 2.5.3-pl1 and 2.6.0b2 allows remote attack… | Patch early | 7.5 high | 6.3% | 2006-03-30 |
| CVE-2008-0143 EXP | PHP remote file inclusion vulnerability in common/db.php in samPHPweb, possibly 4.2.2 and others, as provided with SAM Broadcaster, allows remote atta… | Patch early | 7.5 high | 6.3% | 2008-01-08 |
| CVE-2014-9598 EXP | The picture_Release function in misc/picture.c in VideoLAN VLC media player 2.1.5 allows remote attackers to execute arbitrary code or cause a denial… | Patch early | 6.8 medium | 6.3% | 2015-01-21 |
| CVE-2018-1185 EXP | An issue was discovered in EMC RecoverPoint for Virtual Machines versions prior to 5.1.1, EMC RecoverPoint version 5.1.0.0, and EMC RecoverPoint versi… | Patch early | 6.7 medium | 6.3% | 2018-02-03 |
| CVE-2013-4864 EXP | MiCasaVerde VeraLite with firmware 1.5.408 allows remote attackers to send HTTP requests to intranet servers via the url parameter to cgi-bin/cmh/prox… | Patch early | 9.8 critical | 6.3% | 2020-01-28 |
| CVE-2020-6862 EXP | V6.0.10P2T2 and V6.0.10P2T5 of F6x2W product are impacted by Information leak vulnerability. Unauthorized users could log in directly to obtain page i… | Patch early | 5.3 medium | 6.3% | 2020-01-17 |
| CVE-2014-9448 EXP | Buffer overflow in Mini-stream RM-MP3 Converter 3.1.2.1.2010.03.30 allows remote attackers to execute arbitrary code or cause a denial of service (cra… | Patch early | 7.5 high | 6.3% | 2015-01-02 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt