CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
404,449 CVEs
1,739 on KEV
17,299 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-12
25,091 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2012-2998 EXP | SQL injection vulnerability in the ad hoc query module in Trend Micro Control Manager (TMCM) before 5.5.0.1823 and 6.0 before 6.0.0.1449 allows remote… | Patch early | 7.5 high | 6.1% | 2012-09-28 |
| CVE-2015-5285 EXP | CRLF injection vulnerability in Kallithea before 0.3 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting atta… | Patch early | 5.0 medium | 6.1% | 2015-10-29 |
| CVE-2007-6344 EXP | Directory traversal vulnerability in modules/cms/index.php in Mcms Easy Web Make 1.3, allows remote attackers to include and execute arbitrary local f… | Patch early | 6.8 medium | 6.1% | 2007-12-13 |
| CVE-2009-4367 EXP | The Staging Webservice ("sitecore modules/staging/service/api.asmx") in Sitecore Staging Module 5.4.0 rev.080625 and earlier allows remote attackers t… | Patch early | 6.8 medium | 6.1% | 2009-12-21 |
| CVE-2022-24181 EXP | Cross-site scripting (XSS) via Host Header injection in PKP Open Journals System 2.4.8 >= 3.3 allows remote attackers to inject arbitary code via the… | Patch early | 6.1 medium | 6.1% | 2022-04-01 |
| CVE-2004-2198 EXP | account.asp in DUware DUclassmate 1.0 through 1.1 allows remote attackers to change the passwords for arbitrary users by modifying the MM_recordId par… | Patch early | 6.4 medium | 6.1% | 2004-12-31 |
| CVE-2008-6175 EXP | SilverSHielD 1.0.2.34 allows remote attackers to cause a denial of service (application crash) via a crafted argument to the opendir SFTP command. | Patch early | 5.0 medium | 6.1% | 2009-02-19 |
| CVE-2007-1992 EXP | Multiple PHP remote file inclusion vulnerabilities in the com_zoom 2.5 beta 2 and earlier module for Mambo allow remote attackers to execute arbitrary… | Patch early | 7.5 high | 6.1% | 2007-04-12 |
| CVE-2007-2301 EXP | Multiple PHP remote file inclusion vulnerabilities in audioCMS arash 0.1.4 allow remote attackers to execute arbitrary PHP code via a URL in the arash… | Patch early | 7.5 high | 6.1% | 2007-04-26 |
| CVE-2007-2313 EXP | PHP remote file inclusion vulnerability in getinfo1.php in the Shotcast 1.0 RC2 module for mxBB allows remote attackers to execute arbitrary PHP code… | Patch early | 7.5 high | 6.1% | 2007-04-26 |
| CVE-2007-2345 EXP | PHP remote file inclusion vulnerability in include/include_stream.inc.php in CodeWand phpBrowse allows remote attackers to execute arbitrary PHP code… | Patch early | 7.5 high | 6.1% | 2007-04-27 |
| CVE-2006-5673 EXP | PHP remote file inclusion vulnerability in bb_func_txt.php in miniBB 2.0.2 and earlier, when register_globals is enabled, allows remote attackers to e… | Patch early | 6.8 medium | 6.1% | 2006-11-03 |
| CVE-2007-5771 EXP | Flatnuke 3 (aka FlatnuX) allows remote attackers to obtain administrative access via a myforum%00 cookie. | Patch early | 7.5 high | 6.1% | 2007-11-01 |
| CVE-2006-5108 EXP | Multiple cross-site scripting (XSS) vulnerabilities in Devellion CubeCart 2.0.x allow remote attackers to inject arbitrary web script or HTML via the… | Patch early | 6.8 medium | 6.1% | 2006-10-03 |
| CVE-2015-4633 EXP | Multiple SQL injection vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and 3.20.x before 3.20.1 allow (1)… | Patch early | 9.8 critical | 6.1% | 2018-10-18 |
| CVE-2009-3428 EXP | Stack-based buffer overflow in Easy Music Player 1.0.0.2 allows remote attackers to execute arbitrary code via a crafted .wav file. | Patch early | 9.3 high | 6.1% | 2009-09-25 |
| CVE-2006-6564 EXP | FileZilla Server before 0.9.22 allows remote attackers to cause a denial of service (crash) via a malformed argument to the STOR command, which result… | Patch early | 4.0 medium | 6.1% | 2006-12-15 |
| CVE-2017-2369 EXP | An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. Safari before 10.0.3 is affected. tvOS before 10.1.1 is affected. Th… | Patch early | 8.8 high | 6.1% | 2017-02-20 |
| CVE-2017-2373 EXP | An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. Safari before 10.0.3 is affected. tvOS before 10.1.1 is affected. Th… | Patch early | 8.8 high | 6.1% | 2017-02-20 |
| CVE-2018-10371 EXP | An issue was discovered in the wunderfarm WF Cookie Consent plugin 1.1.3 for WordPress. A persistent cross-site scripting vulnerability has been ident… | Patch early | 6.1 medium | 6.1% | 2018-05-01 |
| CVE-2013-0526 EXP | ping.php in Global Console Manager 16 (GCM16) and Global Console Manager 32 (GCM32) before 1.20.0.22575 on the IBM Avocent 1754 KVM switch allows remo… | Patch early | 8.5 high | 6.1% | 2013-08-21 |
| CVE-2007-2865 EXP | Cross-site scripting (XSS) vulnerability in sqledit.php in phpPgAdmin 4.1.1 allows remote attackers to inject arbitrary web script or HTML via the ser… | Patch early | 9.3 high | 6.1% | 2007-05-25 |
| CVE-2006-2929 EXP | PHP remote file inclusion vulnerability in contrib/forms/evaluation/C_FormEvaluation.class.php in OpenEMR 2.8.1 and earlier, when register_globals is… | Patch early | 6.8 medium | 6.1% | 2006-06-09 |
| CVE-2014-100014 EXP | Multiple stack-based buffer overflows in pdmwService.exe in SolidWorks Workgroup PDM 2014 SP2 allow remote attackers to execute arbitrary code via a l… | Patch early | 7.5 high | 6.1% | 2015-01-13 |
| CVE-2009-0423 EXP | Directory traversal vulnerability in index.php in Php Photo Album (PHPPA) 0.8 BETA allows remote attackers to include and execute arbitrary local file… | Patch early | 7.5 high | 6.1% | 2009-02-05 |
| CVE-2009-1445 EXP | Multiple directory traversal vulnerabilities in WebPortal CMS 0.8-beta allow remote attackers to (1) read arbitrary files via directory traversal sequ… | Patch early | 7.5 high | 6.1% | 2009-04-27 |
| CVE-2008-4775 EXP | Cross-site scripting (XSS) vulnerability in pmd_pdf.php in phpMyAdmin 3.0.0, and possibly other versions including 2.11.9.2 and 3.0.1, when register_g… | Patch early | 2.6 low | 6.1% | 2008-10-28 |
| CVE-2005-0636 EXP | Format string vulnerability in Foxmail Server 2.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via… | Patch early | 10.0 high | 6.1% | 2005-03-02 |
| CVE-2019-12543 EXP | An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the PurchaseRequest.do serviceRequestId parameter. | Patch early | 6.1 medium | 6.1% | 2019-06-05 |
| CVE-2017-17593 EXP | Simple Chatting System 1.0 allows Arbitrary File Upload via view/my_profile.php, which places files under uploads/. | Patch early | 7.5 high | 6.1% | 2017-12-13 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt