CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
404,381 CVEs
1,739 on KEV
17,299 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-12
10,149 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2006-5525 EXP | Incomplete blacklist vulnerability in mainfile.php in PHP-Nuke 7.9 and earlier allows remote attackers to conduct SQL injection attacks via (1) "/**/U… | Patch early | 5.1 medium | 1.1% | 2006-10-26 |
| CVE-2002-1814 EXP | Buffer overflow in efstools in Bonobo, when installed setuid, allows local users to execute arbitrary code via long command line arguments. | Patch early | 4.6 medium | 1.1% | 2002-12-31 |
| CVE-2018-9155 EXP | Cross-site scripting (XSS) vulnerability in Open-AudIT Professional 2.1.1 allows remote attackers to inject arbitrary web script or HTML via a crafted… | Patch early | 5.4 medium | 1.1% | 2018-04-12 |
| CVE-2008-4190 EXP | The IPSEC livetest tool in Openswan 2.4.12 and earlier, and 2.6.x through 2.6.16, allows local users to overwrite arbitrary files and execute arbitrar… | Patch early | 4.4 medium | 1.1% | 2008-09-24 |
| CVE-2007-1057 EXP | The Net Direct client for Linux before 6.0.5 in Nortel Application Switch 2424, VPN 3050 and 3070, and SSL VPN Module 1000 extracts and executes files… | Patch early | 6.9 medium | 1.1% | 2007-02-21 |
| CVE-2008-3185 EXP | SQL injection vulnerability in index.php in Relative Real Estate Systems 3.0 and earlier allows remote attackers to execute arbitrary SQL commands via… | Patch early | 6.8 medium | 1.1% | 2008-07-15 |
| CVE-2006-2697 EXP | Multiple SQL injection vulnerabilities in Easy-Content Forums 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) startletter par… | Patch early | 6.4 medium | 1.1% | 2006-05-31 |
| CVE-2008-3925 EXP | Cross-site request forgery (CSRF) vulnerability in admin.php in Content Management Made Easy (CMME) 1.12 allows remote attackers to trigger the logout… | Patch early | 4.3 medium | 1.1% | 2008-09-04 |
| CVE-2008-0371 EXP | Multiple SQL injection vulnerabilities in aliTalk 1.9.1.1, when magic_quotes_gpc is disabled, allow remote authenticated users to execute arbitrary SQ… | Patch early | 6.8 medium | 1.1% | 2008-01-22 |
| CVE-2011-5195 EXP | Cross-site request forgery (CSRF) vulnerability in index/manager/fileUpload in Public Knowledge Project Open Conference Systems 2.3.4 and earlier allo… | Patch early | 6.8 medium | 1.1% | 2012-09-23 |
| CVE-2003-1520 EXP | SQL injection vulnerability in FuzzyMonkey My Classifieds 2.11 allows remote attackers to execute arbitrary SQL commands via the email parameter. | Patch early | 6.8 medium | 1.1% | 2003-12-31 |
| CVE-2007-1484 EXP | The array_user_key_compare function in PHP 4.4.6 and earlier, and 5.x up to 5.2.1, makes erroneous calls to zval_dtor, which triggers memory corruptio… | Patch early | 4.6 medium | 1.1% | 2007-03-16 |
| CVE-2009-2715 EXP | Sun VirtualBox 2.2 through 3.0.2 r49928 allows guest OS users to cause a denial of service (Linux host OS reboot) via a sysenter instruction. | Patch early | 4.9 medium | 1.1% | 2009-08-07 |
| CVE-2015-7347 EXP | Cross-site scripting (XSS) vulnerability in ZCMS JavaServer Pages Content Management System 1.1. | Patch early | 4.8 medium | 1.1% | 2017-09-20 |
| CVE-2007-2520 EXP | SQL injection vulnerability in admin.php in MyNews 0.10, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands… | Patch early | 6.8 medium | 1.1% | 2007-06-26 |
| CVE-2007-4116 EXP | SQL injection vulnerability in philboard_forum.asp in Metyus Forum Portal 1.0 allows remote attackers to execute arbitrary SQL commands via the forumi… | Patch early | 6.8 medium | 1.1% | 2007-07-31 |
| CVE-2007-4359 EXP | Multiple SQL injection vulnerabilities in SkilMatch Staffing Systems JobLister3 allow remote attackers to execute arbitrary SQL commands via (1) the s… | Patch early | 6.8 medium | 1.1% | 2007-08-15 |
| CVE-2009-0400 EXP | SQL injection vulnerability in blog.php in SocialEngine 3.06 trial allows remote attackers to execute arbitrary SQL commands via the category_id param… | Patch early | 6.8 medium | 1.1% | 2009-02-03 |
| CVE-2009-0409 EXP | SQL injection vulnerability in offline_auth.php in Max.Blog 1.0.6 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute a… | Patch early | 6.8 medium | 1.1% | 2009-02-03 |
| CVE-2012-2956 EXP | SQL injection vulnerability in SpiceWorks 5.3.75941 allows remote authenticated users to execute arbitrary SQL commands via the id parameter to api_v2… | Patch early | 6.5 medium | 1.1% | 2014-09-17 |
| CVE-2020-29477 EXP | Invision Community 4.5.4 is affected by cross-site scripting (XSS) in the Field Name field. This vulnerability can allow an attacker to inject the XSS… | Patch early | 4.8 medium | 1.1% | 2020-12-30 |
| CVE-2020-8504 EXP | School Management Software PHP/mySQL through 2019-03-14 allows office_admin/?action=addadmin CSRF to add an administrative user. | Patch early | 6.5 medium | 1.1% | 2020-01-31 |
| CVE-2020-8505 EXP | School Management Software PHP/mySQL through 2019-03-14 allows office_admin/?action=deleteadmin CSRF to delete a user. | Patch early | 6.5 medium | 1.1% | 2020-01-31 |
| CVE-2006-1422 EXP | SQL injection vulnerability in details_view.php in PHP Booking Calendar 1.0c and earlier allows remote attackers to execute arbitrary SQL commands via… | Patch early | 5.0 medium | 1.1% | 2006-03-28 |
| CVE-2014-1990 EXP | Cross-site request forgery (CSRF) vulnerability in TopAccess (aka the web-based management utility) on TOSHIBA TEC e-Studio 232, 233, 282, and 283 dev… | Patch early | 6.8 medium | 1.1% | 2014-04-19 |
| CVE-2016-7608 EXP | An issue was discovered in certain Apple products. macOS before 10.12.2 is affected. The issue involves the "IOFireWireFamily" component, which allows… | Patch early | 5.5 medium | 1.1% | 2017-02-20 |
| CVE-2004-0244 EXP | Cisco 6000, 6500, and 7600 series systems with Multilayer Switch Feature Card 2 (MSFC2) and a FlexWAN or OSM module allow local users to cause a denia… | Patch early | 4.7 medium | 1.1% | 2004-11-23 |
| CVE-2006-2336 EXP | SQL injection vulnerability in showthread.php in MyBB (aka MyBulletinBoard) 1.1.1 allows remote attackers to execute arbitrary SQL commands via the co… | Patch early | 6.4 medium | 1.1% | 2006-05-12 |
| CVE-2006-1153 EXP | SQL injection vulnerability in D2-Shoutbox 4.2 allows remote attackers to execute arbitrary SQL commands via the load parameter, when performing a Sho… | Patch early | 5.0 medium | 1.1% | 2006-03-10 |
| CVE-2002-1165 EXP | Sendmail Consortium's Restricted Shell (SMRSH) in Sendmail 8.12.6, 8.11.6-15, and possibly other versions after 8.11 from 5/19/1998, allows attackers… | Patch early | 4.6 medium | 1.1% | 2002-10-11 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt