CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
404,381 CVEs
1,739 on KEV
17,299 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-12
10,149 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2004-1413 EXP | Multiple SQL injection vulnerabilities in Kayako eSupport 2.x allow remote attackers to execute arbitrary SQL commands via the (1) subcat, (2) rate, (… | Patch early | 5.0 medium | 1.1% | 2004-12-31 |
| CVE-2005-4781 EXP | Multiple SQL injection vulnerabilities in SergiDs Top Music module 3.0 PR3 and earlier for PHP-Nuke allow remote attackers to execute arbitrary SQL co… | Patch early | 5.0 medium | 1.1% | 2005-12-31 |
| CVE-2006-1420 EXP | SQL injection vulnerability in print.php in SaphpLesson 2.0 allows remote attackers to execute arbitrary SQL commands via the lessid parameter. | Patch early | 5.0 medium | 1.1% | 2006-03-28 |
| CVE-2006-1926 EXP | SQL injection vulnerability in showtopic.php in ThWboard 2.84 beta 3 and earlier allows remote attackers to execute arbitrary SQL commands via the pag… | Patch early | 5.0 medium | 1.1% | 2006-04-20 |
| CVE-2005-4664 EXP | SQL injection vulnerability in OcoMon 1.21, and possibly other versions, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitra… | Patch early | 5.0 medium | 1.1% | 2005-12-31 |
| CVE-2020-29475 EXP | nopCommerce Store 4.30 is affected by cross-site scripting (XSS) in the Schedule tasks name field. This vulnerability can allow an attacker to inject… | Patch early | 4.8 medium | 1.1% | 2020-12-29 |
| CVE-2008-4423 EXP | SQL injection vulnerability in index.php in Ovidentia 6.6.5 allows remote attackers to execute arbitrary SQL commands via the item parameter in a cont… | Patch early | 6.5 medium | 1.1% | 2008-10-03 |
| CVE-2008-5079 EXP | net/atm/svc.c in the ATM subsystem in the Linux kernel 2.6.27.8 and earlier allows local users to cause a denial of service (kernel infinite loop) by… | Patch early | 4.9 medium | 1.1% | 2008-12-09 |
| CVE-2012-4425 EXP | libgio, when used in setuid or other privileged programs in spice-gtk and possibly other products, allows local users to gain privileges and execute a… | Patch early | 6.9 medium | 1.1% | 2012-09-18 |
| CVE-2015-4677 EXP | Cross-site request forgery (CSRF) vulnerability in FiverrScript (aka Fiverr Script) 7.2 allows remote attackers to hijack the authentication of admini… | Patch early | 6.8 medium | 1.1% | 2015-06-19 |
| CVE-2007-1172 EXP | SQL injection vulnerability in nukesentinel.php in NukeSentinel 2.5.05, and possibly earlier, allows remote attackers to execute arbitrary SQL command… | Patch early | 6.4 medium | 1.1% | 2007-03-02 |
| CVE-2008-3191 EXP | Multiple SQL injection vulnerabilities in usercp.php in mForum 0.1a, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQ… | Patch early | 6.8 medium | 1.1% | 2008-07-16 |
| CVE-2009-0730 EXP | Multiple SQL injection vulnerabilities in the GigCalendar (com_gigcal) component 1.0 for Mambo and Joomla!, when magic_quotes_gpc is disabled, allow r… | Patch early | 6.8 medium | 1.1% | 2009-02-24 |
| CVE-2012-4746 EXP | Cross-site request forgery (CSRF) vulnerability in accessaccount.cgi in ZTE ZXDSL 831IIV7.5.0a_Z29_OV allows remote attackers to hijack the authentica… | Patch early | 6.8 medium | 1.1% | 2012-08-31 |
| CVE-2006-6130 EXP | Apple Mac OS X AppleTalk allows local users to cause a denial of service (kernel panic) by calling the AIOCREGLOCALZN ioctl command with a crafted dat… | Patch early | 4.9 medium | 1.1% | 2006-11-28 |
| CVE-2012-4280 EXP | Multiple cross-site request forgery (CSRF) vulnerabilities in admin/agenteditor.php in Free Realty 3.1-0.6 allow remote attackers to hijack the authen… | Patch early | 6.8 medium | 1.1% | 2012-08-13 |
| CVE-2012-6508 EXP | Multiple cross-site request forgery (CSRF) vulnerabilities in NetArt Media Car Portal 3.0 allow remote attackers to hijack the authentication of admin… | Patch early | 6.8 medium | 1.1% | 2013-01-24 |
| CVE-2012-3294 EXP | Multiple cross-site request forgery (CSRF) vulnerabilities in the Web Gateway component in IBM WebSphere MQ File Transfer Edition 7.0.4 and earlier, a… | Patch early | 6.8 medium | 1.1% | 2012-08-17 |
| CVE-2012-5320 EXP | Cross-site request forgery (CSRF) vulnerability in password.cgi in Sagem F@ST 2604 253180972B allows remote attackers to hijack the authentication of… | Patch early | 6.8 medium | 1.1% | 2012-10-08 |
| CVE-2014-1322 EXP | The kernel in Apple OS X through 10.9.2 places a kernel pointer into an XNU object data structure accessible from user space, which makes it easier fo… | Patch early | 4.9 medium | 1.1% | 2014-04-23 |
| CVE-2009-3313 EXP | Multiple SQL injection vulnerabilities in FMyClone 2.3 allow remote attackers to execute arbitrary SQL commands via the comp parameter to (1) index.ph… | Patch early | 6.5 medium | 1.1% | 2009-09-23 |
| CVE-2008-1790 EXP | Unrestricted file upload vulnerability in iScripts SocialWare allows remote authenticated administrators to upload arbitrary files via a crafted logo… | Patch early | 6.5 medium | 1.1% | 2008-04-15 |
| CVE-2008-3670 EXP | SQL injection vulnerability in authordetail.php in Article Friendly Pro allows remote attackers to execute arbitrary SQL commands via the autid parame… | Patch early | 6.8 medium | 1.1% | 2008-08-13 |
| CVE-2008-6250 EXP | SQL injection vulnerability in Comdev Web Blogger 4.1.3 and earlier allows remote attackers to execute arbitrary SQL commands via the arcmonth paramet… | Patch early | 6.8 medium | 1.1% | 2009-02-23 |
| CVE-2010-0948 EXP | SQL injection vulnerability in profil.php in Bigforum 4.5, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL command… | Patch early | 6.8 medium | 1.1% | 2010-03-10 |
| CVE-2010-1346 EXP | SQL injection vulnerability in admin/login.php in Mini CMS RibaFS 1.0, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary… | Patch early | 6.8 medium | 1.1% | 2010-04-09 |
| CVE-2010-3207 EXP | SQL injection vulnerability in index.php in GaleriaSHQIP 1.0, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL comm… | Patch early | 6.8 medium | 1.1% | 2010-09-03 |
| CVE-2010-4799 EXP | Multiple SQL injection vulnerabilities in Chipmunk Pwngame 1.0, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL com… | Patch early | 6.8 medium | 1.1% | 2011-04-27 |
| CVE-2011-1556 EXP | SQL injection vulnerability in plugins/pdfClasses/pdfgen.php in Andy's PHP Knowledgebase (Aphpkb) 0.95.4 allows remote attackers to execute arbitrary… | Patch early | 6.8 medium | 1.1% | 2011-04-04 |
| CVE-2009-4238 EXP | Multiple SQL injection vulnerabilities in TestLink before 1.8.5 allow remote authenticated users to execute arbitrary SQL commands via (1) the Test Ca… | Patch early | 6.5 medium | 1.1% | 2009-12-10 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt