CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
404,394 CVEs
1,739 on KEV
17,299 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-12
10,149 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2026-54645 EXP | CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/products.index.inc.php reads the description, description_short, and spec_co… | Patch early | 4.8 medium | 1.1% | 2026-09-17 |
| CVE-2009-4351 EXP | SQL injection vulnerability in ADMIN/loginaction.php in WSCreator 1.1, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary… | Patch early | 6.8 medium | 1.1% | 2009-12-17 |
| CVE-2007-6634 EXP | Multiple SQL injection vulnerabilities in FAQMasterFlexPlus, possibly 1.5 or 1.52, allow remote attackers to execute arbitrary SQL commands via the ca… | Patch early | 6.8 medium | 1.1% | 2008-01-04 |
| CVE-2018-11581 EXP | Cross-site scripting (XSS) vulnerability on Brother HL series printers allows remote attackers to inject arbitrary web script or HTML via the url para… | Patch early | 4.8 medium | 1.1% | 2018-06-01 |
| CVE-2014-2946 EXP | Cross-site request forgery (CSRF) vulnerability in api/sms/send-sms in the Web UI 11.010.06.01.858 on Huawei E303 modems with software 22.157.18.00.85… | Patch early | 6.8 medium | 1.1% | 2014-06-02 |
| CVE-2009-4907 EXP | Multiple cross-site request forgery (CSRF) vulnerabilities in oBlog allow remote attackers to hijack the authentication of administrators for requests… | Patch early | 6.8 medium | 1.1% | 2010-06-25 |
| CVE-2005-4158 EXP | Sudo before 1.6.8 p12, when the Perl taint flag is off, does not clear the (1) PERLLIB, (2) PERL5LIB, and (3) PERL5OPT environment variables, which al… | Patch early | 4.6 medium | 1.1% | 2005-12-11 |
| CVE-2014-7951 EXP | Directory traversal vulnerability in the Android debug bridge (aka adb) in Android 4.0.4 allows physically proximate attackers with a direct connectio… | Patch early | 4.6 medium | 1.1% | 2020-02-20 |
| CVE-2012-5898 EXP | Cross-site request forgery (CSRF) vulnerability in SAMEDIA LandShop 0.9.2 allows remote attackers to hijack the authentication of administrators for r… | Patch early | 6.8 medium | 1.1% | 2012-11-17 |
| CVE-2008-2096 EXP | SQL injection vulnerability in BackLinkSpider allows remote attackers to execute arbitrary SQL commands via the cat_id parameter to a site-specific co… | Patch early | 6.8 medium | 1.1% | 2008-05-07 |
| CVE-2008-2191 EXP | SQL injection vulnerability in the pnEncyclopedia module 0.2.0 and earlier for PostNuke allows remote attackers to execute arbitrary SQL commands via… | Patch early | 6.8 medium | 1.1% | 2008-05-14 |
| CVE-2008-3788 EXP | Multiple SQL injection vulnerabilities in PICTURESPRO Photo Cart 3.9, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary S… | Patch early | 6.8 medium | 1.1% | 2008-08-26 |
| CVE-1999-0888 EXP | dbsnmp in Oracle Intelligent Agent allows local users to gain privileges by setting the ORACLE_HOME environmental variable, which dbsnmp uses to find… | Patch early | 4.6 medium | 1.1% | 1999-08-16 |
| CVE-2012-5319 EXP | Cross-site request forgery (CSRF) vulnerability in setup/security.cgi in D-Link DCS-900, DCS-2000, and DCS-5300 allows remote attackers to hijack the… | Patch early | 6.8 medium | 1.1% | 2012-10-08 |
| CVE-2012-4325 EXP | Cross-site request forgery (CSRF) vulnerability in upload/users.php in Utopia News Pro (UNP) 1.4.0 and earlier allows remote attackers to hijack the a… | Patch early | 6.8 medium | 1.1% | 2012-08-14 |
| CVE-2012-5005 EXP | Cross-site request forgery (CSRF) vulnerability in admin/admin_options.php in VR GPub 4.0 allows remote attackers to hijack the authentication of admi… | Patch early | 6.8 medium | 1.1% | 2012-09-19 |
| CVE-2015-7895 EXP | Samsung Gallery on the Samsung Galaxy S6 allows local users to cause a denial of service (process crash). | Patch early | 5.5 medium | 1.1% | 2017-06-27 |
| CVE-2012-5891 EXP | Multiple cross-site request forgery (CSRF) vulnerabilities in photo/pass.php in DAlbum 1.44 build 174 and earlier allow remote attackers to hijack the… | Patch early | 6.8 medium | 1.1% | 2012-11-17 |
| CVE-2007-4106 EXP | SQL injection vulnerability in login.asp in CodeWidgets Pay Roll - Time Sheet and Punch Card Application With Web Interface allows remote attackers to… | Patch early | 6.8 medium | 1.1% | 2007-07-31 |
| CVE-2007-4111 EXP | SQL injection vulnerability in the login script in Real Estate listing website application template, when logging in as user or manager, allows remote… | Patch early | 6.8 medium | 1.1% | 2007-07-31 |
| CVE-2025-55911 EXP | An issue Clip Bucket v.5.5.2 Build#90 allows a remote attacker to execute arbitrary codes via the file_downloader.php and the file parameter | Patch early | 6.5 medium | 1.1% | 2025-09-18 |
| CVE-2015-2572 EXP | Unspecified vulnerability in the Oracle Hyperion Smart View for Office component in Oracle Hyperion 11.1.2.5.216 and earlier, when running on Windows,… | Patch early | 4.6 medium | 1.1% | 2015-04-16 |
| CVE-2009-4906 EXP | Cross-site request forgery (CSRF) vulnerability in index.php in Acc PHP eMail 1.1 allows remote attackers to hijack the authentication of administrato… | Patch early | 6.8 medium | 1.1% | 2010-06-25 |
| CVE-2000-0206 EXP | The installation of Oracle 8.1.5.x on Linux follows symlinks and creates the orainstRoot.sh file with world-writeable permissions, which allows local… | Patch early | 6.2 medium | 1.1% | 2000-03-05 |
| CVE-2009-0851 EXP | Multiple SQL injection vulnerabilities in CelerBB 0.0.2, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands v… | Patch early | 6.8 medium | 1.1% | 2009-03-09 |
| CVE-2001-1077 EXP | Buffer overflow in tt_printf function of rxvt 2.6.2 allows local users to gain privileges via a long (1) -T or (2) -name argument. | Patch early | 4.6 medium | 1.1% | 2001-06-15 |
| CVE-2012-1297 EXP | Multiple cross-site request forgery (CSRF) vulnerabilities in main.php in Contao (formerly TYPOlight) 2.11.0 and earlier allow remote attackers to hij… | Patch early | 6.8 medium | 1.1% | 2012-03-19 |
| CVE-2005-2713 EXP | passwd in Directory Services in Mac OS X 10.3.x before 10.3.9 and 10.4.x before 10.4.5 allows local users to create arbitrary world-writable files as… | Patch early | 6.8 medium | 1.1% | 2005-12-31 |
| CVE-2010-5315 EXP | Multiple cross-site request forgery (CSRF) vulnerabilities in BEdita before 3.1 allow remote attackers to hijack the authentication of administrators… | Patch early | 6.8 medium | 1.1% | 2015-01-03 |
| CVE-2011-5318 EXP | Multiple cross-site request forgery (CSRF) vulnerabilities in diafan.CMS before 5.1 allow remote attackers to hijack the authentication of administrat… | Patch early | 6.8 medium | 1.1% | 2015-01-01 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt