CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
404,394 CVEs
1,739 on KEV
17,299 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-12
10,149 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2012-1203 EXP | Cross-site request forgery (CSRF) vulnerability in starnet/index.php in SyndeoCMS 3.0 and earlier allows remote attackers to hijack the authentication… | Patch early | 6.8 medium | 1.1% | 2014-12-28 |
| CVE-2012-1415 EXP | Cross-site request forgery (CSRF) vulnerability in lib/logout.php in DFLabs PTK 1.0.5 and earlier allows remote attackers to hijack the authentication… | Patch early | 6.8 medium | 1.1% | 2014-12-28 |
| CVE-2014-3866 EXP | Multiple cross-site request forgery (CSRF) vulnerabilities in user_settings.php in Usercake 2.0.2 and earlier allow remote attackers to hijack the aut… | Patch early | 6.8 medium | 1.1% | 2014-05-26 |
| CVE-2008-4175 EXP | Multiple SQL injection vulnerabilities in Link Bid Script 1.5 allow remote attackers to execute arbitrary SQL commands via the (1) ucat parameter to u… | Patch early | 6.5 medium | 1.1% | 2008-09-23 |
| CVE-2006-4709 EXP | SQL injection vulnerability in topic.php in Vikingboard 0.1b allows remote attackers to execute arbitrary SQL commands via the s parameter. | Patch early | 5.0 medium | 1.1% | 2006-09-12 |
| CVE-2005-0823 EXP | ThePoolClub (1) iPool and (2) iSnooker 1.6.81 and earlier stores usernames and passwords in cleartext in the MyDetails.txt file, which allows local us… | Patch early | 4.6 medium | 1.1% | 2005-05-02 |
| CVE-2007-3673 EXP | Symantec symtdi.sys before 7.0.0, as distributed in Symantec AntiVirus Corporate Edition 9 through 10.1 and Client Security 2.0 through 3.1, Norton An… | Patch early | 6.9 medium | 1.1% | 2007-07-15 |
| CVE-2008-7009 EXP | Buffer overflow in multiscan.exe in Check Point ZoneAlarm Security Suite 7.0.483.000 and 8.0.020.000 allows local users to execute arbitrary code via… | Patch early | 6.9 medium | 1.1% | 2009-08-19 |
| CVE-2008-0565 EXP | SQL injection vulnerability in vote.php in DeltaScripts PHP Links 1.3 and earlier allows remote attackers to execute arbitrary SQL commands via the id… | Patch early | 6.8 medium | 1.1% | 2008-02-05 |
| CVE-2005-3257 EXP | The VT implementation (vt_ioctl.c) in Linux kernel 2.6.12, and possibly other versions including 2.6.14.4, allows local users to use the KDSKBSENT ioc… | Patch early | 4.6 medium | 1.1% | 2005-10-18 |
| CVE-2010-5239 EXP | Untrusted search path vulnerability in DAEMON Tools Lite 4.35.6.0091 and Pro Standard 4.36.0309.0160 allows local users to gain privileges via a Troja… | Patch early | 6.9 medium | 1.1% | 2012-09-07 |
| CVE-2026-44595 EXP | Yamcs is a mission control framework. Prior to 5.12.7, the IAM API endpoints listUsers, getUser, listGroups, and getGroup in yamcs-core did not enforc… | Patch early | 4.3 medium | 1.1% | 2026-07-16 |
| CVE-2005-2071 EXP | traceroute in Sun Solaris 10 on x86 systems allows local users to execute arbitrary code with PRIV_NET_RAWACCESS privileges via (1) a large number of… | Patch early | 4.6 medium | 1.1% | 2005-06-29 |
| CVE-2014-9457 EXP | SQL injection vulnerability in classes/mono_display.class.php in PMB 4.1.3 and earlier allows remote authenticated users to execute arbitrary SQL comm… | Patch early | 6.5 medium | 1.1% | 2015-01-02 |
| CVE-2003-0325 EXP | Buffer overflow in Maelstrom 3.0.6, 3.0.5, and earlier allows local users to execute arbitrary code via a long -server command line argument. | Patch early | 4.6 medium | 1.1% | 2003-06-09 |
| CVE-2012-5348 EXP | SQL injection vulnerability in MangosWeb Enhanced 3.0.3 allows remote attackers to execute arbitrary SQL commands via the login parameter in a login a… | Patch early | 6.8 medium | 1.1% | 2012-10-09 |
| CVE-2007-2537 EXP | Multiple SQL injection vulnerabilities in mainfile.php in NPDS 5.10 and earlier allow remote authenticated users to execute arbitrary SQL commands via… | Patch early | 6.5 medium | 1.1% | 2007-05-09 |
| CVE-2006-3931 EXP | Buffer overflow in the daemon function in midirecord.cc in Tuomas Airaksinen Midirecord 2.0 allows local users to execute arbitrary code via a long co… | Patch early | 4.6 medium | 1.1% | 2006-07-31 |
| CVE-2008-6498 EXP | Cross-site request forgery (CSRF) vulnerability in security/xamppsecurity.php in XAMPP 1.6.8 allows remote attackers to hijack the authentication of u… | Patch early | 6.8 medium | 1% | 2009-03-20 |
| CVE-2006-5732 EXP | SQL injection vulnerability in logout.php in T.G.S. CMS 0.1.7 and earlier allows remote attackers to execute arbitrary SQL commands via the myauthorid… | Patch early | 5.0 medium | 1% | 2006-11-06 |
| CVE-2024-13946 EXP | DLL's are not digitally signed when loaded in ASPECT's configuration toolset exposing the application to binary planting during device commissioning.T… | Patch early | 6.8 medium | 1% | 2025-05-22 |
| CVE-2011-4089 EXP | The bzexe command in bzip2 1.0.5 and earlier generates compressed executables that do not properly handle temporary files during extraction, which all… | Patch early | 4.6 medium | 1% | 2014-04-16 |
| CVE-2008-2013 EXP | SQL injection vulnerability in index.php in the pnFlashGames 1.5 through 2.5 module for PostNuke, when magic_quotes_gpc is disabled, allows remote att… | Patch early | 6.8 medium | 1% | 2008-04-30 |
| CVE-2020-7030 EXP | A sensitive information disclosure vulnerability was discovered in the web interface component of IP Office that may potentially allow a local user to… | Patch early | 5.5 medium | 1% | 2020-06-04 |
| CVE-2015-1100 EXP | The kernel in Apple iOS before 8.3, Apple OS X before 10.10.3, and Apple TV before 7.2 allows attackers to cause a denial of service (out-of-bounds me… | Patch early | 5.4 medium | 1% | 2015-04-10 |
| CVE-2013-1773 EXP | Buffer overflow in the VFAT filesystem implementation in the Linux kernel before 3.3 allows local users to gain privileges or cause a denial of servic… | Patch early | 6.2 medium | 1% | 2013-02-28 |
| CVE-2012-5323 EXP | Cross-site request forgery (CSRF) vulnerability in webconfig/admin_passwd/passwd.html/admin_passwd in Xavi X7968 allows remote attackers to hijack the… | Patch early | 6.8 medium | 1% | 2012-10-08 |
| CVE-2007-3687 EXP | SQL injection vulnerability in inferno.php in the Inferno Technologies RPG Inferno 2.4 and earlier, a vBulletin module, allows remote authenticated at… | Patch early | 6.5 medium | 1% | 2007-07-11 |
| CVE-2009-4196 EXP | Multiple cross-site scripting (XSS) vulnerabilities in multiple scripts in Forms/ in Huawei MT882 V100R002B020 ARG-T running firmware 3.7.9.98 allow r… | Patch early | 4.3 medium | 1% | 2009-12-04 |
| CVE-2016-5847 EXP | SAP SAPCAR allows local users to change the permissions of arbitrary files and consequently gain privileges via a hard link attack on files extracted… | Patch early | 5.8 medium | 1% | 2016-08-13 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt