CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
404,406 CVEs
1,739 on KEV
17,299 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-12
10,149 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2008-3531 EXP | Stack-based buffer overflow in sys/kern/vfs_mount.c in the kernel in FreeBSD 7.0 and 7.1, when vfs.usermount is enabled, allows local users to gain pr… | Patch early | 6.9 medium | 1% | 2008-09-05 |
| CVE-2005-4702 EXP | SQL injection vulnerability in the favorites module in index.php in IPBProArcade 2.5.2 allows remote attackers to inject arbitrary SQL commands via th… | Patch early | 6.4 medium | 1% | 2005-12-31 |
| CVE-2009-3002 EXP | The Linux kernel before 2.6.31-rc7 does not initialize certain data structures within getname functions, which allows local users to read the contents… | Patch early | 4.9 medium | 1% | 2009-08-28 |
| CVE-2006-6577 EXP | SQL injection vulnerability in polls.php in Neocrome Land Down Under (LDU) 8.x and earlier allows remote attackers to execute arbitrary SQL commands v… | Patch early | 6.8 medium | 1% | 2006-12-15 |
| CVE-2007-5817 EXP | dialog.php in CONTENTCustomizer 3.1mp and earlier allows remote attackers to perform certain privileged actions via a (1) del, (2) delbackup, (3) res,… | Patch early | 6.1 medium | 1% | 2007-11-05 |
| CVE-2006-3822 EXP | SQL injection vulnerability in index.php in GeodesicSolutions GeoAuctions Enterprise 1.0.6 allows remote attackers to execute arbitrary SQL commands v… | Patch early | 5.1 medium | 1% | 2006-07-25 |
| CVE-2009-4173 EXP | Cross-site request forgery (CSRF) vulnerability in CutePHP CuteNews 1.4.6 and UTF-8 CuteNews before 8b allows remote attackers to hijack the authentic… | Patch early | 6.8 medium | 1% | 2009-12-02 |
| CVE-2003-0390 EXP | Multiple buffer overflows in Options Parsing Tool (OPT) shared library 3.18 and earlier, when used in setuid programs, may allow local users to execut… | Patch early | 4.6 medium | 1% | 2003-07-02 |
| CVE-2007-1861 EXP | The nl_fib_lookup function in net/ipv4/fib_frontend.c in Linux Kernel before 2.6.20.8 allows attackers to cause a denial of service (kernel panic) via… | Patch early | 4.9 medium | 1% | 2007-05-07 |
| CVE-2012-5667 EXP | Multiple integer overflows in GNU Grep before 2.11 might allow context-dependent attackers to execute arbitrary code via vectors involving a long inpu… | Patch early | 4.4 medium | 1% | 2013-01-03 |
| CVE-2010-4750 EXP | Cross-site request forgery (CSRF) vulnerability in admin/libs/ADMIN.php in BLOG:CMS 4.2.1.e, and possibly earlier, allows remote attackers to hijack t… | Patch early | 6.8 medium | 1% | 2011-03-01 |
| CVE-2006-6220 EXP | Multiple SQL injection vulnerabilities in Recipes Website (Recipes Complete Website) 1.1.14 allow remote attackers to execute arbitrary SQL commands v… | Patch early | 6.8 medium | 1% | 2006-12-01 |
| CVE-2009-3001 EXP | The llc_ui_getname function in net/llc/af_llc.c in the Linux kernel 2.6.31-rc7 and earlier does not initialize a certain data structure, which allows… | Patch early | 4.9 medium | 1% | 2009-08-28 |
| CVE-2006-1481 EXP | SQL injection vulnerability in search.php in PHP Ticket 0.71 allows remote authenticated users to execute arbitrary SQL commands and obtain usernames… | Patch early | 6.5 medium | 1% | 2006-03-29 |
| CVE-2006-1269 EXP | Buffer overflow in the parse function in parse.c in zoo 2.10 might allow local users to execute arbitrary code via long filename command line argument… | Patch early | 6.2 medium | 1% | 2006-03-19 |
| CVE-1999-0400 EXP | Denial of service in Linux 2.2.0 running the ldd command on a core file. | Patch early | 4.6 medium | 1% | 1999-01-26 |
| CVE-2013-2852 EXP | Format string vulnerability in the b43_request_firmware function in drivers/net/wireless/b43/main.c in the Broadcom B43 wireless driver in the Linux k… | Patch early | 6.9 medium | 1% | 2013-06-07 |
| CVE-2005-4076 EXP | Buffer overflow in Appfluent Technology Database IDS 2.0 allows local users to execute arbitrary code via a long APPFLUENT_HOME environment variable. | Patch early | 4.6 medium | 1% | 2005-12-08 |
| CVE-2010-1611 EXP | Cross-site request forgery (CSRF) vulnerability in AlegroCart 1.1 allows remote attackers to hijack the authentication of the administrator for reques… | Patch early | 6.8 medium | 1% | 2010-04-29 |
| CVE-2012-3375 EXP | The epoll_ctl system call in fs/eventpoll.c in the Linux kernel before 3.2.24 does not properly handle ELOOP errors in EPOLL_CTL_ADD operations, which… | Patch early | 4.9 medium | 1% | 2012-10-03 |
| CVE-2010-5236 EXP | Untrusted search path vulnerability in Roxio Easy Media Creator Home 9.0.136 allows local users to gain privileges via a Trojan horse homeutils9.dll f… | Patch early | 6.9 medium | 1% | 2012-09-07 |
| CVE-2007-4386 EXP | SQL injection vulnerability in search.php in GetMyOwnArcade allows remote attackers to execute arbitrary SQL commands via the query parameter. | Patch early | 6.0 medium | 1% | 2007-08-17 |
| CVE-2013-1828 EXP | The sctp_getsockopt_assoc_stats function in net/sctp/socket.c in the Linux kernel before 3.8.4 does not validate a size value before proceeding to a c… | Patch early | 6.9 medium | 1% | 2013-03-22 |
| CVE-2005-0475 EXP | SQL injection vulnerability in paFAQ Beta4, and possibly other versions, allows remote attackers to execute arbitrary SQL code via the (1) offset, (2)… | Patch early | 6.4 medium | 1% | 2005-03-30 |
| CVE-2005-3358 EXP | Linux kernel before 2.6.15 allows local users to cause a denial of service (panic) via a set_mempolicy call with a 0 bitmask, which causes a panic whe… | Patch early | 4.9 medium | 1% | 2005-12-14 |
| CVE-2007-6359 EXP | The cs_validate_page function in bsd/kern/ubc_subr.c in the xnu kernel 1228.0 and earlier in Apple Mac OS X 10.5.1 allows local users to cause a denia… | Patch early | 4.9 medium | 1% | 2007-12-15 |
| CVE-2012-0045 EXP | The em_syscall function in arch/x86/kvm/emulate.c in the KVM implementation in the Linux kernel before 3.2.14 does not properly handle the 0f05 (aka s… | Patch early | 4.7 medium | 1% | 2012-07-03 |
| CVE-2005-4262 EXP | Cross-site scripting (XSS) vulnerability in the News module in Envolution allows remote attackers to inject arbitrary web script or HTML via the (1) s… | Patch early | 4.3 medium | 1% | 2005-12-15 |
| CVE-2014-0621 EXP | Multiple cross-site request forgery (CSRF) vulnerabilities in Technicolor (formerly Thomson) TC7200 STD6.01.12 allow remote attackers to hijack the au… | Patch early | 6.8 medium | 1% | 2014-01-08 |
| CVE-2006-5446 EXP | SQL injection vulnerability in lobby/config.php in Casinosoft Casino Script (aka Masvet) 3.2 allows remote attackers to execute arbitrary SQL commands… | Patch early | 5.1 medium | 1% | 2006-10-23 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt