CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
404,449 CVEs
1,739 on KEV
17,299 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-12
10,149 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2012-3480 EXP | Multiple integer overflows in the (1) strtod, (2) strtof, (3) strtold, (4) strtod_l, and other unspecified "related functions" in stdlib in GNU C Libr… | Patch early | 4.6 medium | 1% | 2012-08-25 |
| CVE-2008-6729 EXP | Multiple cross-site request forgery (CSRF) vulnerabilities in password.php in PHPmotion 2.1 and earlier allow remote attackers to hijack the authentic… | Patch early | 6.8 medium | 1% | 2009-04-20 |
| CVE-2024-36424 EXP | K7RKScan.sys in K7 Ultimate Security before 17.0.2019 allows local users to cause a denial of service (BSOD) because of a NULL pointer dereference. | Patch early | 5.5 medium | 1% | 2024-08-06 |
| CVE-2005-2709 EXP | The sysctl functionality (sysctl.c) in Linux kernel before 2.6.14.1 allows local users to cause a denial of service (kernel oops) and possibly execute… | Patch early | 4.6 medium | 1% | 2005-11-20 |
| CVE-2011-5074 EXP | Multiple cross-site request forgery (CSRF) vulnerabilities in Support Incident Tracker (aka SiT!) before 3.65 allow remote attackers to hijack the aut… | Patch early | 6.8 medium | 1% | 2012-01-29 |
| CVE-2013-1651 EXP | OXUpdater in Open-Xchange Server before 6.20.7 rev14, 6.22.0 before rev13, and 6.22.1 before rev14 does not verify X.509 certificates from SSL servers… | Patch early | 5.8 medium | 1% | 2013-09-05 |
| CVE-2012-1220 EXP | Cross-site request forgery (CSRF) vulnerability in modules/config/admin_utente.php in GAzie 5.20 and earlier allows remote attackers to hijack the aut… | Patch early | 6.8 medium | 1% | 2012-02-21 |
| CVE-2007-6087 EXP | Cross-site request forgery (CSRF) vulnerability in index.php in VigileCMS 1.4 allows remote attackers to change the admin password via certain paramet… | Patch early | 6.8 medium | 1% | 2007-11-22 |
| CVE-2009-3621 EXP | net/unix/af_unix.c in the Linux kernel 2.6.31.4 and earlier allows local users to cause a denial of service (system hang) by creating an abstract-name… | Patch early | 5.5 medium | 1% | 2009-10-22 |
| CVE-2003-0848 EXP | Heap-based buffer overflow in main.c of slocate 2.6, and possibly other versions, may allow local users to gain privileges via a modified slocate data… | Patch early | 4.6 medium | 1% | 2003-11-17 |
| CVE-2006-3824 EXP | systeminfo.c for Sun Solaris allows local users to read kernel memory via a 0 variable count argument to the sysinfo system call, which causes a -1 ar… | Patch early | 4.9 medium | 1% | 2006-07-25 |
| CVE-2005-1707 EXP | The fn_show_postinst function in Gentoo webapp-config before 1.10-r14 allows local users to overwrite arbitrary files via a symlink attack on the post… | Patch early | 4.6 medium | 1% | 2005-05-24 |
| CVE-2009-1290 EXP | Multiple cross-site request forgery (CSRF) vulnerabilities in the web administration interface in the Advanced Management Module (AMM) on the IBM Blad… | Patch early | 6.8 medium | 1% | 2009-04-13 |
| CVE-2008-5568 EXP | Cross-site request forgery (CSRF) vulnerability in admin/settings.php in IPN Pro 3 1.44 and earlier allows remote attackers to change the admin passwo… | Patch early | 6.8 medium | 1% | 2008-12-15 |
| CVE-2009-2735 EXP | SQL injection vulnerability in admin.php in sun-jester OpenNews 1.0, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary S… | Patch early | 6.8 medium | 1% | 2009-08-11 |
| CVE-2009-1913 EXP | SQL injection vulnerability in manager.php in LuxBum 0.5.5, when magic_quotes_gpc is disabled and dotclear authentication is used, allows remote attac… | Patch early | 5.1 medium | 1% | 2009-06-04 |
| CVE-2006-4866 EXP | Buffer overflow in kextload in Apple OS X, as used by TDIXSupport in Roxio Toast Titanium and possibly other products, allows local users to execute a… | Patch early | 4.6 medium | 1% | 2006-09-19 |
| CVE-2010-5227 EXP | Untrusted search path vulnerability in Opera before 10.62 allows local users to gain privileges via a Trojan horse dwmapi.dll file in the current work… | Patch early | 6.9 medium | 1% | 2012-09-07 |
| CVE-2008-0397 EXP | Multiple SQL injection vulnerabilities in aflog 1.01, and possibly earlier versions, allow remote attackers to execute arbitrary SQL commands via (1)… | Patch early | 6.8 medium | 1% | 2008-01-23 |
| CVE-2008-2180 EXP | Multiple SQL injection vulnerabilities in cpLinks 1.03, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands vi… | Patch early | 6.8 medium | 1% | 2008-05-13 |
| CVE-2008-4084 EXP | SQL injection vulnerability in staticpages/easyclassifields/index.php in MyioSoft EasyClassifields 3.0 allows remote attackers to execute arbitrary SQ… | Patch early | 6.8 medium | 1% | 2008-09-15 |
| CVE-2008-4674 EXP | SQL injection vulnerability in realestate-index.php in Conkurent Real Estate Manager 1.01 allows remote attackers to execute arbitrary SQL commands vi… | Patch early | 6.8 medium | 1% | 2008-10-22 |
| CVE-2008-4700 EXP | SQL injection vulnerability in admin.php in Libera CMS 1.12 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitra… | Patch early | 6.8 medium | 1% | 2008-10-22 |
| CVE-2008-4877 EXP | SQL injection vulnerability in admin.php in WebCards 1.3, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands… | Patch early | 6.8 medium | 1% | 2008-11-01 |
| CVE-2008-5123 EXP | SQL injection vulnerability in admin.php in CCleague Pro 1.2 allows remote attackers to execute arbitrary SQL commands via the u parameter. | Patch early | 6.8 medium | 1% | 2008-11-18 |
| CVE-2008-6274 EXP | Multiple SQL injection vulnerabilities in index.php in FamilyProject 2.0 allow remote attackers to execute arbitrary SQL commands via (1) the logmbr p… | Patch early | 6.8 medium | 1% | 2009-02-25 |
| CVE-2008-5998 EXP | Multiple SQL injection vulnerabilities in the ajax_checklist_save function in the Ajax Checklist module 5.x before 5.x-1.1 for Drupal allow remote aut… | Patch early | 6.0 medium | 1% | 2009-01-28 |
| CVE-2006-5721 EXP | The \Device\SandBox driver in Outpost Firewall PRO 4.0 (964.582.059) allows local users to cause a denial of service (system crash) via an invalid arg… | Patch early | 4.9 medium | 1% | 2006-11-04 |
| CVE-2006-6446 EXP | SQL injection vulnerability in index.php in iWare Professional 5.0.4, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary… | Patch early | 6.8 medium | 1% | 2006-12-10 |
| CVE-2000-1119 EXP | Buffer overflow in setsenv command in IBM AIX 4.3.x and earlier allows local users to execute arbitrary commands via a long "x=" argument. | Patch early | 4.6 medium | 1% | 2001-01-09 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt