CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
404,492 CVEs
1,739 on KEV
17,299 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-12
10,149 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2007-5408 EXP | SQL injection vulnerability in category.php in cpDynaLinks 1.02 allows remote attackers to execute arbitrary SQL commands via the category parameter. | Patch early | 6.8 medium | 1% | 2007-10-12 |
| CVE-2011-0643 EXP | Cross-site request forgery (CSRF) vulnerability in admin/conf_users_edit.php in PHP Link Directory (phpLD) 4.1.0 allows remote attackers to hijack the… | Patch early | 6.8 medium | 1% | 2011-01-25 |
| CVE-2025-51396 EXP | A stored cross-site scripting (XSS) vulnerability in Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a… | Patch early | 5.4 medium | 1% | 2025-07-21 |
| CVE-2006-4789 EXP | Buffer overflow in Open Movie Editor 0.0.20060901 allows local users to cause a denial of service (system crash) or execute arbitrary code via a long… | Patch early | 4.6 medium | 1% | 2006-09-14 |
| CVE-2013-3540 EXP | Cross-site request forgery (CSRF) vulnerability in cgi-bin/admin/usrgrp.cgi in AirLive POE2600HD, POE250HD, POE200HD, OD-325HD, OD-2025HD, OD-2060HD,… | Patch early | 6.8 medium | 1% | 2013-10-04 |
| CVE-2013-0161 EXP | Havalite CMS 1.1.7 has a stored XSS vulnerability | Patch early | 5.4 medium | 1% | 2020-01-29 |
| CVE-2025-69210 EXP | FacturaScripts is open-source enterprise resource planning and accounting software. Prior to version 2025.7, a stored cross-site scripting (XSS) vulne… | Patch early | 5.4 medium | 1% | 2025-12-30 |
| CVE-2007-5225 EXP | Integer signedness error in FIFO filesystems (named pipes) on Sun Solaris 8 through 10 allows local users to read the contents of unspecified memory l… | Patch early | 4.9 medium | 1% | 2007-10-05 |
| CVE-2000-0976 EXP | Buffer overflow in xlib in XFree 3.3.x possibly allows local users to execute arbitrary commands via a long DISPLAY environment variable or a -display… | Patch early | 4.6 medium | 1% | 2000-12-19 |
| CVE-2000-0901 EXP | Format string vulnerability in screen 3.9.5 and earlier allows local users to gain root privileges via format characters in the vbell_msg initializati… | Patch early | 4.6 medium | 1% | 2000-12-19 |
| CVE-2006-6741 EXP | Cross-site request forgery (CSRF) vulnerability in urlobox in MKPortal allows remote attackers to delete arbitrary messages as an administrator via a… | Patch early | 5.8 medium | 1% | 2006-12-26 |
| CVE-2020-6857 EXP | CarbonFTP v1.4 uses insecure proprietary password encryption with a hard-coded weak encryption key. The key for local FTP server passwords is hard-cod… | Patch early | 5.5 medium | 1% | 2020-01-21 |
| CVE-2009-0468 EXP | Multiple cross-site request forgery (CSRF) vulnerabilities in ajax.html in Profense Web Application Firewall 2.6.2 and 2.6.3 allow remote attackers to… | Patch early | 6.8 medium | 1% | 2009-02-10 |
| CVE-2009-4385 EXP | Multiple cross-site request forgery (CSRF) vulnerabilities in Scriptsez.net Ez Poll Hoster (EPH) allow remote attackers to (1) hijack the authenticati… | Patch early | 6.8 medium | 1% | 2009-12-22 |
| CVE-2018-15437 EXP | A vulnerability in the system scanning component of Cisco Immunet and Cisco Advanced Malware Protection (AMP) for Endpoints running on Microsoft Windo… | Patch early | 5.5 medium | 1% | 2018-11-08 |
| CVE-2008-6758 EXP | Cross-site request forgery (CSRF) vulnerability in cart_save.php in ViArt Shop (aka Shopping Cart) 3.5 allows remote attackers to hijack the authentic… | Patch early | 6.8 medium | 1% | 2009-04-28 |
| CVE-2009-0705 EXP | SQL injection vulnerability in news.php in PowerScripts PowerNews 2.5.4, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitra… | Patch early | 6.8 medium | 1% | 2009-02-23 |
| CVE-2009-4059 EXP | SQL injection vulnerability in the JoomClip (com_joomclip) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the cat… | Patch early | 6.8 medium | 1% | 2009-11-24 |
| CVE-2002-0658 EXP | OSSP mm library (libmm) before 1.2.0 allows the local Apache user to gain privileges via temporary files, possibly via a symbolic link attack. | Patch early | 6.2 medium | 1% | 2002-08-12 |
| CVE-2009-1347 EXP | Multiple SQL injection vulnerabilities in stats/index.php in chCounter 3.1.3 allow remote attackers to execute arbitrary SQL commands via (1) the logi… | Patch early | 6.8 medium | 1% | 2009-04-20 |
| CVE-2009-1613 EXP | Multiple SQL injection vulnerabilities in leap.php in Leap CMS 0.1.4, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary S… | Patch early | 6.8 medium | 1% | 2009-05-11 |
| CVE-2010-5044 EXP | SQL injection vulnerability in models/log.php in the Search Log (com_searchlog) component 3.1.0 for Joomla! allows remote authenticated users, with Pu… | Patch early | 6.0 medium | 1% | 2011-11-02 |
| CVE-2014-5455 EXP | Unquoted Windows search path vulnerability in the ptservice service prior to PrivateTunnel version 3.0 (Windows) and OpenVPN Connect version 3.1 (Wind… | Patch early | 5.3 medium | 1% | 2014-08-25 |
| CVE-2012-0957 EXP | The override_release function in kernel/sys.c in the Linux kernel before 3.4.16 allows local users to obtain sensitive information from kernel stack m… | Patch early | 4.9 medium | 1% | 2012-12-21 |
| CVE-2007-6667 EXP | SQL injection vulnerability in faq.php in MyPHP Forum 3.0 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.… | Patch early | 6.8 medium | 1% | 2008-01-04 |
| CVE-2008-3497 EXP | SQL injection vulnerability in pages.php in MyPHP CMS 0.3.1 allows remote attackers to execute arbitrary SQL commands via the pid parameter. | Patch early | 6.8 medium | 1% | 2008-08-06 |
| CVE-2012-1921 EXP | Cross-site request forgery (CSRF) vulnerability in goform/admin/formWlEncrypt in Sitecom WLM-2501 allows remote attackers to hijack the authentication… | Patch early | 6.8 medium | 1% | 2012-08-26 |
| CVE-2023-25187 EXP | An issue was discovered on NOKIA Airscale ASIKA Single RAN devices before 21B. Nokia Single RAN commissioning procedures do not change (factory-time i… | Patch early | 6.3 medium | 1% | 2023-06-16 |
| CVE-2009-2388 EXP | SQL injection vulnerability in admin/index.php in Opial 1.0 allows remote attackers to execute arbitrary SQL commands via the txtPassword parameter.… | Patch early | 6.8 medium | 1% | 2009-07-09 |
| CVE-2010-0711 EXP | Cross-site request forgery (CSRF) vulnerability in default.asp in ASPCode CMS 1.5.8, 2.0.0 Build 103, and possibly other versions, allows remote attac… | Patch early | 6.8 medium | 1% | 2010-02-25 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt