CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
405,413 CVEs
1,739 on KEV
17,301 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-13
10,149 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2008-1295 EXP | SQL injection vulnerability in archives.php in Gregory Kokanosky (aka Greg's Place) phpMyNewsletter 0.8 beta 5 and earlier allows remote attackers to… | Patch early | 6.8 medium | 0.9% | 2008-03-12 |
| CVE-2008-4145 EXP | SQL injection vulnerability in user_read_links.php in Addalink 1.0 beta 4 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to e… | Patch early | 6.8 medium | 0.9% | 2008-09-24 |
| CVE-2009-2847 EXP | The do_sigaltstack function in kernel/signal.c in Linux kernel 2.4 through 2.4.37 and 2.6 before 2.6.31-rc5, when running on 64-bit systems, does not… | Patch early | 4.9 medium | 0.9% | 2009-08-18 |
| CVE-2008-4156 EXP | SQL injection vulnerability in print.php in CustomCms (CCMS) Gaming Portal 4.0, when magic_quotes_gpc is disabled, allows remote attackers to execute… | Patch early | 6.8 medium | 0.9% | 2008-09-19 |
| CVE-2008-4760 EXP | SQL injection vulnerability in lecture.php in Graphiks MyForum 1.3, when register_globals is enabled, allows remote attackers to execute arbitrary SQL… | Patch early | 6.8 medium | 0.9% | 2008-10-28 |
| CVE-2008-6605 EXP | Cross-site request forgery (CSRF) vulnerability in the xslt script in the web-based management interface on the 2wire 1701HG, 1800HW, 2071HG, and 2700… | Patch early | 6.8 medium | 0.9% | 2009-04-06 |
| CVE-2008-2919 EXP | SQL injection vulnerability in listing.php in Gryphon gllcTS2 4.2.4 allows remote attackers to execute arbitrary SQL commands via the sort parameter. | Patch early | 6.8 medium | 0.9% | 2008-06-30 |
| CVE-2009-0295 EXP | SQL injection vulnerability in index.php in Information Technology Light Poll Information (ITLPoll) 2.7 Stable 2, when magic_quotes_gpc is disabled, a… | Patch early | 6.8 medium | 0.9% | 2009-01-27 |
| CVE-2009-1317 EXP | Multiple SQL injection vulnerabilities in Aqua CMS 1.1, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands vi… | Patch early | 6.8 medium | 0.9% | 2009-04-17 |
| CVE-2009-1404 EXP | SQL injection vulnerability in admin.php in PastelCMS 0.8.0, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL comma… | Patch early | 6.8 medium | 0.9% | 2009-04-24 |
| CVE-2009-1453 EXP | SQL injection vulnerability in class.eport.php in Tiny Blogr 1.0.0 rc4, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrar… | Patch early | 6.8 medium | 0.9% | 2009-04-28 |
| CVE-2007-4085 EXP | Multiple SQL injection vulnerabilities in AlstraSoft AskMe Pro allow remote attackers to execute arbitrary SQL commands via the (1) que_id parameter t… | Patch early | 6.8 medium | 0.9% | 2007-07-30 |
| CVE-2009-3661 EXP | Multiple SQL injection vulnerabilities in the DJ-Catalog (com_djcatalog) component for Joomla! allow remote attackers to execute arbitrary SQL command… | Patch early | 6.8 medium | 0.9% | 2009-10-11 |
| CVE-2001-0526 EXP | Buffer overflow in the Xview library as used by mailtool in Solaris 8 and earlier allows a local attacker to gain privileges via the OPENWINHOME envir… | Patch early | 4.6 medium | 0.9% | 2001-08-14 |
| CVE-2006-3693 EXP | Rocks Clusters 4.1 and earlier allows local users to gain privileges via commands enclosed with escaped backticks (\`) in an argument to the (1) mount… | Patch early | 4.6 medium | 0.9% | 2006-07-21 |
| CVE-2024-57708 EXP | An issue in OneTrust SDK v.6.33.0 allows a local attacker to cause a denial of service via the Object.setPrototypeOf, __proto__, and Object.assign com… | Patch early | 5.7 medium | 0.9% | 2025-06-25 |
| CVE-2006-7051 EXP | The sys_timer_create function in posix-timers.c for Linux kernel 2.6.x allows local users to cause a denial of service (memory consumption) and possib… | Patch early | 4.9 medium | 0.9% | 2007-02-24 |
| CVE-2008-3582 EXP | SQL injection vulnerability in login.php in Keld PHP-MySQL News Script 0.7.1 allows remote attackers to execute arbitrary SQL commands via the usernam… | Patch early | 6.8 medium | 0.9% | 2008-08-10 |
| CVE-2009-0883 EXP | SQL injection vulnerability in Blue Eye CMS 1.0.0 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL com… | Patch early | 6.8 medium | 0.9% | 2009-03-12 |
| CVE-2009-1259 EXP | SQL injection vulnerability in inc/bb/topic.php in Insane Visions AdaptBB 1.0, when magic_quotes_gpc is disabled, allows remote attackers to execute a… | Patch early | 6.8 medium | 0.9% | 2009-04-07 |
| CVE-2009-1500 EXP | SQL injection vulnerability in index.php in ProjectCMS 1.0 Beta allows remote attackers to execute arbitrary SQL commands via the sn parameter. | Patch early | 6.8 medium | 0.9% | 2009-05-01 |
| CVE-2009-1799 EXP | Multiple SQL injection vulnerabilities in the getGalleryImage function in st_admin/gallery_output.php in ST-Gallery 0.1 alpha, when magic_quotes_gpc i… | Patch early | 6.8 medium | 0.9% | 2009-05-28 |
| CVE-2024-39143 EXP | A stored cross-site scripting (XSS) vulnerability exists in ResidenceCMS 2.10.1 that allows a low-privilege user to create malicious property content… | Patch early | 5.4 medium | 0.9% | 2024-07-02 |
| CVE-2025-51401 EXP | A stored cross-site scripting (XSS) vulnerability in the chat transfer function of Live Helper Chat v4.60 allows attackers to execute arbitrary web sc… | Patch early | 5.4 medium | 0.9% | 2025-07-21 |
| CVE-2025-51400 EXP | A stored cross-site scripting (XSS) vulnerability in the Personal Canned Messages of Live Helper Chat v4.60 allows attackers to execute arbitrary web… | Patch early | 5.4 medium | 0.9% | 2025-07-21 |
| CVE-2025-51398 EXP | A stored cross-site scripting (XSS) vulnerability in the Facebook registration page of Live Helper Chat v4.60 allows attackers to execute arbitrary we… | Patch early | 5.4 medium | 0.9% | 2025-07-21 |
| CVE-2015-7110 EXP | The Disk Images component in Apple OS X before 10.11.2 and tvOS before 9.1 allows local users to gain privileges or cause a denial of service (memory… | Patch early | 6.9 medium | 0.9% | 2015-12-11 |
| CVE-2008-6789 EXP | SQL injection vulnerability in MindDezign Photo Gallery 2.2 allows remote attackers to execute arbitrary SQL commands via the username parameter in a… | Patch early | 5.1 medium | 0.9% | 2009-05-04 |
| CVE-2013-3963 EXP | Cross-site request forgery (CSRF) vulnerability in goform/usermanage in Grandstream GXV3501, GXV3504, GXV3601, GXV3601HD/LL, GXV3611HD/LL, GXV3615W/P,… | Patch early | 6.8 medium | 0.9% | 2013-10-01 |
| CVE-2003-1473 EXP | Buffer overflow in LTris 1.0.1 of FreeBSD Ports Collection 2003-02-25 and earlier allows local users to execute arbitrary code with gid "games" permis… | Patch early | 4.6 medium | 0.9% | 2003-12-31 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt