CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
405,505 CVEs
1,739 on KEV
17,301 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-13
10,149 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2009-4365 EXP | Multiple cross-site request forgery (CSRF) vulnerabilities in admin.php in ScriptsEz Ez Blog 1.0 allow remote attackers to hijack the authentication o… | Patch early | 4.3 medium | 0.9% | 2009-12-21 |
| CVE-2008-1871 EXP | SQL injection vulnerability in links.php in Scriptsagent.com Links Directory 1.1 allows remote authenticated users to execute arbitrary SQL commands v… | Patch early | 6.5 medium | 0.9% | 2008-04-17 |
| CVE-2011-1020 EXP | The proc filesystem implementation in the Linux kernel 2.6.37 and earlier does not restrict access to the /proc directory tree of a process after this… | Patch early | 4.6 medium | 0.9% | 2011-02-28 |
| CVE-2005-1590 EXP | The Altiris Client Service for Windows (ACLIENT.EXE) 6.0.88 allows local users to disable password protection and access the administrative interface… | Patch early | 4.6 medium | 0.9% | 2005-05-16 |
| CVE-2014-5395 EXP | Multiple cross-site request forgery (CSRF) vulnerabilities in Huawei HiLink E3276 and E3236 TCPU before V200R002B470D13SP00C00 and WebUI before V100R0… | Patch early | 6.8 medium | 0.9% | 2014-11-21 |
| CVE-2011-5135 EXP | Multiple SQL injection vulnerabilities in the save_connection function in lib/lib.iotask.php in the iotask module in DoceboLMS 4.0.4 and earlier allow… | Patch early | 6.0 medium | 0.9% | 2012-08-30 |
| CVE-2011-2918 EXP | The Performance Events subsystem in the Linux kernel before 3.1 does not properly handle event overflows associated with PERF_COUNT_SW_CPU_CLOCK event… | Patch early | 5.5 medium | 0.9% | 2012-05-24 |
| CVE-2010-4638 EXP | SQL injection vulnerability in the submitSurvey function in controller.php in JQuarks4s (com_jquarks4s) component 1.0.0 for Joomla!, when magic_quotes… | Patch early | 6.8 medium | 0.9% | 2010-12-30 |
| CVE-2012-3873 EXP | Multiple SQL injection vulnerabilities in Open Constructor 3.12.0 allow remote authenticated users to execute arbitrary SQL commands via the id parame… | Patch early | 6.5 medium | 0.9% | 2012-12-28 |
| CVE-2008-6788 EXP | SQL injection vulnerability in MindDezign Photo Gallery 2.2, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL comma… | Patch early | 5.1 medium | 0.9% | 2009-05-04 |
| CVE-2007-1899 EXP | Multiple SQL injection vulnerabilities in myWebland myBloggie 2.1.6 allow remote attackers to execute arbitrary SQL commands via (1) the user_id param… | Patch early | 5.1 medium | 0.9% | 2008-07-09 |
| CVE-2008-5859 EXP | SQL injection vulnerability in index.php in Constructr CMS 3.02.5 and earlier, when register_globals is enabled and magic_quotes_gpc is disabled, allo… | Patch early | 5.1 medium | 0.9% | 2009-01-06 |
| CVE-2008-1559 EXP | SQL injection vulnerability in the Bernard Gilly AlphaContent (com_alphacontent) 2.5.8 component for Joomla! allows remote attackers to execute arbitr… | Patch early | 6.8 medium | 0.9% | 2008-03-31 |
| CVE-2008-2996 EXP | Multiple SQL injection vulnerabilities in index.php in Gravity Board X (GBX) 2.0 Beta, when magic_quotes_gpc is disabled, allow remote attackers to ex… | Patch early | 6.8 medium | 0.9% | 2008-07-03 |
| CVE-2025-10493 EXP | The Chained Quiz plugin for WordPress is vulnerable to Insecure Direct Object Reference in version 1.3.4 and below via the quiz submission and complet… | Patch early | 5.3 medium | 0.9% | 2025-09-18 |
| CVE-2010-1053 EXP | Multiple SQL injection vulnerabilities in Zen Time Tracking 2.2 and earlier, when magic_quotes_gpc is disabled, allow remote attackers to execute arbi… | Patch early | 6.8 medium | 0.9% | 2010-03-23 |
| CVE-2010-1604 EXP | Multiple SQL injection vulnerabilities in admin_login.php in NCT Jobs Portal Script allow remote attackers to execute arbitrary SQL commands via the (… | Patch early | 6.8 medium | 0.9% | 2010-04-29 |
| CVE-2010-2340 EXP | SQL injection vulnerability in members.php in Arab Portal 2.2, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL com… | Patch early | 6.8 medium | 0.9% | 2010-06-18 |
| CVE-2010-3467 EXP | SQL injection vulnerability in modules/sections/index.php in E-Xoopport Samsara 3.1 and earlier, when the Tutorial module is enabled, allows remote at… | Patch early | 6.8 medium | 0.9% | 2010-09-17 |
| CVE-2008-0147 EXP | SQL injection vulnerability in index.php in SmallNuke 2.0.4 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitra… | Patch early | 6.8 medium | 0.9% | 2008-01-09 |
| CVE-2008-0254 EXP | SQL injection vulnerability in activate.php in TutorialCMS (aka Photoshop Tutorials) 1.02, when magic_quotes_gpc is disabled, allows remote attackers… | Patch early | 6.8 medium | 0.9% | 2008-01-15 |
| CVE-2008-1316 EXP | SQL injection vulnerability in qtf_ind_search_ov.php in QT-cute QuickTalk Forum 1.6 and earlier allows remote attackers to execute arbitrary SQL comma… | Patch early | 6.8 medium | 0.9% | 2008-03-13 |
| CVE-2008-1404 EXP | SQL injection vulnerability in index.php in the Viso (Industry Book) 2.04 and 2.03 module for eXV2 allows remote attackers to execute arbitrary SQL co… | Patch early | 6.8 medium | 0.9% | 2008-03-20 |
| CVE-2008-1406 EXP | SQL injection vulnerability in annonces-p-f.php in the MyAnnonces 1.8 module for eXV2 allows remote attackers to execute arbitrary SQL commands via th… | Patch early | 6.8 medium | 0.9% | 2008-03-20 |
| CVE-2008-1407 EXP | SQL injection vulnerability in index.php in the WebChat 1.60 module for eXV2 allows remote attackers to execute arbitrary SQL commands via the roomid… | Patch early | 6.8 medium | 0.9% | 2008-03-20 |
| CVE-2008-1714 EXP | SQL injection vulnerability in show.php in FaScript FaPhoto 1.0, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL c… | Patch early | 6.8 medium | 0.9% | 2008-04-09 |
| CVE-2008-1715 EXP | SQL injection vulnerability in content/user.php in AuraCMS 2.2.1 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute ar… | Patch early | 6.8 medium | 0.9% | 2008-04-09 |
| CVE-2008-2129 EXP | SQL injection vulnerability in index.php in Galleristic 1.0, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL comma… | Patch early | 6.8 medium | 0.9% | 2008-05-09 |
| CVE-2008-2754 EXP | SQL injection vulnerability in toplists.php in eFiction 3.0 and 3.4.3, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary… | Patch early | 6.8 medium | 0.9% | 2008-06-18 |
| CVE-2008-2903 EXP | SQL injection vulnerability in news.php in Advanced Webhost Billing System (AWBS) 2.3.3 through 2.7.1, when magic_quotes_gpc is disabled, allows remot… | Patch early | 6.8 medium | 0.9% | 2008-06-30 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt