CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
405,070 CVEs
1,739 on KEV
17,301 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-13
25,091 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2014-1854 EXP | SQL injection vulnerability in library/clicktracker.php in the AdRotate Pro plugin 3.9 through 3.9.5 and AdRotate Free plugin 3.9 through 3.9.4 for Wo… | Patch early | 7.5 high | 5.7% | 2014-02-27 |
| CVE-2016-8366 EXP | Webvisit in Phoenix Contact ILC PLCs offers a password macro to protect HMI pages on the PLC against casual or coincidental opening of HMI pages by th… | Patch early | 7.3 high | 5.7% | 2018-04-05 |
| CVE-2000-1100 EXP | The default configuration for PostACI webmail system installs the /includes/global.inc configuration file within the web root, which allows remote att… | Patch early | 7.5 high | 5.7% | 2001-01-09 |
| CVE-2008-3296 EXP | Directory traversal vulnerability in modules/system/admin.php in XOOPS 2.0.18 1 allows remote attackers to include and execute arbitrary local files v… | Patch early | 7.5 high | 5.7% | 2008-07-25 |
| CVE-2006-5418 EXP | PHP remote file inclusion vulnerability in archive/archive_topic.php in pbpbb archive for search engines (SearchIndexer) (aka phpBBSEI) for phpBB allo… | Patch early | 6.8 medium | 5.7% | 2006-10-20 |
| CVE-2010-4647 EXP | Multiple cross-site scripting (XSS) vulnerabilities in the Help Contents web application (aka the Help Server) in Eclipse IDE before 3.6.2 allow remot… | Patch early | 4.3 medium | 5.7% | 2011-01-13 |
| CVE-2011-0502 EXP | Music Animation Machine MIDI Player 2006aug19 Release 035 and possibly other versions allows user-assisted remote attackers to cause a denial of servi… | Patch early | 9.3 high | 5.7% | 2011-01-20 |
| CVE-2004-2061 EXP | RiSearch 1.0.01 and RiSearch Pro 3.2.06 allows remote attackers to use the show.pl script as an open proxy, or read arbitrary local files, by setting… | Patch early | 9.8 critical | 5.7% | 2004-07-27 |
| CVE-2001-0491 EXP | Directory traversal vulnerability in RaidenFTPD Server 2.1 before build 952 allows attackers to access files outside the ftp root via dot dot attacks,… | Patch early | 5.0 medium | 5.7% | 2001-06-27 |
| CVE-2007-3845 EXP | Mozilla Firefox before 2.0.0.6, Thunderbird before 1.5.0.13 and 2.x before 2.0.0.6, and SeaMonkey before 1.1.4 allow remote attackers to execute arbit… | Patch early | 9.3 high | 5.7% | 2007-08-08 |
| CVE-2008-0239 EXP | Multiple cross-site scripting (XSS) vulnerabilities in Sun Java System Identity Manager 6.0 SP1 through SP3, 7.0, and 7.1 allow remote attackers to in… | Patch early | 4.3 medium | 5.7% | 2008-01-11 |
| CVE-2006-4074 EXP | PHP remote file inclusion vulnerability in lib/tpl/default/main.php in the JD-Wiki Component (com_jd-wiki) 1.0.2 and earlier for Joomla!, when registe… | Patch early | 6.8 medium | 5.7% | 2006-08-11 |
| CVE-2009-2112 EXP | Directory traversal vulnerability in include/page_bottom.php in phpFK 7.03 allows remote attackers to include and execute arbitrary local files via di… | Patch early | 7.5 high | 5.7% | 2009-06-18 |
| CVE-2009-2183 EXP | Directory traversal vulnerability in admin-files/ad.php in Campsite 3.3.0 RC1 allows remote attackers to read and possibly execute arbitrary local fil… | Patch early | 7.5 high | 5.7% | 2009-06-23 |
| CVE-2007-6558 EXP | TotalPlayer 3.0 allows user-assisted remote attackers to cause a denial of service (application crash) via a large .m3u file. NOTE: this might be a d… | Patch early | 4.3 medium | 5.7% | 2007-12-28 |
| CVE-2014-0871 EXP | RICOS in IBM Algo Credit Limits (aka ACLM) 4.5.0 through 4.7.0 before 4.7.0.03 FP5 in IBM Algorithmics allows remote attackers to obtain potentially s… | Patch early | 4.3 medium | 5.7% | 2014-07-07 |
| CVE-2008-1353 EXP | zabbix_agentd in ZABBIX 1.4.4 allows remote attackers to cause a denial of service (CPU and connection consumption) via multiple vfs.file.cksum comman… | Patch early | 4.3 medium | 5.7% | 2008-03-17 |
| CVE-2006-0663 EXP | Multiple cross-site scripting (XSS) vulnerabilities in Lotus Domino iNotes Client 6.5.4 and 7.0 allow remote attackers to inject arbitrary web script… | Patch early | 4.3 medium | 5.7% | 2006-02-13 |
| CVE-2022-37706 EXP | enlightenment_sys in Enlightenment before 0.25.4 allows local users to gain privileges because it is setuid root, and the system library function mish… | Patch early | 7.8 high | 5.7% | 2022-12-25 |
| CVE-2005-3489 EXP | Buffer overflow in Asus Video Security 3.5.0.0 and earlier, when using authorization, allows remote attackers to execute arbitrary code via a long use… | Patch early | 7.5 high | 5.7% | 2005-11-04 |
| CVE-2010-2920 EXP | Directory traversal vulnerability in the Foobla Suggestions (com_foobla_suggestions) component 1.5.1.2 for Joomla! allows remote attackers to read arb… | Patch early | 6.8 medium | 5.7% | 2010-07-30 |
| CVE-2006-7127 EXP | Multiple PHP remote file inclusion vulnerabilities in JAF CMS 4.0 and 4.0 RC2 allow remote attackers to execute arbitrary PHP code via a URL in the ma… | Patch early | 6.8 medium | 5.7% | 2007-03-06 |
| CVE-2004-2449 EXP | Roger Wilco 1.4.1.6 and earlier or Roger Wilco Base Station 0.30a and earlier allows remote attackers to cause a denial of service (application crash)… | Patch early | 5.0 medium | 5.7% | 2004-12-31 |
| CVE-2006-2814 EXP | Multiple buffer overflows in the (1) vGetPost and (2) main functions in easy-scart.c through easy-scart6.c in iShopCart allow remote attackers to exec… | Patch early | 7.5 high | 5.7% | 2006-06-05 |
| CVE-2014-6047 EXP | phpMyFAQ before 2.8.13 allows remote authenticated users with certain permissions to read arbitrary attachments by leveraging incorrect "download an a… | Patch early | 5.3 medium | 5.7% | 2018-08-28 |
| CVE-2014-6048 EXP | phpMyFAQ before 2.8.13 allows remote attackers to read arbitrary attachments via a direct request. | Patch early | 5.3 medium | 5.7% | 2018-08-28 |
| CVE-2016-4997 EXP | The compat IPT_SO_SET_REPLACE and IP6T_SO_SET_REPLACE setsockopt implementations in the netfilter subsystem in the Linux kernel before 4.6.3 allow loc… | Patch early | 7.8 high | 5.7% | 2016-07-03 |
| CVE-2008-2304 EXP | Buffer overflow in Apple Core Image Fun House 2.0 and earlier in CoreImage Examples in Xcode tools before 3.1 allows user-assisted attackers to execut… | Patch early | 6.8 medium | 5.7% | 2008-07-14 |
| CVE-2001-0187 EXP | Format string vulnerability in wu-ftp 2.6.1 and earlier, when running with debug mode enabled, allows remote attackers to execute arbitrary commands v… | Patch early | 10.0 high | 5.7% | 2001-03-26 |
| CVE-2002-0926 EXP | Directory traversal vulnerability in Wolfram Research webMathematica 1.0.0 and 1.0.0.1 allows remote attackers to read arbitrary files via a .. (dot d… | Patch early | 5.0 medium | 5.7% | 2002-10-04 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt