CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
405,610 CVEs
1,740 on KEV
17,302 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-13
10,149 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2008-5075 EXP | Multiple SQL injection vulnerabilities in E-Uploader Pro 1.0 (aka Uploader PRO), when magic_quotes_gpc is disabled, allow remote attackers to execute… | Patch early | 6.8 medium | 0.9% | 2008-11-14 |
| CVE-2008-5267 EXP | SQL injection vulnerability in answer.php in Experts 1.0.0, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL comman… | Patch early | 6.8 medium | 0.9% | 2008-11-28 |
| CVE-2008-5628 EXP | SQL injection vulnerability in index.php in CMS little 0.0.1 allows remote attackers to execute arbitrary SQL commands via the term parameter. | Patch early | 6.8 medium | 0.9% | 2008-12-17 |
| CVE-2008-6091 EXP | SQL injection vulnerability in plugins.php in BMForum 5.6, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL command… | Patch early | 6.8 medium | 0.9% | 2009-02-09 |
| CVE-2008-6093 EXP | SQL injection vulnerability in index.php in Noname CMS 1.0, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL comman… | Patch early | 6.8 medium | 0.9% | 2009-02-09 |
| CVE-2008-6100 EXP | Multiple SQL injection vulnerabilities in Discussion Forums 2k 3.3, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL… | Patch early | 6.8 medium | 0.9% | 2009-02-10 |
| CVE-2008-7114 EXP | SQL injection vulnerability in members_search.php in iFusion Services iFdate 2.0.3 and earlier allows remote attackers to execute arbitrary SQL comman… | Patch early | 6.8 medium | 0.9% | 2009-08-28 |
| CVE-2012-5378 EXP | Untrusted search path vulnerability in the installation functionality in ActiveTcl 8.5.12, when installed in the top-level C:\ directory, allows local… | Patch early | 6.0 medium | 0.9% | 2012-10-11 |
| CVE-2007-0602 EXP | Buffer overflow in libvsapi.so in the VSAPI library in Trend Micro VirusWall 3.81 for Linux, as used by IScan.BASE/vscan, allows local users to gain p… | Patch early | 6.9 medium | 0.9% | 2007-01-30 |
| CVE-2008-1141 EXP | Memory leak in DLMFENC.sys 1.0.0.26 in DESlock+ 3.2.6 and earlier allows local users to cause a denial of service (kernel memory consumption) via a se… | Patch early | 4.9 medium | 0.9% | 2008-03-04 |
| CVE-1999-0026 EXP | root privileges via buffer overflow in pset command on SGI IRIX systems. | Patch early | 4.6 medium | 0.9% | 1997-07-16 |
| CVE-2009-2883 EXP | SQL injection vulnerability in admin/login.php in SaphpLesson 4.0, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL… | Patch early | 6.8 medium | 0.9% | 2009-08-20 |
| CVE-2009-4540 EXP | SQL injection vulnerability in page.php in Mini CMS 1.0.1 allows remote attackers to execute arbitrary SQL commands via the id parameter. | Patch early | 6.8 medium | 0.9% | 2010-01-04 |
| CVE-2010-2015 EXP | Multiple SQL injection vulnerabilities in LiSK CMS 4.4 allow remote attackers to execute arbitrary SQL commands via (1) the id parameter in a view_inb… | Patch early | 6.8 medium | 0.9% | 2010-05-24 |
| CVE-2010-3482 EXP | Multiple SQL injection vulnerabilities in cms_write.php in Primitive CMS 1.0.9 allow remote authenticated administrators to execute arbitrary SQL comm… | Patch early | 6.5 medium | 0.9% | 2010-09-22 |
| CVE-2009-2010 EXP | Multiple SQL injection vulnerabilities in Haudenschilt Family Connections CMS (FCMS) 1.9 and earlier allow remote authenticated users to execute arbit… | Patch early | 6.5 medium | 0.9% | 2009-06-08 |
| CVE-2006-2132 EXP | SQL injection vulnerability in detail.asp in DUclassified allows remote attackers to execute arbitrary SQL commands via the iPro parameter. NOTE: the… | Patch early | 6.4 medium | 0.9% | 2006-05-01 |
| CVE-2007-3103 EXP | The init.d script for the X.Org X11 xfs font server on various Linux distributions might allow local users to change the permissions of arbitrary file… | Patch early | 6.2 medium | 0.9% | 2007-07-15 |
| CVE-2010-4752 EXP | SQL injection vulnerability in LightNEasy.php in LightNEasy 3.2.1, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL… | Patch early | 6.8 medium | 0.9% | 2011-03-01 |
| CVE-2020-8793 EXP | OpenSMTPD before 6.6.4 allows local users to read arbitrary files (e.g., on some Linux distributions) because of a combination of an untrusted search… | Patch early | 4.7 medium | 0.9% | 2020-02-25 |
| CVE-2006-4655 EXP | Buffer overflow in the Strcmp function in the XKEYBOARD extension in X Window System X11R6.4 and earlier, as used in SCO UnixWare 7.1.3 and Sun Solari… | Patch early | 4.6 medium | 0.9% | 2006-09-09 |
| CVE-2003-0388 EXP | pam_wheel in Linux-PAM 0.78, with the trust option enabled and the use_uid option disabled, allows local users to spoof log entries and gain privilege… | Patch early | 4.6 medium | 0.9% | 2003-07-24 |
| CVE-2010-4834 EXP | Multiple SQL injection vulnerabilities in index.php in OneOrZero AIMS 2.6.0 Members Edition and 2.7.0 Trial Edition allow remote authenticated users t… | Patch early | 6.5 medium | 0.9% | 2011-09-14 |
| CVE-2026-54644 EXP | CubeCart is an ecommerce software solution. Prior to 6.7.5, the _errorMessage method in classes/gui.class.php uses strip_tags to permit anchor element… | Patch early | 6.1 medium | 0.9% | 2026-09-17 |
| CVE-2025-28121 EXP | code-projects Online Exam Mastering System 1.0 is vulnerable to Cross Site Scripting (XSS) in feedback.php via the "q" parameter allowing remote attac… | Patch early | 6.1 medium | 0.9% | 2025-04-21 |
| CVE-2007-3235 EXP | Cross-site scripting (XSS) vulnerability in low.php in Fuzzylime Forum 1.0 allows remote attackers to inject arbitrary web script or HTML via the topi… | Patch early | 4.3 medium | 0.9% | 2007-06-15 |
| CVE-2008-7017 EXP | Cross-site scripting (XSS) vulnerability in analyse.php in CAcert 20080921, and possibly other versions before 20080928, allows remote attackers to in… | Patch early | 4.3 medium | 0.9% | 2009-08-21 |
| CVE-2007-6393 EXP | SQL injection vulnerability in albums.php in Ace Image Hosting Script allows remote authenticated users to execute arbitrary SQL commands via the id p… | Patch early | 6.5 medium | 0.9% | 2007-12-17 |
| CVE-2009-3223 EXP | SQL injection vulnerability in ppc-add-keywords.php in Inout Adserver allows remote authenticated users to execute arbitrary SQL commands via the id p… | Patch early | 6.5 medium | 0.9% | 2009-09-16 |
| CVE-2025-52392 EXP | Soosyze CMS 2.0 allows brute-force login attacks via the /user/login endpoint due to missing rate-limiting and lockout mechanisms. An attacker can rep… | Patch early | 5.4 medium | 0.9% | 2025-08-13 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt