CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
407,162 CVEs
1,740 on KEV
17,302 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-13
10,149 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2008-5731 EXP | The PGPwded device driver (aka PGPwded.sys) in PGP Corporation PGP Desktop 9.0.6 build 6060 and 9.9.0 build 397 allows local users to cause a denial o… | Patch early | 4.9 medium | 0.9% | 2008-12-26 |
| CVE-2014-8612 EXP | Multiple array index errors in the Stream Control Transmission Protocol (SCTP) module in FreeBSD 10.1 before p5, 10.0 before p17, 9.3 before p9, and 8… | Patch early | 4.6 medium | 0.9% | 2015-02-02 |
| CVE-2008-2521 EXP | SQL injection vulnerability in members.php in YABSoft Mega File Hosting Script (aka MFH or MFHS) 1.2 allows remote authenticated users to execute arbi… | Patch early | 6.5 medium | 0.9% | 2008-06-03 |
| CVE-2008-2562 EXP | SQL injection vulnerability in edCss.php in PowerPhlogger 2.2.5 and earlier allows remote authenticated users to execute arbitrary SQL commands via th… | Patch early | 6.5 medium | 0.9% | 2008-06-06 |
| CVE-2008-3035 EXP | SQL injection vulnerability in newThread.php in XchangeBoard 1.70 Final and earlier allows remote authenticated users to execute arbitrary SQL command… | Patch early | 6.5 medium | 0.9% | 2008-07-07 |
| CVE-2008-3718 EXP | Multiple SQL injection vulnerabilities in cyberBB 0.6 allow remote authenticated users to execute arbitrary SQL commands via the (1) id parameter to s… | Patch early | 6.5 medium | 0.9% | 2008-08-20 |
| CVE-2006-2409 EXP | Format string vulnerability in the raydium_log function in console.c in Raydium before SVN revision 310 allows local users to execute arbitrary code v… | Patch early | 4.6 medium | 0.9% | 2006-05-16 |
| CVE-2009-2598 EXP | Multiple SQL injection vulnerabilities in Online Grades & Attendance 3.2.6 and earlier allow (1) remote attackers to execute arbitrary SQL commands vi… | Patch early | 6.5 medium | 0.9% | 2009-07-27 |
| CVE-2010-5195 EXP | Untrusted search path vulnerability in Roxio MyDVD 9 allows local users to gain privileges via a Trojan horse HomeUtils9.dll file in the current worki… | Patch early | 6.9 medium | 0.9% | 2012-09-06 |
| CVE-2009-1436 EXP | The db interface in libc in FreeBSD 6.3, 6.4, 7.0, 7.1, and 7.2-PRERELEASE does not properly initialize memory for Berkeley DB 1.85 database structure… | Patch early | 4.9 medium | 0.9% | 2009-04-27 |
| CVE-2009-2129 EXP | Cross-site request forgery (CSRF) vulnerability in login.php in Elvin 1.2.0 allows remote attackers to hijack the authentication of arbitrary users vi… | Patch early | 6.8 medium | 0.9% | 2009-06-19 |
| CVE-2009-2150 EXP | Multiple cross-site request forgery (CSRF) vulnerabilities in Campus Virtual-LMS allow (1) remote attackers to hijack the authentication of arbitrary… | Patch early | 6.8 medium | 0.9% | 2009-06-22 |
| CVE-2024-9458 EXP | The Reservit Hotel WordPress plugin before 3.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin… | Patch early | 4.8 medium | 0.9% | 2025-03-07 |
| CVE-2003-0372 EXP | Signed integer vulnerability in libnasl in Nessus before 2.0.6 allows local users with plugin upload privileges to cause a denial of service (core dum… | Patch early | 4.6 medium | 0.9% | 2003-06-16 |
| CVE-2025-41228 EXP | VMware ESXi and vCenter Server contain a reflected cross-site scripting vulnerability due to improper input validation. A malicious actor with network… | Patch early | 4.3 medium | 0.9% | 2025-05-20 |
| CVE-2004-0158 EXP | Buffer overflow in lbreakout2 allows local users to gain 'games' group privileges via a large HOME environment variable to (1) editor.c, (2) theme.c,… | Patch early | 4.6 medium | 0.9% | 2004-03-29 |
| CVE-2009-1952 EXP | Multiple SQL injection vulnerabilities in the administrative login feature in PropertyMax Pro FREE 0.3, when magic_quotes_gpc is disabled, allow remot… | Patch early | 6.8 medium | 0.9% | 2009-06-05 |
| CVE-2009-4733 EXP | SQL injection vulnerability in checkuser.php in SimpleLoginSys 0.5, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQ… | Patch early | 6.8 medium | 0.9% | 2010-03-18 |
| CVE-2012-1058 EXP | Cross-site request forgery (CSRF) vulnerability in Flyspray 0.9.9.6 allows remote attackers to hijack the authentication of admins for requests that a… | Patch early | 6.0 medium | 0.9% | 2012-02-14 |
| CVE-2010-4249 EXP | The wait_for_unix_gc function in net/unix/garbage.c in the Linux kernel before 2.6.37-rc3-next-20101125 does not properly select times for garbage col… | Patch early | 4.9 medium | 0.9% | 2010-11-29 |
| CVE-2012-2236 EXP | SQL injection vulnerability in users.php in PHP Gift Registry 1.5.5 allows remote authenticated users to execute arbitrary SQL commands via the userid… | Patch early | 6.5 medium | 0.9% | 2012-04-20 |
| CVE-2009-3970 EXP | SQL injection vulnerability in index.php in PHP Dir Submit (aka WebsiteSubmitter or Submitter Script) allows remote authenticated users to execute arb… | Patch early | 6.5 medium | 0.9% | 2009-11-18 |
| CVE-2009-4198 EXP | SQL injection vulnerability in my_orders.php in MyMiniBill allows remote authenticated users to execute arbitrary SQL commands via the orderid paramet… | Patch early | 6.5 medium | 0.9% | 2009-12-04 |
| CVE-2009-4667 EXP | SQL injection vulnerability in form.php in WebMember 1.0 allows remote authenticated users to execute arbitrary SQL commands via the formID parameter. | Patch early | 6.5 medium | 0.9% | 2010-03-05 |
| CVE-2002-0211 EXP | Race condition in the installation script for Tarantella Enterprise 3 3.01 through 3.20 creates a world-writeable temporary "gunzip" program before ex… | Patch early | 6.2 medium | 0.9% | 2002-05-16 |
| CVE-2009-1810 EXP | Multiple SQL injection vulnerabilities in myColex 1.4.2 allow remote attackers to execute arbitrary SQL commands via (1) the formUser parameter (aka t… | Patch early | 6.0 medium | 0.9% | 2009-05-29 |
| CVE-2009-1812 EXP | Multiple SQL injection vulnerabilities in myGesuad 0.9.14 (aka 0.9) allow remote attackers to execute arbitrary SQL commands via (1) the formUser para… | Patch early | 6.0 medium | 0.9% | 2009-05-29 |
| CVE-2011-4122 EXP | Directory traversal vulnerability in openpam_configure.c in OpenPAM before r478 on FreeBSD 8.1 allows local users to load arbitrary DSOs and gain priv… | Patch early | 6.9 medium | 0.9% | 2011-11-17 |
| CVE-2006-6131 EXP | Untrusted search path vulnerability in (1) WSAdminServer and (2) WSWebServer in Kerio WebSTAR (4D WebSTAR Server Suite) 5.4.2 and earlier allows local… | Patch early | 6.2 medium | 0.9% | 2006-11-28 |
| CVE-2008-6777 EXP | Multiple SQL injection vulnerabilities in MyPHP Forum 3.0 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id paramete… | Patch early | 5.1 medium | 0.9% | 2009-05-01 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt