CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
407,162 CVEs
1,740 on KEV
17,302 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-13
10,149 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2008-6330 EXP | SQL injection vulnerability in index.php in MyTopix 1.3.0 and earlier allows remote authenticated users to execute arbitrary SQL commands via the send… | Patch early | 6.5 medium | 0.9% | 2009-02-27 |
| CVE-2006-2805 EXP | SQL injection vulnerability in VBulletin 3.0.10 allows remote attackers to execute arbitrary SQL commands via the featureid parameter. | Patch early | 5.0 medium | 0.9% | 2006-06-03 |
| CVE-2007-5060 EXP | Cross-site request forgery (CSRF) vulnerability in the cpass functionality in an admin action in index.php in XCMS allows remote attackers to change a… | Patch early | 4.3 medium | 0.9% | 2007-09-24 |
| CVE-2009-2579 EXP | SQL injection vulnerability in reward_points.post.php in the Reward points addon in CS-Cart before 2.0.6 allows remote authenticated users to execute… | Patch early | 6.5 medium | 0.9% | 2009-08-05 |
| CVE-2009-3052 EXP | SQL injection vulnerability in root/includes/prime_quick_style.php in the Prime Quick Style addon before 1.2.3 for phpBB 3 allows remote authenticated… | Patch early | 6.5 medium | 0.9% | 2009-09-03 |
| CVE-2006-7234 EXP | Untrusted search path vulnerability in Lynx before 2.8.6rel.4 allows local users to execute arbitrary code via malicious (1) .mailcap and (2) mime.typ… | Patch early | 4.6 medium | 0.9% | 2008-10-27 |
| CVE-2000-0545 EXP | Buffer overflow in mailx mail command (aka Mail) on Linux systems allows local users to gain privileges via a long -c (carbon copy) parameter. | Patch early | 4.6 medium | 0.9% | 2000-08-08 |
| CVE-2014-5207 EXP | fs/namespace.c in the Linux kernel through 3.16.1 does not properly restrict clearing MNT_NODEV, MNT_NOSUID, and MNT_NOEXEC and changing MNT_ATIME_MAS… | Patch early | 6.2 medium | 0.9% | 2014-08-18 |
| CVE-2007-2878 EXP | The VFAT compat ioctls in the Linux kernel before 2.6.21.2, when run on a 64-bit system, allow local users to corrupt a kernel_dirent struct and cause… | Patch early | 4.9 medium | 0.9% | 2007-05-29 |
| CVE-2007-6490 EXP | Cross-site request forgery (CSRF) vulnerability in Falcon Series One CMS 1.4.3 allows remote attackers to change a password via a certain changepass a… | Patch early | 4.3 medium | 0.9% | 2007-12-20 |
| CVE-2015-1305 EXP | McAfee Data Loss Prevention Endpoint (DLPe) before 9.3.400 allows local users to write to arbitrary memory locations, and consequently gain privileges… | Patch early | 6.9 medium | 0.9% | 2015-02-06 |
| CVE-2008-6851 EXP | SQL injection vulnerability in page.php in PHP Link Directory (phpLD) 3.3, when register_globals is enabled and magic_quotes_gpc is disabled, allows r… | Patch early | 5.1 medium | 0.9% | 2009-07-07 |
| CVE-2024-50859 EXP | The ip_import_acl_csv request in GestioIP v3.5.7 is vulnerable to Reflected XSS. When a user uploads an improperly formatted file, the content may be… | Patch early | 4.8 medium | 0.9% | 2025-01-14 |
| CVE-2006-1240 EXP | Buffer overflow in inet_server.cpp in (1) fb_inet_server and (2) fbserver in Firebird 1.5.2.4731 allows local users to gain privileges via a long valu… | Patch early | 4.6 medium | 0.9% | 2006-03-15 |
| CVE-2003-0579 EXP | uvadmsh in IBM U2 UniVerse 10.0.0.9 and earlier trusts the user-supplied -uv.install command line option to find and execute the uv.install program, w… | Patch early | 4.6 medium | 0.9% | 2003-08-18 |
| CVE-2008-3490 EXP | SQL injection vulnerability in members/mail.php in E-topbiz Online Dating 3 1.0 allows remote authenticated users to execute arbitrary SQL commands vi… | Patch early | 6.5 medium | 0.9% | 2008-08-06 |
| CVE-2009-1585 EXP | Multiple SQL injection vulnerabilities in TemaTres 1.031, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands… | Patch early | 4.4 medium | 0.9% | 2009-05-07 |
| CVE-2009-1038 EXP | Multiple SQL injection vulnerabilities in YAP Blog 1.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) image_id parameter to co… | Patch early | 6.5 medium | 0.9% | 2009-03-20 |
| CVE-2007-5773 EXP | Cross-site request forgery (CSRF) vulnerability in index.php in the File Manager module in Flatnuke 3 allows remote attackers to perform certain actio… | Patch early | 4.3 medium | 0.9% | 2007-11-01 |
| CVE-2010-4236 EXP | Untrusted search path vulnerability in estaskwrapper in IBM OmniFind Enterprise Edition before 9.1 allows local users to gain privileges via an ES_LIB… | Patch early | 6.9 medium | 0.9% | 2010-11-12 |
| CVE-2010-1093 EXP | SQL injection vulnerability in rss.php in 1024 CMS 2.1.1, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands… | Patch early | 6.8 medium | 0.9% | 2010-03-24 |
| CVE-2008-0937 EXP | SQL injection vulnerability in index.php in the Tiny Event (tinyevent) 1.01 module for XOOPS allows remote attackers to execute arbitrary SQL commands… | Patch early | 6.8 medium | 0.9% | 2008-02-25 |
| CVE-2008-5954 EXP | SQL injection vulnerability in KTP Computer Customer Database (KTPCCD) CMS, when magic_quotes_gpc is disabled, allows remote attackers to execute arbi… | Patch early | 6.8 medium | 0.9% | 2009-01-23 |
| CVE-2012-0997 EXP | Cross-site request forgery (CSRF) vulnerability in admin/index.php in 11in1 1.2.1 stable 12-31-2011 allows remote attackers to hijack the authenticati… | Patch early | 6.8 medium | 0.9% | 2012-02-24 |
| CVE-2014-3977 EXP | libodm.a in IBM AIX 6.1 and 7.1, and VIOS 2.2.x, allows local users to overwrite arbitrary files via a symlink attack on a temporary file. NOTE: this… | Patch early | 6.9 medium | 0.9% | 2014-06-08 |
| CVE-2009-1506 EXP | SQL injection vulnerability in classes/Xp.php in eLitius 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter to banner-… | Patch early | 6.8 medium | 0.9% | 2009-05-01 |
| CVE-2008-1138 EXP | DLMFENC.sys 1.0.0.26 in DESlock+ 3.2.6 and earlier allows local users to cause a denial of service (system crash) via a certain ZERO_MEM DLMFENC_IOCTL… | Patch early | 4.9 medium | 0.9% | 2008-03-04 |
| CVE-2007-5997 EXP | SQL injection vulnerability in campaign_stats.php in Softbiz Banner Exchange Network Script 1.0 allows remote authenticated users to execute arbitrary… | Patch early | 6.5 medium | 0.9% | 2007-11-15 |
| CVE-2007-5998 EXP | SQL injection vulnerability in ads.php in Softbiz Ad Management plus Script 1 allows remote authenticated users to execute arbitrary SQL commands via… | Patch early | 6.5 medium | 0.9% | 2007-11-15 |
| CVE-2010-2020 EXP | sys/nfsclient/nfs_vfsops.c in the NFS client in the kernel in FreeBSD 7.2 through 8.1-PRERELEASE, when vfs.usermount is enabled, does not validate the… | Patch early | 6.9 medium | 0.9% | 2010-05-28 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt