CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
407,357 CVEs
1,740 on KEV
17,302 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-13
10,149 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2009-0384 EXP | SQL injection vulnerability in autor.php in OwnRS CMS 1.2 allows remote attackers to execute arbitrary SQL commands via the id parameter. | Patch early | 6.8 medium | 0.9% | 2009-02-02 |
| CVE-2009-2154 EXP | SQL injection vulnerability in admin/login.php in Impleo Music Collection 2.0, when magic_quotes_gpc is disabled, allows remote attackers to execute a… | Patch early | 6.8 medium | 0.9% | 2009-06-22 |
| CVE-2012-5382 EXP | Untrusted search path vulnerability in the installation functionality in Zend Server 5.6.0 SP4, when installed in the top-level C:\ directory, might a… | Patch early | 6.0 medium | 0.9% | 2012-10-11 |
| CVE-2006-2316 EXP | S24EvMon.exe in the Intel PROset/Wireless software, possibly 10.1.0.33, uses a S24EventManagerSharedMemory shared memory section with weak permissions… | Patch early | 4.9 medium | 0.9% | 2006-05-12 |
| CVE-1999-0491 EXP | The prompt parsing in bash allows a local user to execute commands as another user by creating a directory with the name of the command to execute. | Patch early | 4.6 medium | 0.9% | 1999-04-20 |
| CVE-2003-0265 EXP | Race condition in SDBINST for SAP database 7.3.0.29 creates critical files with world-writable permissions before initializing the setuid bits, which… | Patch early | 6.2 medium | 0.9% | 2003-05-27 |
| CVE-2024-11956 EXP | A vulnerability, which was classified as critical, has been found in Pimcore customer-data-framework up to 4.2.0. Affected by this issue is some unkno… | Patch early | 4.7 medium | 0.9% | 2025-01-28 |
| CVE-2011-0642 EXP | Cross-site request forgery (CSRF) vulnerability in news/admin.php in N-13 News 3.4, 3.7, and 4.0 allows remote attackers to hijack the authentication… | Patch early | 4.3 medium | 0.9% | 2011-01-25 |
| CVE-2010-1457 EXP | Tools/gdomap.c in gdomap in GNUstep Base before 1.20.0 allows local users to read arbitrary files via a (1) -c or (2) -a option, which prints file con… | Patch early | 4.9 medium | 0.9% | 2010-05-12 |
| CVE-2011-4613 EXP | The X.Org X wrapper (xserver-wrapper.c) in Debian GNU/Linux and Ubuntu Linux does not properly verify the TTY of a user who is starting X, which allow… | Patch early | 4.6 medium | 0.9% | 2014-02-05 |
| CVE-2006-5701 EXP | Double free vulnerability in squashfs module in the Linux kernel 2.6.x, as used in Fedora Core 5 and possibly other distributions, allows local users… | Patch early | 4.9 medium | 0.9% | 2006-11-03 |
| CVE-2007-4305 EXP | Multiple race conditions in the (1) Sudo monitor mode and (2) Sysjail policies in Systrace on NetBSD and OpenBSD allow local users to defeat system ca… | Patch early | 6.2 medium | 0.9% | 2007-08-13 |
| CVE-2002-1414 EXP | Buffer overflow in qmailadmin allows local users to gain privileges via a long QMAILADMIN_TEMPLATEDIR environment variable. | Patch early | 4.6 medium | 0.9% | 2003-04-11 |
| CVE-2012-5375 EXP | The CRC32C feature in the Btrfs implementation in the Linux kernel before 3.8-rc1 allows local users to cause a denial of service (prevention of file… | Patch early | 4.0 medium | 0.9% | 2013-02-18 |
| CVE-2010-0461 EXP | SQL injection vulnerability in the casino (com_casino) component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id… | Patch early | 6.5 medium | 0.9% | 2010-01-28 |
| CVE-2000-0214 EXP | FTP Explorer uses weak encryption for storing the username, password, and profile of FTP sites. | Patch early | 4.6 medium | 0.9% | 2000-02-24 |
| CVE-2008-0911 EXP | SQL injection vulnerability in productdetails.php in iScripts MultiCart 2.0 allows remote authenticated users to execute arbitrary SQL commands via th… | Patch early | 6.5 medium | 0.9% | 2008-02-22 |
| CVE-2008-1874 EXP | SQL injection vulnerability in account/user/mail.html in Xpoze Pro 3.05 and earlier allows remote authenticated users to execute arbitrary SQL command… | Patch early | 6.5 medium | 0.9% | 2008-04-17 |
| CVE-2008-2901 EXP | Multiple SQL injection vulnerabilities in Haudenschilt Family Connections CMS (FCMS) 1.4 allow remote authenticated users to execute arbitrary SQL com… | Patch early | 6.5 medium | 0.9% | 2008-06-30 |
| CVE-2008-6077 EXP | SQL injection vulnerability in loudblog/ajax.php in LoudBlog 0.8.0a and earlier allows remote authenticated users to execute arbitrary SQL commands vi… | Patch early | 6.5 medium | 0.9% | 2009-02-06 |
| CVE-2008-6156 EXP | SQL injection vulnerability in editCampaign.php in AdMan 1.1.20070907 allows remote authenticated users to execute arbitrary SQL commands via the camp… | Patch early | 6.5 medium | 0.9% | 2009-02-16 |
| CVE-2009-0593 EXP | SQL injection vulnerability in members.php in plx Auto Reminder 3.7 allows remote authenticated users to execute arbitrary SQL commands via the id par… | Patch early | 6.5 medium | 0.9% | 2009-02-16 |
| CVE-2007-4922 EXP | SQL injection vulnerability in play.php in the jeuxflash 1.0 module for KwsPHP allows remote authenticated users to execute arbitrary SQL commands via… | Patch early | 6.5 medium | 0.9% | 2007-09-17 |
| CVE-2001-0762 EXP | Buffer overflow in su-wrapper 1.1.1 allows local users to execute arbitrary code via a long first argument. | Patch early | 4.6 medium | 0.9% | 2001-10-18 |
| CVE-2008-5970 EXP | SQL injection vulnerability in profile_social.php in i-Net Solution Orkut Clone allows remote authenticated users to execute arbitrary SQL commands vi… | Patch early | 6.5 medium | 0.9% | 2009-01-27 |
| CVE-2009-3439 EXP | Multiple SQL injection vulnerabilities in Open Source Security Information Management (OSSIM) before 2.1.2 allow remote authenticated users to execute… | Patch early | 6.5 medium | 0.9% | 2009-09-28 |
| CVE-2009-3528 EXP | SQL injection vulnerability in Profile.php in MyMsg 1.0.3 allows remote authenticated users to execute arbitrary SQL commands via the uid parameter in… | Patch early | 6.5 medium | 0.9% | 2009-10-02 |
| CVE-2012-5381 EXP | Untrusted search path vulnerability in the installation functionality in PHP 5.3.17, when installed in the top-level C:\ directory, might allow local… | Patch early | 6.0 medium | 0.9% | 2012-10-11 |
| CVE-2008-6029 EXP | SQL injection vulnerability in search.php in BuzzyWall 1.3.1 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitr… | Patch early | 6.8 medium | 0.9% | 2009-02-03 |
| CVE-2008-6333 EXP | SQL injection vulnerability in news.php in RSS Simple News (RSSSN), when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQ… | Patch early | 6.8 medium | 0.9% | 2009-02-27 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt