CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
407,366 CVEs
1,741 on KEV
17,302 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-14
10,149 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2024-51463 EXP | IBM i 7.3, 7.4, and 7.5 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests… | Patch early | 5.4 medium | 0.9% | 2024-12-21 |
| CVE-2008-6641 EXP | Multiple SQL injection vulnerabilities in Shader TV (Beta) allow remote authenticated administrators to execute arbitrary SQL commands via the sid par… | Patch early | 6.5 medium | 0.9% | 2009-04-07 |
| CVE-2009-3043 EXP | The tty_ldisc_hangup function in drivers/char/tty_ldisc.c in the Linux kernel 2.6.31-rc before 2.6.31-rc8 allows local users to cause a denial of serv… | Patch early | 4.9 medium | 0.9% | 2009-09-02 |
| CVE-2007-4004 EXP | Buffer overflow in the ftp client in IBM AIX 5.3 SP6 and 5.2.0 allows local users to execute arbitrary code via unspecified vectors that trigger the o… | Patch early | 6.9 medium | 0.9% | 2007-07-26 |
| CVE-2009-3330 EXP | SQL injection vulnerability in index.php in cP Creator 2.7.1, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL comm… | Patch early | 6.8 medium | 0.9% | 2009-09-23 |
| CVE-2009-3529 EXP | SQL injection vulnerability in index.php in RadScripts RadBids Gold 4 allows remote attackers to execute arbitrary SQL commands via the fid parameter… | Patch early | 6.8 medium | 0.9% | 2009-10-02 |
| CVE-2009-4561 EXP | Multiple SQL injection vulnerabilities in Admin/index.php in WebLeague 2.2.0, when magic_quotes_gpc is disabled, allow remote attackers to execute arb… | Patch early | 6.8 medium | 0.9% | 2010-01-04 |
| CVE-2008-0099 EXP | Multiple SQL injection vulnerabilities in MyPHP Forum 3.0 and earlier allow remote attackers to execute arbitrary SQL commands via the searchtext para… | Patch early | 6.8 medium | 0.9% | 2008-01-08 |
| CVE-2008-1513 EXP | SQL injection vulnerability in index.php in Danneo CMS 0.5.1 and earlier, when the Referers statistics option is enabled, allows remote attackers to e… | Patch early | 6.8 medium | 0.9% | 2008-03-25 |
| CVE-2009-2389 EXP | Multiple SQL injection vulnerabilities in newsscript.php in USOLVED NEWSolved 1.1.6, when magic_quotes_gpc is disabled, allow remote attackers to exec… | Patch early | 6.8 medium | 0.9% | 2009-07-09 |
| CVE-2009-1766 EXP | SQL injection vulnerability in index.php in LightOpenCMS 0.1 allows remote attackers to execute arbitrary SQL commands via the id parameter. | Patch early | 6.4 medium | 0.8% | 2009-05-22 |
| CVE-1999-0718 EXP | IBM GINA, when used for OS/2 domain authentication of Windows NT users, allows local users to gain administrator privileges by changing the GroupMappi… | Patch early | 6.2 medium | 0.8% | 2001-03-12 |
| CVE-2013-4889 EXP | Multiple cross-site request forgery (CSRF) vulnerabilities in index.php in Digital Signage Xibo 1.4.2 allow remote attackers to hijack the authenticat… | Patch early | 6.8 medium | 0.8% | 2014-01-29 |
| CVE-2008-0384 EXP | OpenBSD 4.2 allows local users to cause a denial of service (kernel panic) by calling the SIOCGIFRTLABEL IOCTL on an interface that does not have a ro… | Patch early | 4.9 medium | 0.8% | 2008-01-22 |
| CVE-2008-0142 EXP | Multiple SQL injection vulnerabilities in WebPortal CMS 0.6-beta allow remote attackers to execute arbitrary SQL commands via the user_name parameter… | Patch early | 6.8 medium | 0.8% | 2008-01-08 |
| CVE-2009-4564 EXP | SQL injection vulnerability in index.php in Zenphoto 1.2.5, when the ZenPage plugin is enabled, allows remote attackers to execute arbitrary SQL comma… | Patch early | 6.8 medium | 0.8% | 2010-01-04 |
| CVE-2010-4838 EXP | SQL injection vulnerability in the JSupport (com_jsupport) component 1.5.6 for Joomla! allows remote authenticated users, with Public Back-end permiss… | Patch early | 6.0 medium | 0.8% | 2011-09-14 |
| CVE-2010-5043 EXP | SQL injection vulnerability in the DJ-ArtGallery (com_djartgallery) component 0.9.1 for Joomla! allows remote authenticated users to execute arbitrary… | Patch early | 6.0 medium | 0.8% | 2011-11-02 |
| CVE-2015-7898 EXP | Samsung Gallery in the Samsung Galaxy S6 allows local users to cause a denial of service (process crash). | Patch early | 5.5 medium | 0.8% | 2017-06-27 |
| CVE-1999-1120 EXP | netprint in SGI IRIX 6.4 and earlier trusts the PATH environmental variable for finding and executing the disable program, which allows local users to… | Patch early | 4.6 medium | 0.8% | 1997-01-04 |
| CVE-2000-0468 EXP | man in HP-UX 10.20 and 11 allows local attackers to overwrite files via a symlink attack. | Patch early | 4.6 medium | 0.8% | 2000-06-02 |
| CVE-2024-7801 EXP | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Microchip TimeProvider 4100 (Data plot modules)… | Patch early | 6.5 medium | 0.8% | 2024-10-04 |
| CVE-2008-2827 EXP | The rmtree function in lib/File/Path.pm in Perl 5.10 does not properly check permissions before performing a chmod, which allows local users to modify… | Patch early | 4.6 medium | 0.8% | 2008-06-23 |
| CVE-2008-0270 EXP | SQL injection vulnerability in index.php in TaskFreak! 0.6.1 and earlier allows remote authenticated users to execute arbitrary SQL commands via the s… | Patch early | 6.0 medium | 0.8% | 2008-01-15 |
| CVE-2007-2027 EXP | Untrusted search path vulnerability in the add_filename_to_string function in intl/gettext/loadmsgcat.c for Elinks 0.11.1 allows local users to cause… | Patch early | 4.4 medium | 0.8% | 2007-04-13 |
| CVE-2010-0105 EXP | The hfs implementation in Apple Mac OS X 10.5.8 and 10.6.x before 10.6.5 supports hard links to directories and does not prevent certain deeply nested… | Patch early | 4.9 medium | 0.8% | 2010-04-27 |
| CVE-2013-0722 EXP | Stack-based buffer overflow in the scan_load_hosts function in ec_scan.c in Ettercap 0.7.5.1 and earlier might allow local users to gain privileges vi… | Patch early | 4.4 medium | 0.8% | 2013-01-11 |
| CVE-2009-3514 EXP | Multiple SQL injection vulnerabilities in d.net CMS allow remote attackers to execute arbitrary SQL commands via (1) the page parameter to index.php;… | Patch early | 6.5 medium | 0.8% | 2009-10-01 |
| CVE-2024-42831 EXP | A reflected cross-site scripting (XSS) vulnerability in Elaine's Realtime CRM Automation v6.18.17 allows attackers to execute arbitrary JavaScript cod… | Patch early | 6.1 medium | 0.8% | 2024-10-07 |
| CVE-2011-5050 EXP | SQL injection vulnerability in corporate/Controller in Elitecore Technologies Cyberoam UTM before 10.01.2 build 059 allows remote authenticated admini… | Patch early | 6.0 medium | 0.8% | 2012-01-04 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt