CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
407,366 CVEs
1,741 on KEV
17,302 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-14
10,149 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2008-4082 EXP | SQL injection vulnerability in the Tasks plugin in Brim 2.0.0, when magic_quotes_gpc is disabled, allows remote authenticated users to execute arbitra… | Patch early | 4.6 medium | 0.8% | 2008-09-15 |
| CVE-2005-3857 EXP | The time_out_leases function in locks.c for Linux kernel before 2.6.15-rc3 allows local users to cause a denial of service (kernel log message consump… | Patch early | 4.9 medium | 0.8% | 2005-11-27 |
| CVE-2007-0162 EXP | Unsanity Application Enhancer (APE) 2.0.2 installs with insecure permissions for the (1) ApplicationEnhancer binary and the (2) /Library/Frameworks/Ap… | Patch early | 6.8 medium | 0.8% | 2007-01-10 |
| CVE-2007-1572 EXP | SQL injection vulnerability in search.asp in JGBBS 3.0 Beta 1 and earlier allows remote attackers to execute arbitrary SQL commands via the title para… | Patch early | 6.8 medium | 0.8% | 2007-03-21 |
| CVE-2009-4114 EXP | kl1.sys in Kaspersky Anti-Virus 2010 9.0.0.463, and possibly other versions before 9.0.0.736, does not properly validate input to IOCTL 0x0022c008, wh… | Patch early | 4.9 medium | 0.8% | 2009-11-30 |
| CVE-2024-43687 EXP | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Microchip TimeProvider 4100 (banner confi… | Patch early | 6.1 medium | 0.8% | 2024-10-04 |
| CVE-2008-4113 EXP | The sctp_getsockopt_hmac_ident function in net/sctp/socket.c in the Stream Control Transmission Protocol (sctp) implementation in the Linux kernel bef… | Patch early | 4.7 medium | 0.8% | 2008-09-16 |
| CVE-2008-1968 EXP | Multiple SQL injection vulnerabilities in Cezanne 7 allow remote authenticated users to execute arbitrary SQL commands via the FUNID parameter to (1)… | Patch early | 6.0 medium | 0.8% | 2008-04-27 |
| CVE-2008-1607 EXP | SQL injection vulnerability in haberoku.php in Serbay Arslanhan Bomba Haber 2.0 allows remote attackers to execute arbitrary SQL commands via the habe… | Patch early | 6.8 medium | 0.8% | 2008-04-01 |
| CVE-2009-4199 EXP | Multiple SQL injection vulnerabilities in the Mambo Resident (aka Mos Res or com_mosres) component 1.0f for Mambo and Joomla!, when magic_quotes_gpc i… | Patch early | 6.8 medium | 0.8% | 2009-12-04 |
| CVE-2010-1859 EXP | SQL injection vulnerability in newpost.php in DeluxeBB 1.3 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrar… | Patch early | 6.8 medium | 0.8% | 2010-05-07 |
| CVE-2010-0453 EXP | The ucode_ioctl function in intel/io/ucode_drv.c in Sun Solaris 10 and OpenSolaris snv_69 through snv_133, when running on x86 architectures, allows l… | Patch early | 4.9 medium | 0.8% | 2010-02-03 |
| CVE-2007-3450 EXP | SQL injection vulnerability in member.php in 6ALBlog allows remote attackers to execute arbitrary SQL commands via the member parameter. NOTE: the pro… | Patch early | 6.8 medium | 0.8% | 2007-06-27 |
| CVE-2008-5952 EXP | SQL injection vulnerability in KTP Computer Customer Database (KTPCCD) CMS, when magic_quotes_gpc is disabled, allows remote authenticated users to ex… | Patch early | 6.0 medium | 0.8% | 2009-01-23 |
| CVE-2005-1606 EXP | H-Sphere Winbox 2.4.2 and 2.4.3 RC1 stores sensitive information such as username and password in plaintext in world-readable log files, which allows… | Patch early | 4.6 medium | 0.8% | 2005-05-16 |
| CVE-2014-9416 EXP | Multiple untrusted search path vulnerabilities in Huawei eSpace Desktop before V200R003C00 allow local users to execute arbitrary code and conduct DLL… | Patch early | 4.4 medium | 0.8% | 2014-12-24 |
| CVE-2010-3030 EXP | Cross-site request forgery (CSRF) vulnerability in Tomaz Muraus Open Blog 1.2.1, and possibly earlier, allows remote attackers to hijack the authentic… | Patch early | 6.8 medium | 0.8% | 2010-08-17 |
| CVE-2010-3884 EXP | Cross-site request forgery (CSRF) vulnerability in CMS Made Simple 1.8.1 and earlier allows remote attackers to hijack the authentication of administr… | Patch early | 6.8 medium | 0.8% | 2010-10-08 |
| CVE-2010-5241 EXP | Multiple untrusted search path vulnerabilities in Autodesk AutoCAD 2010 allow local users to gain privileges via a Trojan horse (1) dwmapi.dll or (2)… | Patch early | 6.9 medium | 0.8% | 2012-09-07 |
| CVE-2010-4143 EXP | SQL injection vulnerability in chart.php in phpCheckZ 1.1.0, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL comma… | Patch early | 6.8 medium | 0.8% | 2010-11-02 |
| CVE-1999-1543 EXP | MacOS uses weak encryption for passwords that are stored in the Users & Groups Data File. | Patch early | 4.6 medium | 0.8% | 1999-07-10 |
| CVE-2012-5383 EXP | Untrusted search path vulnerability in the installation functionality in Oracle MySQL 5.5.28, when installed in the top-level C:\ directory, might all… | Patch early | 6.2 medium | 0.8% | 2012-10-11 |
| CVE-2010-0307 EXP | The load_elf_binary function in fs/binfmt_elf.c in the Linux kernel before 2.6.32.8 on the x86_64 platform does not ensure that the ELF interpreter is… | Patch early | 4.7 medium | 0.8% | 2010-02-17 |
| CVE-2008-7192 EXP | Cross-site request forgery (CSRF) vulnerability in index.php in WoltLab Burning Board (wBB) 3.0.1, and possibly other 3.x versions, allows remote atta… | Patch early | 6.8 medium | 0.8% | 2009-09-09 |
| CVE-2010-4751 EXP | SQL injection vulnerability in LightNEasy.php in LightNEasy 3.2.1, when magic_quotes_gpc is disabled, allows remote authenticated users to execute arb… | Patch early | 6.0 medium | 0.8% | 2011-03-01 |
| CVE-2009-4452 EXP | Kaspersky Anti-Virus 5.0 (5.0.712); Antivirus Personal 5.0.x; Anti-Virus 6.0 (6.0.3.837), 7 (7.0.1.325), 2009 (8.0.0.x), and 2010 (9.0.0.463); and Int… | Patch early | 6.8 medium | 0.8% | 2009-12-29 |
| CVE-2018-9445 EXP | In readMetadata of Utils.cpp, there is a possible path traversal bug due to a confused deputy. This could lead to local escalation of privilege when m… | Patch early | 6.8 medium | 0.8% | 2018-11-06 |
| CVE-2009-1362 EXP | SQL injection vulnerability in administration/index.php in chCounter 3.1.3 allows remote attackers to execute arbitrary SQL commands via the login_nam… | Patch early | 6.8 medium | 0.8% | 2009-04-22 |
| CVE-2003-1169 EXP | DATEV Nutzungskontrolle 2.1 and 2.2 has insecure write permissions for critical registry keys, which allows local users to bypass access restrictions… | Patch early | 4.6 medium | 0.8% | 2003-12-31 |
| CVE-2008-2858 EXP | SQL injection vulnerability in index.php in WebChamado 1.1 allows remote attackers to execute arbitrary SQL commands via the eml parameter. NOTE: the… | Patch early | 6.8 medium | 0.8% | 2008-06-25 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt