CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
425,729 CVEs
1,781 on KEV
17,555 EPSS ≥ 10%
25,095 with exploits
synced 2026-11-14
10,150 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2010-1478 EXP | Directory traversal vulnerability in the Ternaria Informatica Jfeedback! (com_jfeedback) component 1.2 for Joomla! allows remote attackers to read arb… | Patch early | 6.8 medium | 8.2% | 2010-04-19 |
| CVE-2010-1469 EXP | Directory traversal vulnerability in the Ternaria Informatica JProject Manager (com_jprojectmanager) component 1.0 for Joomla! allows remote attackers… | Patch early | 6.8 medium | 8.2% | 2010-04-19 |
| CVE-2010-1473 EXP | Directory traversal vulnerability in the Advertising (com_advertising) component 0.25 for Joomla! allows remote attackers to read arbitrary files and… | Patch early | 6.8 medium | 8.2% | 2010-04-19 |
| CVE-2009-0348 EXP | The login module in Sun Java System Access Manager 6 2005Q1 (aka 6.3), 7 2005Q4 (aka 7.0), and 7.1 responds differently to a failed login attempt depe… | Patch early | 5.0 medium | 8.2% | 2009-01-29 |
| CVE-2015-2184 EXP | ZeusCart 4 allows remote attackers to obtain configuration information via a getphpinfo action to admin/, which calls the phpinfo function. | Patch early | 5.0 medium | 8.1% | 2015-03-10 |
| CVE-2006-0922 EXP | CubeCart 3.0 through 3.6 does not properly check authorization for an administration session because of a missing auth.inc.php include, which results… | Patch early | 5.0 medium | 8.1% | 2006-02-28 |
| CVE-2019-15501 EXP | Reflected cross site scripting (XSS) in L-Soft LISTSERV before 16.5-2018a exists via the /scripts/wa.exe OK parameter. | Patch early | 6.1 medium | 8.1% | 2019-08-26 |
| CVE-2009-3704 EXP | ZoIPer 2.22, and possibly other versions before 2.24 Library 5324, allows remote attackers to cause a denial of service (crash) via a SIP INVITE reque… | Patch early | 5.0 medium | 8.1% | 2009-10-16 |
| CVE-2001-0705 EXP | Directory traversal vulnerability in tradecli.dll in Arcadia Internet Store 1.0 allows a remote attacker to read arbitrary files on the web server via… | Patch early | 5.0 medium | 8.1% | 2001-09-20 |
| CVE-2004-1620 EXP | CRLF injection vulnerability in Serendipity before 0.7rc1 allows remote attackers to perform HTTP Response Splitting attacks to modify expected HTML c… | Patch early | 5.0 medium | 8.1% | 2004-10-21 |
| CVE-2002-0112 EXP | Etype Eserv 2.97 allows remote attackers to view password protected files via /./ in the URL. | Patch early | 5.0 medium | 8.1% | 2002-03-25 |
| CVE-2014-0983 EXP | Multiple array index errors in programs that are automatically generated by VBox/HostServices/SharedOpenGL/crserverlib/server_dispatch.py in Oracle Vi… | Patch early | 6.9 medium | 8.1% | 2014-03-31 |
| CVE-2000-0921 EXP | Directory traversal vulnerability in Hassan Consulting shop.cgi shopping cart program allows remote attackers to read arbitrary files via a .. (dot do… | Patch early | 5.0 medium | 8.1% | 2000-12-19 |
| CVE-2001-0295 EXP | Directory traversal vulnerability in War FTP 1.67.04 allows remote attackers to list directory contents and possibly read files via a "dir *./../.." c… | Patch early | 5.0 medium | 8.1% | 2001-05-03 |
| CVE-2001-0924 EXP | Directory traversal vulnerability in ifx CGI program in Informix Web DataBlade allows remote attackers to read arbitrary files via a .. (dot dot) in t… | Patch early | 5.0 medium | 8.1% | 2001-11-22 |
| CVE-2009-0497 EXP | Directory traversal vulnerability in log.jsp in Ignite Realtime Openfire 3.6.2 allows remote attackers to read arbitrary files via a ..\ (dot dot back… | Patch early | 5.0 medium | 8.1% | 2009-02-10 |
| CVE-2006-1470 EXP | OpenLDAP in Apple Mac OS X 10.4 up to 10.4.6 allows remote attackers to cause a denial of service (crash) via an invalid LDAP request that triggers an… | Patch early | 5.0 medium | 8.1% | 2006-06-27 |
| CVE-2012-0389 EXP | Cross-site scripting (XSS) vulnerability in ForgottenPassword.aspx in MailEnable Professional, Enterprise, and Premium 4.26 and earlier, 5.x before 5.… | Patch early | 4.3 medium | 8.1% | 2012-01-24 |
| CVE-2018-5753 EXP | The frontend component in Open-Xchange OX App Suite before 7.6.3-rev31, 7.8.x before 7.8.2-rev31, 7.8.3 before 7.8.3-rev41, and 7.8.4 before 7.8.4-rev… | Patch early | 6.5 medium | 8.1% | 2018-06-16 |
| CVE-2023-0493 EXP | Improper Neutralization of Equivalent Special Elements in GitHub repository btcpayserver/btcpayserver prior to 1.7.5. | Patch early | 5.3 medium | 8.1% | 2023-01-26 |
| CVE-2004-1937 EXP | Multiple directory traversal vulnerabilities in Nuked-KlaN 1.4b and 1.5b allow remote attackers to read or include arbitrary files via .. sequences in… | Patch early | 5.0 medium | 8.1% | 2004-12-31 |
| CVE-2004-2640 EXP | Directory traversal vulnerability in lstat.cgi in LinuxStat before 2.3.1 allows remote attackers to read arbitrary files via (1) .. (dot dot) sequence… | Patch early | 5.0 medium | 8.1% | 2004-12-31 |
| CVE-2017-3132 EXP | A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.6.0 and earlier allows attackers to Execute unauthorized code or commands via the… | Patch early | 6.1 medium | 8.1% | 2017-09-12 |
| CVE-2009-4050 EXP | Directory traversal vulnerability in get_file.php in phpMyBackupPro 2.1 allows remote attackers to read arbitrary files via directory traversal sequen… | Patch early | 5.0 medium | 8.1% | 2009-11-23 |
| CVE-2002-2084 EXP | Directory traversal vulnerability in index.php of Portix 0.4.02 allows remote attackers to read arbitrary files via a .. (dot dot) in the (1) l and (2… | Patch early | 5.0 medium | 8.1% | 2002-12-31 |
| CVE-2005-4208 EXP | Directory traversal vulnerability in Flatnuke 2.5.6 allows remote attackers to access arbitrary files via a .. (dot dot) and null byte (%00) in the id… | Patch early | 5.0 medium | 8.1% | 2005-12-13 |
| CVE-2006-2156 EXP | Directory traversal vulnerability in help/index.php in X7 Chat 2.0 and earlier allows remote attackers to include arbitrary files via .. (dot dot) seq… | Patch early | 6.4 medium | 8.1% | 2006-05-03 |
| CVE-2006-2142 EXP | PHP remote file inclusion vulnerability in classes/adodbt/sql.php in Limbo CMS 1.04 and earlier allows remote attackers to execute arbitrary PHP code… | Patch early | 6.4 medium | 8.1% | 2006-05-02 |
| CVE-2008-0625 EXP | Buffer overflow in the MediaGrid ActiveX control (mediagrid.dll) in Yahoo! Music Jukebox 2.2.2.56 allows remote attackers to execute arbitrary code vi… | Patch early | 4.3 medium | 8.1% | 2008-02-06 |
| CVE-2001-1408 EXP | Directory traversal vulnerability in readmsg.php in WebMail 2.0.1 in Cobalt Qube 3 allows remote attackers to read arbitrary files via a .. (dot dot)… | Patch early | 5.0 medium | 8.1% | 2001-07-05 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt