CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
425,729 CVEs
1,781 on KEV
17,555 EPSS ≥ 10%
25,095 with exploits
synced 2026-11-14
10,150 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2001-1408 EXP | Directory traversal vulnerability in readmsg.php in WebMail 2.0.1 in Cobalt Qube 3 allows remote attackers to read arbitrary files via a .. (dot dot)… | Patch early | 5.0 medium | 8.1% | 2001-07-05 |
| CVE-2003-0277 EXP | Directory traversal vulnerability in normal_html.cgi in Happycgi.com Happymall 4.3 and 4.4 allows remote attackers to read arbitrary files via .. (dot… | Patch early | 5.0 medium | 8.1% | 2003-06-16 |
| CVE-2004-1951 EXP | xine 1.x alpha, 1.x beta, and 1.0rc through 1.0rc3a, and xine-ui 0.9.21 to 0.9.23 allows remote attackers to overwrite arbitrary files via the (1) aud… | Patch early | 5.0 medium | 8.1% | 2004-12-31 |
| CVE-2004-2184 EXP | Directory traversal vulnerability in Digicraft Yak! server 2.0 through 2.1.2 allows remote attackers to read or write arbitrary files via "../" or "..… | Patch early | 6.4 medium | 8.1% | 2004-12-31 |
| CVE-2004-1699 EXP | SettingsBase.php in Pinnacle ShowCenter 1.51 allows remote attackers to cause a denial of service (web interface errors) via an invalid Skin parameter… | Patch early | 5.0 medium | 8.1% | 2004-09-21 |
| CVE-2004-0269 EXP | SQL injection vulnerability in PHP-Nuke 6.9 and earlier, and possibly 7.x, allows remote attackers to inject arbitrary SQL code and gain sensitive inf… | Patch early | 6.4 medium | 8.1% | 2004-11-23 |
| CVE-2016-9018 EXP | Improper handling of a repeating VRAT chunk in qcpfformat.dll allows attackers to cause a Null pointer dereference and crash in RealNetworks RealPlaye… | Patch early | 5.5 medium | 8.1% | 2016-10-28 |
| CVE-2007-3006 EXP | Buffer overflow in Acoustica MP3 CD Burner 4.32 allows user-assisted remote attackers to execute arbitrary code via a .asx playlist file with a REF el… | Patch early | 6.8 medium | 8.1% | 2007-06-04 |
| CVE-2010-1128 EXP | The Linear Congruential Generator (LCG) in PHP before 5.2.13 does not provide the expected entropy, which makes it easier for context-dependent attack… | Patch early | 6.4 medium | 8.1% | 2010-03-26 |
| CVE-2000-0242 EXP | WindMail allows remote attackers to read arbitrary files or execute commands via shell metacharacters. | Patch early | 5.0 medium | 8.1% | 2000-03-25 |
| CVE-2008-7248 EXP | Ruby on Rails 2.1 before 2.1.3 and 2.2.x before 2.2.2 does not verify tokens for requests with certain content types, which allows remote attackers to… | Patch early | 6.8 medium | 8.1% | 2009-12-16 |
| CVE-2018-10077 EXP | XML external entity (XXE) vulnerability in Geist WatchDog Console 3.2.2 allows remote authenticated administrators to read arbitrary files via crafted… | Patch early | 4.9 medium | 8.1% | 2018-04-20 |
| CVE-2007-3947 EXP | request.c in lighttpd 1.4.15 allows remote attackers to cause a denial of service (daemon crash) by sending an HTTP request with duplicate headers, as… | Patch early | 5.8 medium | 8.1% | 2007-07-24 |
| CVE-2005-0698 EXP | PHP remote file inclusion vulnerability in PHPWebLog 0.5.3 and earlier allows remote attackers to execute arbitrary PHP code by modifying the (1) G_PA… | Patch early | 4.6 medium | 8.1% | 2005-03-07 |
| CVE-2017-1000367 EXP | Todd Miller's sudo version 1.8.20 and earlier is vulnerable to an input validation (embedded spaces) in the get_process_ttyname() function resulting i… | Patch early | 6.4 medium | 8.1% | 2017-06-05 |
| CVE-2014-8493 EXP | ZTE ZXHN H108L with firmware 4.0.0d_ZRQ_GR4 allows remote attackers to modify the CWMP configuration via a crafted request to Forms/access_cwmp_1. | Patch early | 5.0 medium | 8.1% | 2014-11-20 |
| CVE-2008-5062 EXP | Directory traversal vulnerability in php/cal_pdf.php in Mini Web Calendar (mwcal) 1.2 allows remote attackers to read arbitrary files via directory tr… | Patch early | 5.0 medium | 8.1% | 2008-11-13 |
| CVE-2010-0303 EXP | mystring.c in hybserv in IRCD-Hybrid (aka Hybrid2 IRC Services) 1.9.2 through 1.9.4 allows remote attackers to cause a denial of service (daemon crash… | Patch early | 5.0 medium | 8.1% | 2010-02-04 |
| CVE-2011-1425 EXP | xslt.c in XML Security Library (aka xmlsec) before 1.2.17, as used in WebKit and other products, when XSLT is enabled, allows remote attackers to crea… | Patch early | 5.1 medium | 8.1% | 2011-04-04 |
| CVE-2006-2568 EXP | PHP remote file inclusion vulnerability in addpost_newpoll.php in UBB.threads 6.4 through 6.5.2 and 6.5.1.1 (trial) allows remote attackers to execute… | Patch early | 5.1 medium | 8.1% | 2006-05-24 |
| CVE-1999-1069 EXP | Directory traversal vulnerability in carbo.dll in iCat Carbo Server 3.0.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the ic… | Patch early | 5.0 medium | 8.1% | 1997-11-08 |
| CVE-2001-0189 EXP | Directory traversal vulnerability in LocalWEB2000 HTTP server allows remote attackers to read arbitrary commands via a .. (dot dot) attack in an HTTP… | Patch early | 5.0 medium | 8.1% | 2001-03-26 |
| CVE-2002-1525 EXP | Directory traversal vulnerability in ASTAware SearchDisk engine for Sun ONE Starter Kit 2.0 allows remote attackers to read arbitrary files via a .. (… | Patch early | 5.0 medium | 8.1% | 2003-04-02 |
| CVE-2003-0748 EXP | Directory traversal vulnerability in wgate.dll for SAP Internet Transaction Server (ITS) 4620.2.0.323011 allows remote attackers to read arbitrary fil… | Patch early | 5.0 medium | 8.1% | 2003-10-20 |
| CVE-2003-0621 EXP | The Administration Console for BEA Tuxedo 8.1 and earlier allows remote attackers to determine the existence of files outside the web root via modifie… | Patch early | 5.0 medium | 8% | 2003-12-01 |
| CVE-2007-4583 EXP | Multiple absolute path traversal vulnerabilities in the nvUtility.Utility.1 ActiveX control in nvUtility.dll 1.0.14.0 in ACTi Network Video Recorder (… | Patch early | 5.0 medium | 8% | 2007-08-29 |
| CVE-2002-1031 EXP | KeyFocus (KF) web server 1.0.2 allows remote attackers to list directories and read restricted files via an HTTP request containing a %00 (null) chara… | Patch early | 5.0 medium | 8% | 2002-10-04 |
| CVE-2000-0919 EXP | Directory traversal vulnerability in PHPix Photo Album 1.0.2 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) attack. | Patch early | 5.0 medium | 8% | 2000-12-19 |
| CVE-2001-1209 EXP | Directory traversal vulnerability in zml.cgi allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter. | Patch early | 5.0 medium | 8% | 2001-12-31 |
| CVE-2006-2059 EXP | action_public/search.php in Invision Power Board (IPB) 2.1.x and 2.0.x before 20060425 allows remote attackers to execute arbitrary PHP code via a sea… | Patch early | 5.0 medium | 8% | 2006-04-26 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt