CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
401,295 CVEs
1,734 on KEV
17,292 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-05
170,051 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2013-6976 EXP | Cross-site request forgery (CSRF) vulnerability in goform/Quick_setup on Cisco EPC3925 devices allows remote attackers to hijack the authentication of… | Patch early | 6.8 medium | 3.7% | 2013-12-19 |
| CVE-2005-1613 EXP | Cross-site scripting (XSS) vulnerability in member.php in Open Bulletin Board (OpenBB) 1.0.8 allows remote attackers to inject arbitrary web script or… | Patch early | 6.8 medium | 3.7% | 2005-05-16 |
| CVE-2005-1614 EXP | Cross-site scripting (XSS) vulnerability in viewforum.php in Ultimate PHP Board (UPB) 1.8 through 1.9.6 allows remote attackers to inject arbitrary we… | Patch early | 6.8 medium | 3.7% | 2005-05-16 |
| CVE-2005-3411 EXP | Cross-site scripting (XSS) vulnerability in post.asp in Snitz Forums 2000 3.4.05 allows remote attackers to inject arbitrary web script or HTML via th… | Patch early | 4.3 medium | 3.7% | 2005-11-01 |
| CVE-2014-0870 EXP | Multiple cross-site scripting (XSS) vulnerabilities in RICOS in IBM Algo Credit Limits (aka ACLM) 4.5.0 through 4.7.0 before 4.7.0.03 FP5 in IBM Algor… | Patch early | 4.3 medium | 3.7% | 2014-07-07 |
| CVE-1999-1488 EXP | sdrd daemon in IBM SP2 System Data Repository (SDR) allows remote attackers to read files without authentication. | Patch early | 5.0 medium | 3.7% | 1999-12-31 |
| CVE-2007-5018 EXP | Stack-based buffer overflow in IMAPD in Mercury/32 4.52 allows remote authenticated users to execute arbitrary code via a long argument in a SEARCH ON… | Patch early | 6.0 medium | 3.6% | 2007-09-20 |
| CVE-2024-0723 EXP | A vulnerability was found in freeSSHd 1.0.9 on Windows. It has been classified as problematic. This affects an unknown part. The manipulation leads to… | Patch early | 5.3 medium | 3.6% | 2024-01-19 |
| CVE-2024-0725 EXP | A vulnerability was found in ProSSHD 1.2 on Windows. It has been declared as problematic. This vulnerability affects unknown code. The manipulation le… | Patch early | 5.3 medium | 3.6% | 2024-01-19 |
| CVE-2018-18308 EXP | In the 4.2.23 version of BigTree, a Stored XSS vulnerability has been discovered in /admin/ajax/file-browser/upload/ (aka the image upload area). | Patch early | 6.1 medium | 3.6% | 2018-10-16 |
| CVE-2005-3981 EXP | NOTE: this issue has been disputed by third parties. Microsoft Windows XP, 2000, and 2003 allows local users to kill a writable process by using the… | Patch early | 4.9 medium | 3.6% | 2005-12-04 |
| CVE-2019-15999 EXP | A vulnerability in the application environment of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker to gain unaut… | Patch early | 6.3 medium | 3.6% | 2020-01-06 |
| CVE-2005-3131 EXP | Multiple cross-site scripting (XSS) vulnerabilities in MERAK Mail Server 8.2.4r with Icewarp Web Mail 5.5.1, and possibly earlier versions, allow remo… | Patch early | 4.3 medium | 3.6% | 2005-10-04 |
| CVE-2004-1645 EXP | Cross-site scripting (XSS) vulnerability in Xedus 1.0 allows remote attackers to execute arbitrary web script or HTML via the (1) username parameter t… | Patch early | 4.3 medium | 3.6% | 2004-08-30 |
| CVE-2005-1823 EXP | Multiple cross-site scripting (XSS) vulnerabilities in Qualiteam X-Cart 4.0.8 allow remote attackers to inject arbitrary web script or HTML via the (1… | Patch early | 4.3 medium | 3.6% | 2005-06-01 |
| CVE-2015-6809 EXP | Multiple cross-site scripting (XSS) vulnerabilities in BEdita before 3.6.0 allow remote attackers to inject arbitrary web script or HTML via the (1) c… | Patch early | 4.3 medium | 3.6% | 2015-09-04 |
| CVE-2011-3390 EXP | Multiple cross-site scripting (XSS) vulnerabilities in index.php in IBM OpenAdmin Tool (OAT) before 2.72 for Informix allow remote attackers to inject… | Patch early | 4.3 medium | 3.6% | 2011-09-06 |
| CVE-2000-0912 EXP | MultiHTML CGI script allows remote attackers to read arbitrary files and possibly execute arbitrary commands by specifying the file name to the "multi… | Patch early | 5.0 medium | 3.6% | 2000-12-19 |
| CVE-2002-0115 EXP | Snort 1.8.3 does not properly define the minimum ICMP header size, which allows remote attackers to cause a denial of service (crash and core dump) vi… | Patch early | 5.0 medium | 3.6% | 2002-03-25 |
| CVE-2005-3556 EXP | Multiple cross-site scripting (XSS) vulnerabilities in PHPlist 2.10.1 and earlier allow remote attackers to inject arbitrary web script or HTML via th… | Patch early | 4.3 medium | 3.6% | 2005-11-16 |
| CVE-2009-4563 EXP | Cross-site request forgery (CSRF) vulnerability in zp-core/admin-options.php in Zenphoto 1.2.5 allows remote attackers to hijack the authentication of… | Patch early | 4.3 medium | 3.6% | 2010-01-04 |
| CVE-2018-9844 EXP | The Iptanus WordPress File Upload plugin before 4.3.4 for WordPress mishandles Settings attributes, leading to XSS. | Patch early | 6.1 medium | 3.6% | 2018-04-07 |
| CVE-2006-6628 EXP | Integer overflow in OpenOffice.org (OOo) 2.1 allows user-assisted remote attackers to cause a denial of service (application crash) via a crafted DOC… | Patch early | 4.3 medium | 3.6% | 2006-12-18 |
| CVE-2004-2297 EXP | The Reviews module in PHP-Nuke 6.0 to 7.3 allows remote attackers to cause a denial of service (CPU and memory consumption) via a large, out-of-range… | Patch early | 5.0 medium | 3.6% | 2004-12-31 |
| CVE-2008-1979 EXP | The Discovery Service (casdscvc) in CA ARCserve Backup 12.0.5454.0 and earlier allows remote attackers to cause a denial of service (crash) via a pack… | Patch early | 5.0 medium | 3.6% | 2008-04-27 |
| CVE-2009-4729 EXP | Multiple cross-site scripting (XSS) vulnerabilities in x10 Adult Media Script 1.7 allow remote attackers to inject arbitrary web script or HTML via th… | Patch early | 4.3 medium | 3.6% | 2010-03-18 |
| CVE-2006-1412 EXP | TFT Gallery 0.10 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the admin… | Patch early | 5.0 medium | 3.6% | 2006-03-28 |
| CVE-2005-2952 EXP | Directory traversal vulnerability in s.pl in Subscribe Me Pro 2.044.09P and earlier allows remote attackers to read arbitrary files via a .. (dot dot)… | Patch early | 5.0 medium | 3.6% | 2005-09-16 |
| CVE-2005-3026 EXP | Directory traversal vulnerability in index.php in Alstrasoft Epay Pro 2.0 and earlier allows remote attackers to read arbitrary files via a .. (dot do… | Patch early | 5.0 medium | 3.6% | 2005-09-21 |
| CVE-2005-0782 EXP | Cross-site scripting (XSS) vulnerability in (1) viewall.php and (2) category.php for paFileDB 3.1 and earlier allows remote attackers to inject arbitr… | Patch early | 4.3 medium | 3.6% | 2005-05-02 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt