CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
402,674 CVEs
1,734 on KEV
17,294 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-07
170,469 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2000-1110 EXP | document.d2w CGI program in the IBM Net.Data db2www package allows remote attackers to determine the physical path of the web server by sending a none… | Patch early | 5.0 medium | 2.7% | 2001-01-09 |
| CVE-2005-0818 EXP | Cross-site scripting (XSS) vulnerability in PunBB 1.2.3 allows remote attackers to inject arbitrary web script or HTML via the (1) email or (2) Jabber… | Patch early | 4.3 medium | 2.7% | 2005-05-02 |
| CVE-2007-3434 EXP | index.php in Pharmacy System 2 and earlier allows remote attackers to obtain sensitive information via a ' (quote) character in the page parameter, wh… | Patch early | 5.0 medium | 2.7% | 2007-06-27 |
| CVE-2009-0852 EXP | showme.php in CelerBB 0.0.2 allows remote attackers to obtain "reserved information" via the user parameter. | Patch early | 5.0 medium | 2.7% | 2009-03-09 |
| CVE-2007-6496 EXP | Hosting Controller 6.1 Hot fix 3.3 and earlier allows remote attackers to register arbitrary users via a request to hosting/addsubsite.asp with the lo… | Patch early | 6.8 medium | 2.7% | 2007-12-20 |
| CVE-2011-4720 EXP | Hillstone HS TFTP Server 1.3.2 allows remote attackers to cause a denial of service (daemon crash) via a long filename in a (1) RRQ or (2) WRQ operati… | Patch early | 5.0 medium | 2.7% | 2014-12-28 |
| CVE-2009-5141 EXP | Format string vulnerability in War FTP Daemon (warftpd) 1.82 RC 12 allows remote authenticated users to cause a denial of service (crash) via format s… | Patch early | 4.0 medium | 2.7% | 2014-04-01 |
| CVE-2006-6338 EXP | Unrestricted file upload vulnerability in upload/index.php in deV!L`z Clanportal (DZCP) before 1.3.6.1 allows remote attackers to upload and execute a… | Patch early | 5.0 medium | 2.7% | 2006-12-07 |
| CVE-2006-2730 EXP | PHP remote file inclusion vulnerability in admin/lib_action_step.php in Hot Open Tickets (HOT) 11012004_ver2f, when register_globals is enabled, allow… | Patch early | 5.1 medium | 2.7% | 2006-06-01 |
| CVE-2006-4121 EXP | PHP remote file inclusion vulnerability in owimg.php3 in See-Commerce 1.0.625 and earlier allows remote attackers to execute arbitrary PHP code via a… | Patch early | 5.1 medium | 2.7% | 2006-08-14 |
| CVE-2000-0395 EXP | Buffer overflow in CProxy 3.3 allows remote users to cause a denial of service via a long HTTP request. | Patch early | 5.0 medium | 2.7% | 2000-05-16 |
| CVE-2020-8776 EXP | Alfresco Enterprise before 5.2.7 and Alfresco Community before 6.2.0 (rb65251d6-b368) has XSS via the URL property of a file. | Patch early | 5.4 medium | 2.7% | 2020-03-02 |
| CVE-2006-3147 EXP | Unspecified vulnerability in Hosting Controller before 6.1 (aka Hotfix 3.2) allows remote authenticated attackers to gain host admin privileges, list… | Patch early | 6.5 medium | 2.7% | 2006-06-22 |
| CVE-2007-6405 EXP | Sergey Lyubka Simple HTTPD (shttpd) 1.38 and earlier on Windows allows remote attackers to download arbitrary CGI programs or scripts via a URI with a… | Patch early | 6.4 medium | 2.7% | 2007-12-17 |
| CVE-2006-3105 EXP | CRLF injection vulnerability in Bitweaver 1.3 allows remote attackers to conduct HTTP response splitting attacks by via CRLF sequences in multiple uns… | Patch early | 5.0 medium | 2.7% | 2006-06-21 |
| CVE-2007-6476 EXP | GF-3XPLORER 2.4 allows remote attackers to obtain configuration information via a direct request to explorer/phpinfo.php, which calls the phpinfo func… | Patch early | 5.0 medium | 2.7% | 2007-12-20 |
| CVE-2013-0397 EXP | Unspecified vulnerability in the Oracle Applications Framework component in Oracle E-Business Suite 11.5.10.2, 12.0.6, and 12.1.3 allows remote attack… | Patch early | 6.4 medium | 2.7% | 2013-01-17 |
| CVE-2006-2028 EXP | Cross-site scripting (XSS) vulnerability in imagelist.php in Jeremy Ashcraft Simplog 0.9.3 and earlier allows remote attackers to inject arbitrary web… | Patch early | 5.8 medium | 2.7% | 2006-04-26 |
| CVE-2008-6010 EXP | Multiple directory traversal vulnerabilities in SG Real Estate Portal 2.0 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1)… | Patch early | 5.0 medium | 2.7% | 2009-01-30 |
| CVE-2008-6139 EXP | Directory traversal vulnerability in faqsupport/wce.download.php in WebBiscuits Modules Controller 1.1 allows remote attackers to read arbitrary files… | Patch early | 5.0 medium | 2.7% | 2009-02-14 |
| CVE-2008-6933 EXP | Directory traversal vulnerability in index.php in MiniGal b13 (aka MG2) allows remote attackers to read the source code of .php files, and possibly th… | Patch early | 5.0 medium | 2.7% | 2009-08-11 |
| CVE-2008-0542 EXP | Directory traversal vulnerability in thumbnail.php in Gerd Tentler Simple Forum 3.2 allows remote attackers to read arbitrary files via a .. (dot dot)… | Patch early | 5.0 medium | 2.7% | 2008-02-01 |
| CVE-2008-0813 EXP | Directory traversal vulnerability in Download.php in XPWeb 3.0.1, 3.3.2, and possibly other versions, allows remote attackers to read arbitrary files… | Patch early | 5.0 medium | 2.7% | 2008-02-19 |
| CVE-2008-0905 EXP | Directory traversal vulnerability in globsy_edit.php in Globsy 1.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the file para… | Patch early | 5.0 medium | 2.7% | 2008-02-22 |
| CVE-2008-1755 EXP | Directory traversal vulnerability in the showSource function in showSource.php in World of Phaos 4.0.1 allows remote attackers to read arbitrary files… | Patch early | 5.0 medium | 2.7% | 2008-04-11 |
| CVE-2008-1799 EXP | Directory traversal vulnerability in thumbnails.php in sabros.us 1.75 allows remote attackers to read arbitrary files via a .. (dot dot) in the img pa… | Patch early | 5.0 medium | 2.7% | 2008-04-15 |
| CVE-2008-1849 EXP | Directory traversal vulnerability in index.php in the joomlaXplorer (com_joomlaxplorer) Mambo/Joomla! component 1.6.2 and earlier allows remote attack… | Patch early | 5.0 medium | 2.7% | 2008-04-16 |
| CVE-2008-2342 EXP | Directory traversal vulnerability in attachments.php in News Manager 2.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the id… | Patch early | 5.0 medium | 2.7% | 2008-05-19 |
| CVE-2008-2838 EXP | Directory traversal vulnerability in index.php in Traindepot 0.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the module para… | Patch early | 5.0 medium | 2.7% | 2008-06-24 |
| CVE-2008-2961 EXP | Multiple directory traversal vulnerabilities in view/index.php in CMS Mini 0.2.2 allow remote attackers to read arbitrary local files via a .. (dot do… | Patch early | 5.0 medium | 2.7% | 2008-07-02 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt