CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
402,708 CVEs
1,734 on KEV
17,294 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-07
170,486 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2008-4707 EXP | Directory traversal vulnerability in index.php in BbZL.PhP 0.92 allows remote attackers to access unauthorized directories via a .. (dot dot) in the l… | Patch early | 5.0 medium | 2.7% | 2008-10-23 |
| CVE-2008-4773 EXP | Directory traversal vulnerability in main/main.php in QuestCMS allows remote attackers to read arbitrary local files via a .. (dot dot) in the theme p… | Patch early | 5.0 medium | 2.7% | 2008-10-28 |
| CVE-2019-14804 EXP | studio/polyglot.php?page=etemplates in UNA 10.0.0-RC1 allows XSS via the System Name field under Emails during template editing. | Patch early | 4.8 medium | 2.7% | 2019-08-09 |
| CVE-2020-10596 EXP | OpenCart 3.0.3.2 allows remote authenticated users to conduct XSS attacks via a crafted filename in the users' image upload section. | Patch early | 5.4 medium | 2.7% | 2020-03-17 |
| CVE-2006-4418 EXP | Directory traversal vulnerability in index.php for Wikepage 2006.2a Opus 10 allows remote attackers to include arbitrary local files via the lng param… | Patch early | 4.0 medium | 2.7% | 2006-08-28 |
| CVE-2008-3607 EXP | The IMAP server in NoticeWare Email Server NG 4.6.3 and earlier allows remote attackers to cause a denial of service (daemon crash) via multiple long… | Patch early | 5.0 medium | 2.7% | 2008-08-12 |
| CVE-2006-6755 EXP | Ixprim 1.2 allows remote attackers to obtain sensitive information via a direct request for kernel/plugins/fckeditor2/ixprim_api.php, which reveals th… | Patch early | 5.0 medium | 2.7% | 2006-12-27 |
| CVE-2004-2447 EXP | Cross-site scripting (XSS) vulnerability in 1st Class Mail Server 4.01 allows remote attackers to inject arbitrary web script or HTML via the Mailbox… | Patch early | 4.3 medium | 2.7% | 2004-12-31 |
| CVE-2006-1508 EXP | Multiple cross-site scripting (XSS) vulnerabilities in MH Software Connect Daily Web Calendar Software 3.2.9 and earlier allow remote attackers to inj… | Patch early | 4.3 medium | 2.7% | 2006-03-30 |
| CVE-2006-0496 EXP | Cross-site scripting (XSS) vulnerability in Mozilla 1.7.12 and possibly earlier, Mozilla Firefox 1.0.7 and possibly earlier, and Netscape 8.1 and poss… | Patch early | 4.3 medium | 2.7% | 2006-02-01 |
| CVE-2007-4641 EXP | Directory traversal vulnerability in index.php in Pakupaku CMS 0.4 and earlier allows remote attackers to include and execute arbitrary local files vi… | Patch early | 6.4 medium | 2.7% | 2007-08-31 |
| CVE-2007-6271 EXP | Absolute News Manager.NET 5.1 allows remote attackers to obtain sensitive information via a direct request to getpath.aspx, which reveals the installa… | Patch early | 5.0 medium | 2.7% | 2007-12-07 |
| CVE-2003-1480 EXP | MySQL 3.20 through 4.1.0 uses a weak algorithm for hashed passwords, which makes it easier for attackers to decrypt the password via brute force metho… | Patch early | 4.3 medium | 2.7% | 2003-12-31 |
| CVE-2022-4944 EXP | A vulnerability, which was classified as problematic, has been found in kalcaddle KodExplorer up to 4.49. Affected by this issue is some unknown funct… | Patch early | 4.3 medium | 2.7% | 2023-04-22 |
| CVE-2007-6488 EXP | Multiple PHP remote file inclusion vulnerabilities in Falcon Series One CMS 1.4.3 allow remote attackers to execute arbitrary PHP code via a URL in (1… | Patch early | 6.8 medium | 2.7% | 2007-12-20 |
| CVE-2002-2403 EXP | Directory traversal vulnerability in KeyFocus web server 1.0.8 allows remote attackers to read arbitrary files for recognized MIME type files via "...… | Patch early | 5.0 medium | 2.7% | 2002-12-31 |
| CVE-2008-5579 EXP | Absolute path traversal vulnerability in mini-pub.php/front-end/cat.php in mini-pub 0.3 allows remote attackers to read arbitrary files via a full pat… | Patch early | 5.0 medium | 2.7% | 2008-12-15 |
| CVE-2006-4448 EXP | Multiple PHP remote file inclusion vulnerabilities in interact 2.2, when register_globals is enabled, allow remote attackers to execute arbitrary PHP… | Patch early | 5.1 medium | 2.7% | 2006-08-30 |
| CVE-2011-5025 EXP | Multiple cross-site scripting (XSS) vulnerabilities in the wiki application in Yaws 1.88 allow remote attackers to inject arbitrary web script or HTML… | Patch early | 4.3 medium | 2.7% | 2011-12-29 |
| CVE-2007-3492 EXP | Conti FtpServer 1.0 allows remote authenticated users to cause a denial of service (daemon crash) via a certain string containing "//A:" in the argume… | Patch early | 6.8 medium | 2.7% | 2007-06-29 |
| CVE-2002-2335 EXP | Killer Protection 1.0 stores the vars.inc include file under the web root with insufficient access control, which allows remote attackers to obtain us… | Patch early | 5.0 medium | 2.7% | 2002-12-31 |
| CVE-2005-1008 EXP | Cross-site scripting (XSS) vulnerability in posts.asp for ASP-DEv XM Forum RC3 allows remote attackers to inject arbitrary web script or HTML via a "j… | Patch early | 4.3 medium | 2.7% | 2005-05-02 |
| CVE-2015-4460 EXP | Cross-site request forgery (CSRF) vulnerability in SecuritySetting/UserSecurity/UserManagement.aspx in B.A.S C2Box before 4.0.0 (r19171) allows remote… | Patch early | 6.8 medium | 2.7% | 2015-07-16 |
| CVE-2014-5346 EXP | Multiple cross-site request forgery (CSRF) vulnerabilities in the Disqus Comment System plugin 2.77 for WordPress allow remote attackers to hijack the… | Patch early | 6.8 medium | 2.7% | 2014-08-19 |
| CVE-2010-1734 EXP | The SfnINSTRING function in win32k.sys in the kernel in Microsoft Windows 2000, XP, and Server 2003 allows local users to cause a denial of service (s… | Patch early | 4.9 medium | 2.7% | 2010-05-06 |
| CVE-2010-4313 EXP | Unrestricted file upload vulnerability in fileman_file_upload.php in Orbis CMS 1.0.2 allows remote authenticated users to execute arbitrary code by up… | Patch early | 6.0 medium | 2.7% | 2010-12-02 |
| CVE-2010-4258 EXP | The do_exit function in kernel/exit.c in the Linux kernel before 2.6.36.2 does not properly handle a KERNEL_DS get_fs value, which allows local users… | Patch early | 6.2 medium | 2.7% | 2010-12-30 |
| CVE-2007-1138 EXP | Absolute path traversal vulnerability in list_main_pages.php in Cromosoft Simple Plantilla PHP (SPP) allows remote attackers to list arbitrary directo… | Patch early | 5.0 medium | 2.7% | 2007-03-02 |
| CVE-2006-6598 EXP | Directory traversal vulnerability in viewnfo.php in (1) TorrentFlux before 2.2 and (2) torrentflux-b4rt before 2.1-b4rt-972 allows remote authenticate… | Patch early | 6.5 medium | 2.7% | 2006-12-15 |
| CVE-2002-2258 EXP | Moby NetSuite allows remote attackers to cause a denial of service (crash) via an HTTP POST request with a (1) large integer or (2) non-numeric value… | Patch early | 5.0 medium | 2.7% | 2002-12-31 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt