CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
403,226 CVEs
1,739 on KEV
17,298 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-08
170,768 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2007-6191 EXP | Multiple PHP remote file inclusion vulnerabilities in Armin Burger p.mapper 3.2.0 beta3 allow remote attackers to execute arbitrary PHP code via a URL… | Patch early | 6.8 medium | 2.2% | 2007-11-30 |
| CVE-2019-13346 EXP | In MyT 1.5.1, the User[username] parameter has XSS. | Patch early | 6.1 medium | 2.2% | 2019-07-17 |
| CVE-2018-5370 EXP | BizLogic xnami 1.0 has XSS via the comment parameter in an addComment action to the /media/ajax URI. | Patch early | 6.1 medium | 2.2% | 2018-01-16 |
| CVE-2017-16356 EXP | Reflected XSS in Kubik-Rubik SIGE (aka Simple Image Gallery Extended) before 3.3.0 allows attackers to execute JavaScript in a victim's browser by hav… | Patch early | 6.1 medium | 2.2% | 2018-02-20 |
| CVE-2017-16962 EXP | The WebMail components (Crystal, pronto, and pronto4) in CommuniGate Pro before 6.2.1 have stored XSS vulnerabilities via (1) the location or details… | Patch early | 6.1 medium | 2.2% | 2017-11-27 |
| CVE-2016-8855 EXP | Cross-Site Scripting (XSS) in "/sitecore/client/Applications/List Manager/Taskpages/Contact list" in Sitecore Experience Platform 8.1 rev. 160519 (8.1… | Patch early | 6.1 medium | 2.2% | 2017-03-19 |
| CVE-2007-5374 EXP | cp_memberedit.php in LightBlog 8.4.1.1 does not check for administrative credentials when processing an admin action, which allows remote authenticate… | Patch early | 6.5 medium | 2.2% | 2007-10-11 |
| CVE-2006-0923 EXP | Multiple cross-site scripting (XSS) vulnerabilities in MyPHPNuke (MPN) 1.88 and earlier allow remote attackers to inject arbitrary web script or HTML… | Patch early | 4.3 medium | 2.2% | 2006-02-28 |
| CVE-2008-3758 EXP | Multiple cross-site scripting (XSS) vulnerabilities in Lussumo Vanilla 1.1.4 and earlier (1) allow remote attackers to inject arbitrary web script or… | Patch early | 4.3 medium | 2.2% | 2008-08-21 |
| CVE-2006-5060 EXP | Cross-site scripting (XSS) vulnerability in login.php in Jamroom 3.0.16 and possibly earlier allows remote attackers to inject arbitrary web script or… | Patch early | 5.1 medium | 2.2% | 2006-09-28 |
| CVE-2007-4229 EXP | Unspecified vulnerability in KDE Konqueror 3.5.7 and earlier allows remote attackers to cause a denial of service (failed assertion and application cr… | Patch early | 4.3 medium | 2.2% | 2007-08-08 |
| CVE-2007-4930 EXP | Multiple cross-site request forgery (CSRF) vulnerabilities in the AXIS 207W camera allow remote attackers to perform certain actions as administrators… | Patch early | 4.3 medium | 2.2% | 2007-09-18 |
| CVE-2008-4166 EXP | Integer overflow in the JavaScript engine in Avant Browser 11.7 Build 9 and earlier allows remote attackers to cause a denial of service (application… | Patch early | 4.3 medium | 2.2% | 2008-09-22 |
| CVE-2006-1121 EXP | Cross-site scripting (XSS) vulnerability in CuteNews 1.4.1 allows remote attackers to inject arbitrary web script or HTML via the query string to inde… | Patch early | 6.8 medium | 2.2% | 2006-03-09 |
| CVE-2019-7004 EXP | A Cross-Site Scripting (XSS) vulnerability in the WebUI component of IP Office Application Server could allow unauthorized code execution and potentia… | Patch early | 5.4 medium | 2.2% | 2019-12-12 |
| CVE-2008-2070 EXP | The WHM interface 11.15.0 for cPanel 11.18 before 11.18.4 and 11.22 before 11.22.3 allows remote attackers to bypass XSS protection and inject arbitra… | Patch early | 4.3 medium | 2.2% | 2008-05-12 |
| CVE-2006-1659 EXP | Multiple SQL injection vulnerabilities in Softbiz Image Gallery allow remote attackers to execute arbitrary SQL commands via the (1) id parameter in i… | Patch early | 6.4 medium | 2.2% | 2006-04-07 |
| CVE-2003-1199 EXP | Cross-site scripting (XSS) vulnerability in MyProxy 20030629 allows remote attackers to inject arbitrary web script or HTML via the URL. | Patch early | 6.8 medium | 2.2% | 2004-03-11 |
| CVE-2008-3302 EXP | SQL injection vulnerability in admin/delete.php in BilboBlog 0.2.1, when magic_quotes_gpc is disabled, allows remote authenticated administrators to e… | Patch early | 6.0 medium | 2.2% | 2008-07-25 |
| CVE-2010-0665 EXP | JAG (Just Another Guestbook) 1.14 stores sensitive information under the web root with insufficient access control, which allows remote attackers to o… | Patch early | 5.0 medium | 2.2% | 2010-02-19 |
| CVE-2008-0358 EXP | SQL injection vulnerability in index.php in Pixelpost 1.7 allows remote attackers to execute arbitrary SQL commands via the parent_id parameter. | Patch early | 6.8 medium | 2.2% | 2008-01-18 |
| CVE-2005-3473 EXP | Multiple cross-site scripting (XSS) vulnerabilities in Simple PHP Blog 0.4.5 and earlier allow remote attackers to inject arbitrary web script or HTML… | Patch early | 4.3 medium | 2.2% | 2005-11-03 |
| CVE-2022-31886 EXP | Marval MSM v14.19.0.12476 is vulnerable to Cross Site Request Forgery (CSRF). An attacker can disable the 2FA by sending the user a malicious form. | Patch early | 6.5 medium | 2.2% | 2022-06-28 |
| CVE-2007-0764 EXP | Unrestricted file upload vulnerability in F3Site 2.1 and earlier allows remote authenticated administrators to upload and execute arbitrary PHP script… | Patch early | 6.5 medium | 2.2% | 2007-02-06 |
| CVE-2008-5697 EXP | The skype_tool.copy_num method in the Skype extension BETA 2.2.0.95 for Firefox allows remote attackers to write arbitrary data to the clipboard via a… | Patch early | 4.3 medium | 2.2% | 2008-12-22 |
| CVE-2008-3093 EXP | Unrestricted file upload vulnerability in ImperialBB 2.3.5 and earlier allows remote authenticated users to upload and execute arbitrary PHP code by p… | Patch early | 6.5 medium | 2.2% | 2008-07-09 |
| CVE-2014-2227 EXP | The default Flash cross-domain policy (crossdomain.xml) in Ubiquiti Networks UniFi Video (formerly AirVision aka AirVision Controller) before 3.0.1 do… | Patch early | 6.0 medium | 2.2% | 2014-07-25 |
| CVE-2020-35241 EXP | FlatPress 1.0.3 is affected by cross-site scripting (XSS) in the Blog Content component. This vulnerability can allow an attacker to inject the XSS pa… | Patch early | 4.8 medium | 2.2% | 2020-12-30 |
| CVE-2006-5944 EXP | Cross-site scripting (XSS) vulnerability in csm/asp/listings.asp in MGinternet Car Site Manager (CSM) allows remote attackers to inject arbitrary web… | Patch early | 6.8 medium | 2.2% | 2006-11-17 |
| CVE-2006-6205 EXP | Multiple cross-site scripting (XSS) vulnerabilities in result.asp in Enthrallweb eHomes allow remote attackers to inject arbitrary web script or HTML… | Patch early | 6.8 medium | 2.2% | 2006-12-01 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt