CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
403,226 CVEs
1,739 on KEV
17,298 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-08
170,768 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2006-6919 EXP | Firefox Sage extension 1.3.8 and earlier allows remote attackers to execute arbitrary Javascript in the local context via an RSS feed with an img tag… | Patch early | 6.8 medium | 2.2% | 2007-01-11 |
| CVE-2009-1744 EXP | InstallHFZ.exe 6.5.201.0 in Pinnacle Hollywood Effects 6, a module in Pinnacle Systems Pinnacle Studio 12, allows remote attackers to cause a denial o… | Patch early | 4.3 medium | 2.2% | 2009-05-21 |
| CVE-2008-2190 EXP | SQL injection vulnerability in index.php in Online Rent (aka Online Rental Property Script) 4.5 and earlier allows remote attackers to execute arbitra… | Patch early | 6.8 medium | 2.2% | 2008-05-14 |
| CVE-2004-2699 EXP | deleteicon.aspx in AspDotNetStorefront 3.3 allows remote attackers to delete arbitrary product images via a modified ProductID parameter. | Patch early | 4.3 medium | 2.2% | 2004-12-31 |
| CVE-2014-3857 EXP | Multiple SQL injection vulnerabilities in Kerio Control Statistics in Kerio Control (formerly WinRoute Firewall) before 8.3.2 allow remote authenticat… | Patch early | 6.5 medium | 2.2% | 2014-07-03 |
| CVE-2017-14619 EXP | Cross-site scripting (XSS) vulnerability in phpMyFAQ through 2.9.8 allows remote attackers to inject arbitrary web script or HTML via the "Title of yo… | Patch early | 6.1 medium | 2.2% | 2017-09-20 |
| CVE-2010-0681 EXP | ZeusCMS 0.2 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain sensitive inform… | Patch early | 5.0 medium | 2.2% | 2010-02-22 |
| CVE-2008-7011 EXP | The Unreal engine, as used in Unreal Tournament 3 1.3, Unreal Tournament 2003 and 2004, Dead Man's Hand, Pariah, WarPath, Postal2, and Shadow Ops, all… | Patch early | 4.0 medium | 2.2% | 2009-08-19 |
| CVE-2007-4637 EXP | xGB.php in xGB 2.0 does not require authentication for an admin edit action, which allows remote attackers to make unspecified changes via an unknown… | Patch early | 6.4 medium | 2.2% | 2007-08-31 |
| CVE-2023-29918 EXP | RosarioSIS 10.8.4 is vulnerable to CSV injection via the Periods Module. | Patch early | 5.4 medium | 2.2% | 2023-05-02 |
| CVE-2007-0082 EXP | users_adm/start1.php in IMGallery 2.5 and earlier does not properly handle files with multiple extensions, which allows remote authenticated users to… | Patch early | 6.5 medium | 2.2% | 2007-01-05 |
| CVE-2005-1233 EXP | Cross-site scripting (XSS) vulnerability in index.php in PHP Labs proFile allows remote attackers to inject arbitrary web script or HTML via the (1) d… | Patch early | 4.3 medium | 2.2% | 2005-04-20 |
| CVE-2008-7046 EXP | AJ Square Free Polling Script (AJPoll) allows remote attackers to bypass authentication and create new polls via a direct request to admin/include/new… | Patch early | 6.4 medium | 2.2% | 2009-08-24 |
| CVE-2006-3611 EXP | Directory traversal vulnerability in pm.php in Phorum 5 allows remote authenticated users to include and execute arbitrary local files via directory t… | Patch early | 5.5 medium | 2.2% | 2006-07-18 |
| CVE-2008-6742 EXP | Foxy P2P software allows remote attackers to cause a denial of service (memory consumption) via a foxy URI with a download action and a large fs value… | Patch early | 4.3 medium | 2.2% | 2009-04-21 |
| CVE-2008-5125 EXP | admin.php in CCleague Pro 1.2 allows remote attackers to bypass authentication by setting the type cookie value to admin. | Patch early | 6.8 medium | 2.2% | 2008-11-18 |
| CVE-2004-1845 EXP | Multiple cross-site scripting (XSS) vulnerabilities in News Manager Lite 2.5 allow remote attackers to inject arbitrary web script or HTML via the (1)… | Patch early | 4.3 medium | 2.2% | 2004-12-31 |
| CVE-2006-0217 EXP | Multiple cross-site scripting (XSS) vulnerabilities in Ultimate Auction 3.67 allow remote attackers to inject arbitrary web script or HTML via the (1)… | Patch early | 4.3 medium | 2.2% | 2006-01-16 |
| CVE-2006-4751 EXP | Cross-site scripting (XSS) vulnerability in index.php in Laurentiu Matei eXpandable Home Page (XHP) CMS 0.5.1 allows remote attackers to inject arbitr… | Patch early | 6.8 medium | 2.2% | 2006-09-13 |
| CVE-2017-5223 EXP | An issue was discovered in PHPMailer before 5.2.22. PHPMailer's msgHTML method applies transformations to an HTML document to make it usable as an ema… | Patch early | 5.5 medium | 2.2% | 2017-01-16 |
| CVE-2006-4654 EXP | Format string vulnerability in Easy Address Book Web Server 1.2 allows remote attackers to cause a denial of service (crash) or "compromise the server… | Patch early | 5.1 medium | 2.2% | 2006-09-09 |
| CVE-2006-5643 EXP | Cross-site scripting (XSS) vulnerability in search_de.html in foresite CMS allows remote attackers to inject arbitrary web script or HTML via the quer… | Patch early | 6.8 medium | 2.2% | 2006-11-01 |
| CVE-2007-1996 EXP | PHP remote file inclusion vulnerability in codebreak.php in CodeBreak, probably 1.1.2 and earlier, allows remote attackers to execute arbitrary PHP co… | Patch early | 6.8 medium | 2.2% | 2007-04-12 |
| CVE-2020-20139 EXP | Cross Site Scripting (XSS) vulnerability in the Remote JSON component Under the Connect menu in Flexmonster Pivot Table & Charts 2.7.17. | Patch early | 6.1 medium | 2.2% | 2020-12-17 |
| CVE-2020-20140 EXP | Cross Site Scripting (XSS) vulnerability in Remote Report component under the Open menu in Flexmonster Pivot Table & Charts 2.7.17. | Patch early | 6.1 medium | 2.2% | 2020-12-17 |
| CVE-2020-20141 EXP | Cross Site Scripting (XSS) vulnerability in the To OLAP (XMLA) component Under the Connect menu in Flexmonster Pivot Table & Charts 2.7.17. | Patch early | 6.1 medium | 2.2% | 2020-12-17 |
| CVE-2004-0344 EXP | Directory traversal vulnerability in ModifyMessage.php in YaBB SE 1.5.4 through 1.5.5b allows remote attackers to delete arbitrary files via a .. (dot… | Patch early | 6.4 medium | 2.2% | 2004-11-23 |
| CVE-2008-2018 EXP | The AssignUser function in template.class.php in PHPizabi 0.848b C1 HFP3 performs unsafe macro expansions on strings delimited by '{' and '}' characte… | Patch early | 4.0 medium | 2.2% | 2008-04-30 |
| CVE-2008-0289 EXP | PHP remote file inclusion vulnerability in view_func.php in Member Area System (MAS) 1.7 and possibly others allows remote attackers to execute arbitr… | Patch early | 6.8 medium | 2.2% | 2008-01-16 |
| CVE-2009-0735 EXP | Directory traversal vulnerability in lib/classes/message_class.php in Papoo CMS 3.6, when register_globals is enabled and magic_quotes_gpc is disabled… | Patch early | 5.1 medium | 2.2% | 2009-02-25 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt