CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
403,534 CVEs
1,739 on KEV
17,298 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-09
150,568 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2006-2844 EXP | Multiple PHP remote file inclusion vulnerabilities in Redaxo 3.0 allow remote attackers to execute arbitrary PHP code via a URL in the REX[INCLUDE_PAT… | Patch early | 7.5 high | 3.8% | 2006-06-06 |
| CVE-2006-2845 EXP | PHP remote file inclusion vulnerability in Redaxo 3.0 up to 3.2 allows remote attackers to execute arbitrary PHP code via a URL in the REX[INCLUDE_PAT… | Patch early | 7.5 high | 3.8% | 2006-06-06 |
| CVE-2007-6538 EXP | SQL injection vulnerability in ing/blocks/mrbs/code/web/view_entry.php in the MRBS plugin for Moodle allows remote attackers to execute arbitrary SQL… | Patch early | 7.5 high | 3.8% | 2007-12-27 |
| CVE-2006-0959 EXP | SQL injection vulnerability in misc.php in MyBulletinBoard (MyBB) 1.03, when register_globals is enabled, allows remote attackers to execute arbitrary… | Patch early | 7.5 high | 3.8% | 2006-03-02 |
| CVE-2020-35151 EXP | The Online Marriage Registration System 1.0 post parameter "searchdata" in the user/search.php request is vulnerable to Time Based Sql Injection. | Patch early | 8.8 high | 3.8% | 2020-12-21 |
| CVE-2006-6360 EXP | PHP remote file inclusion vulnerability in activate.php in PHP Upload Center 2.0 allows remote attackers to execute arbitrary PHP code via a URL in th… | Patch early | 7.5 high | 3.8% | 2006-12-07 |
| CVE-2012-5897 EXP | The (1) SimpleTree and (2) ReportTree classes in the ARDoc ActiveX control (ARDoc.dll) in Quest InTrust 10.4.0.853 and earlier do not properly impleme… | Patch early | 9.3 high | 3.8% | 2012-11-17 |
| CVE-2008-4999 EXP | Nortel Networks UNIStim IP Phone 0604DAS allows remote attackers to cause a denial of service (crash) via a long ping packet ("ping of death"). NOTE:… | Patch early | 7.8 high | 3.8% | 2008-11-07 |
| CVE-2007-2496 EXP | The WordOCX ActiveX control in WordViewer.ocx 3.2.0.5 allows remote attackers to cause a denial of service (Internet Explorer 7 crash) via a long (1)… | Patch early | 7.8 high | 3.8% | 2007-05-04 |
| CVE-2001-0274 EXP | kicq IRC client 1.0.0, and possibly later versions, allows remote attackers to execute arbitrary commands via shell metacharacters in a URL. | Patch early | 7.5 high | 3.8% | 2001-05-03 |
| CVE-2006-7173 EXP | Direct static code injection vulnerability in admin.php in PHP-Stats 0.1.9.1b and earlier allows remote attackers to execute arbitrary PHP code via a… | Patch early | 10.0 high | 3.8% | 2007-03-20 |
| CVE-2017-15667 EXP | In Flexense SysGauge Server 3.6.18, the Control Protocol suffers from a denial of service. The attack vector is a crafted SERVER_GET_INFO packet sent… | Patch early | 7.5 high | 3.8% | 2017-12-28 |
| CVE-2010-3301 EXP | The IA32 system call emulation functionality in arch/x86/ia32/ia32entry.S in the Linux kernel before 2.6.36-rc4-git2 on the x86_64 platform does not z… | Patch early | 7.2 high | 3.8% | 2010-09-22 |
| CVE-2005-4213 EXP | SQL injection vulnerability in mod.php in phpCOIN 1.2.2 allows remote attackers to execute arbitrary SQL commands via the phpcoinsessid cookie. | Patch early | 7.5 high | 3.8% | 2005-12-14 |
| CVE-2005-3938 EXP | SQL injection vulnerability in Softbiz FAQ Script 1.1 and earler allows remote attackers to execute arbitrary SQL commands via the id parameter in (1)… | Patch early | 7.5 high | 3.8% | 2005-12-01 |
| CVE-2014-2046 EXP | cgi-bin/rpcBridge in the web interface 1.1 on Broadcom Ltd PIPA C211 rev2 does not properly restrict access, which allows remote attackers to (1) obta… | Patch early | 9.7 high | 3.8% | 2014-05-14 |
| CVE-2013-4631 EXP | Huawei AR 150, 200, 1200, 2200, and 3200 routers, when SNMPv3 is enabled, allow remote attackers to cause a denial of service (device crash) via malfo… | Patch early | 7.8 high | 3.8% | 2013-06-20 |
| CVE-2017-11176 EXP | The mq_notify function in the Linux kernel through 4.11.9 does not set the sock pointer to NULL upon entry into the retry logic. During a user-space c… | Patch early | 7.8 high | 3.8% | 2017-07-11 |
| CVE-2015-8088 EXP | Heap-based buffer overflow in the HIFI driver in Huawei Mate 7 phones with software MT7-UL00 before MT7-UL00C17B354, MT7-TL10 before MT7-TL10C00B354,… | Patch early | 7.8 high | 3.8% | 2016-01-12 |
| CVE-2000-0751 EXP | mopd (Maintenance Operations Protocol loader daemon) does not properly cleanse user-injected format strings, which allows remote attackers to execute… | Patch early | 7.5 high | 3.8% | 2000-10-20 |
| CVE-2006-7007 EXP | Buffer overflow in Tiny FTPd 1.4 and earlier allows remote attackers to cause a denial of service (daemon crash) via a long USER command, a different… | Patch early | 7.8 high | 3.8% | 2007-02-12 |
| CVE-2006-3994 EXP | SQL injection vulnerability in the u2u_send_recp function in u2u.inc.php in XMB (aka extreme message board) 1.9.6 Alpha and earlier allows remote atta… | Patch early | 7.5 high | 3.8% | 2006-08-05 |
| CVE-2006-5399 EXP | PHP remote file inclusion vulnerability in classes/Import_MM.class.php in PHPRecipeBook 2.36, when register_globals is enabled, allows remote attacker… | Patch early | 7.5 high | 3.8% | 2006-10-18 |
| CVE-2000-1021 EXP | Heap overflow in WebConfig in Mdaemon 3.1.1 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary commands v… | Patch early | 7.5 high | 3.8% | 2000-12-11 |
| CVE-2013-7248 EXP | Franklin Fueling Systems TS-550 evo with firmware 2.0.0.6833 and other versions before 2.4.0 has a hardcoded password for the roleDiag account, which… | Patch early | 10.0 high | 3.8% | 2014-01-26 |
| CVE-2010-1431 EXP | SQL injection vulnerability in templates_export.php in Cacti 0.8.7e and earlier allows remote attackers to execute arbitrary SQL commands via the expo… | Patch early | 7.5 high | 3.8% | 2010-05-04 |
| CVE-2016-0171 EXP | The kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R… | Patch early | 7.8 high | 3.8% | 2016-05-11 |
| CVE-2015-1471 EXP | SQL injection vulnerability in userprofile.lib.php in Pragyan CMS 3.0 allows remote attackers to execute arbitrary SQL commands via the user parameter… | Patch early | 7.5 high | 3.8% | 2015-02-12 |
| CVE-2006-4583 EXP | Multiple PHP remote file inclusion vulnerabilities in FlashChat before 4.6.2 allow remote attackers to execute arbitrary PHP code via a URL in the dir… | Patch early | 7.5 high | 3.8% | 2006-09-06 |
| CVE-2007-0202 EXP | SQL injection vulnerability in index.php in @lex Guestbook 4.0.2 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute ar… | Patch early | 7.5 high | 3.8% | 2007-01-11 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt