CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
403,011 CVEs
1,734 on KEV
17,293 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-08
207,513 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2004-0298 EXP | CesarFTP 0.99e allows remote attackers to cause a denial of service (CPU consumption) via a long RETR parameter. | Patch early | 5.0 medium | 3.1% | 2004-11-23 |
| CVE-2004-0668 EXP | Web Access in Lotus Domino 6.5.1 allows remote attackers to cause a denial of service (server crash) via a large e-mail message, as demonstrated using… | Patch early | 5.0 medium | 3.1% | 2004-08-06 |
| CVE-2004-1195 EXP | Star Wars Battlefront 1.11 and earlier allows remote attackers to cause a denial of service (application crash) via a join request that contains a mem… | Patch early | 5.0 medium | 3.1% | 2005-01-10 |
| CVE-2018-18755 EXP | K-iwi Framework 1775 has SQL Injection via the admin/user/group/update user_group_id parameter or the admin/user/user/update user_id parameter. | Patch early | 9.8 critical | 3.1% | 2018-11-16 |
| CVE-2005-2594 EXP | Apple Safari 1.3 (132) on Mac OS X 1.3.9 allows remote attackers to cause a denial of service (crash) via certain Javascript, possibly involving a fun… | Patch early | 5.0 medium | 3.1% | 2005-08-17 |
| CVE-2004-0671 EXP | Brightmail Spamfilter 6.0 and earlier beta releases allows remote attackers to read mail from other users by modifying the id parameter in a viewMsgDe… | Patch early | 5.0 medium | 3.1% | 2004-08-06 |
| CVE-2001-0898 EXP | Opera 6.0 and earlier allows remote attackers to access sensitive information such as cookies and links for other domains via Javascript that uses set… | Patch early | 5.0 medium | 3.1% | 2001-11-15 |
| CVE-2001-1334 EXP | Block_render_url.class in PHPSlash 0.6.1 allows remote attackers with PHPSlash administrator privileges to read arbitrary files by creating a block an… | Patch early | 5.0 medium | 3.1% | 2002-05-19 |
| CVE-2010-3201 EXP | Cross-site scripting (XSS) vulnerability in NetWin Surgemail before 4.3g allows remote attackers to inject arbitrary web script or HTML via the userna… | Patch early | 4.3 medium | 3.1% | 2011-01-07 |
| CVE-2006-5391 EXP | Xfire 1.64 and earlier allows remote attackers to cause a denial of service (client application crash) via a long string to UDP port 25777. | Patch early | 5.0 medium | 3.1% | 2006-10-18 |
| CVE-2006-0713 EXP | Directory traversal vulnerability in LinPHA 1.0 allows remote attackers to include arbitrary files via .. (dot dot) sequences in the (1) lang paramete… | Patch early | 5.0 medium | 3.1% | 2006-02-15 |
| CVE-2006-2746 EXP | Multiple cross-site scripting (XSS) vulnerabilities in F@cile Interactive Web 0.8.5 and earlier allow remote attackers to inject arbitrary web script… | Patch early | 6.8 medium | 3.1% | 2006-06-01 |
| CVE-2008-2276 EXP | Cross-site request forgery (CSRF) vulnerability in manage_user_create.php in Mantis 1.1.1 allows remote attackers to create new administrative users v… | Patch early | 6.8 medium | 3.1% | 2008-05-16 |
| CVE-2013-5954 EXP | Multiple cross-site request forgery (CSRF) vulnerabilities in OpenX 2.8.11 and earlier allow remote attackers to hijack the authentication of administ… | Patch early | 6.8 medium | 3.1% | 2014-04-25 |
| CVE-2012-6665 EXP | Directory traversal vulnerability in index.php in phpMoneyBooks 1.0.4 allows remote attackers to read arbitrary files via a .. (dot dot) in the file p… | Patch early | 4.3 medium | 3.1% | 2014-11-17 |
| CVE-2009-2286 EXP | Buffer overflow in compface 1.5.2 and earlier allows user-assisted attackers to cause a denial of service (crash) via a long declaration in a .xbm fil… | Patch early | 4.3 medium | 3.1% | 2009-07-01 |
| CVE-2008-1125 EXP | Multiple directory traversal vulnerabilities in Podcast Generator 1.0 BETA 2 and earlier allow remote attackers to read arbitrary files via a .. (dot… | Patch early | 5.0 medium | 3.1% | 2008-03-03 |
| CVE-2023-23956 EXP | A user can supply malicious HTML and JavaScript code that will be executed in the client browser | Patch early | 5.4 medium | 3.1% | 2023-05-30 |
| CVE-2004-1621 EXP | NOTE: this issue has been disputed by the vendor. Cross-site scripting (XSS) vulnerability in IBM Lotus Notes R6 and Domino R6, and possibly earlier… | Patch early | 4.3 medium | 3.1% | 2004-10-18 |
| CVE-2010-5099 EXP | The fileDenyPattern functionality in the PHP file inclusion protection API in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 do… | Patch early | 6.8 medium | 3.1% | 2012-05-30 |
| CVE-2006-4444 EXP | Multiple SQL injection vulnerabilities in Cybozu Garoon 2.1.0 for Windows allow remote authenticated users to execute arbitrary SQL commands via the (… | Patch early | 6.5 medium | 3.1% | 2006-08-29 |
| CVE-2006-3269 EXP | PHP remote file inclusion vulnerability in includes/functions_cms.php in THoRCMS 1.3.1 allows remote attackers to execute arbitrary PHP code via the p… | Patch early | 5.1 medium | 3.1% | 2006-06-28 |
| CVE-2006-3294 EXP | PHP remote file inclusion vulnerability in mod_cbsms_messages.php in CBSMS Mambo Module 1.0 and earlier, when register_globals is enabled, allows remo… | Patch early | 5.1 medium | 3.1% | 2006-06-29 |
| CVE-2006-4113 EXP | PHP remote file inclusion vulnerability in genpage-cgi.php in Brian Fraval hitweb 4.2 and possibly earlier versions allows remote attackers to execute… | Patch early | 5.1 medium | 3.1% | 2006-08-14 |
| CVE-2006-4158 EXP | PHP remote file inclusion vulnerability in Login.php in Spaminator 1.7 and earlier allows remote attackers to execute arbitrary PHP code via a URL in… | Patch early | 5.1 medium | 3.1% | 2006-08-16 |
| CVE-2006-4291 EXP | PHP remote file inclusion vulnerability in handlers/email/mod.listmail.php in PHlyMail Lite 3.4.4 and earlier (Build 3.04.04) allows remote attackers… | Patch early | 5.1 medium | 3.1% | 2006-08-22 |
| CVE-2006-4426 EXP | PHP remote file inclusion vulnerability in AES/modules/auth/phpsecurityadmin/include/logout.php in AlberT-EasySite (AES) 1.0a5 and earlier allows remo… | Patch early | 5.1 medium | 3.1% | 2006-08-29 |
| CVE-2006-4638 EXP | PHP remote file inclusion vulnerability in article.php in ACGV News 0.9.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL… | Patch early | 5.1 medium | 3.1% | 2006-09-08 |
| CVE-2011-4716 EXP | Directory traversal vulnerability in file in DreamBox DM800 1.6rc3, 1.5rc1, and earlier allows remote attackers to read arbitrary files via the file p… | Patch early | 5.0 medium | 3.1% | 2011-12-08 |
| CVE-2009-2600 EXP | Multiple directory traversal vulnerabilities in view.php in Webboard 2.90 beta and earlier allow remote attackers to read arbitrary files via a .. (do… | Patch early | 5.0 medium | 3.1% | 2009-07-27 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt