CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
403,659 CVEs
1,739 on KEV
17,298 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-09
170,909 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2008-3390 EXP | Directory traversal vulnerability in libraries/general.init.php in Minishowcase Image Gallery 09b136, when register_globals is enabled, allows remote… | Patch early | 6.8 medium | 1.9% | 2008-07-31 |
| CVE-2008-3555 EXP | Directory traversal vulnerability in index.php in (1) WSN Forum 4.1.43 and earlier, (2) Gallery 4.1.30 and earlier, (3) Knowledge Base (WSNKB) 4.1.36… | Patch early | 6.8 medium | 1.9% | 2008-08-08 |
| CVE-2008-4632 EXP | Multiple directory traversal vulnerabilities in index.php in Kure 0.6.3, when magic_quotes_gpc is disabled, allow remote attackers to read and possibl… | Patch early | 6.8 medium | 1.9% | 2008-10-21 |
| CVE-2008-6290 EXP | Directory traversal vulnerability in includefile.php in nicLOR Sito, when register_globals is enabled or magic_quotes_gpc is disabled, allows remote a… | Patch early | 6.8 medium | 1.9% | 2009-02-26 |
| CVE-2004-1829 EXP | Multiple cross-site scripting (XSS) vulnerabilities in error.php in Gijza.net Error Manager 2.1 for PHP-Nuke 6.0 allow remote attackers to inject arbi… | Patch early | 4.3 medium | 1.9% | 2004-03-18 |
| CVE-2004-2113 EXP | Cross-site scripting (XSS) vulnerability in BremsServer 1.2.4 allows remote attackers to inject arbitrary web script or HTML via the URL. | Patch early | 4.3 medium | 1.9% | 2004-12-31 |
| CVE-2004-2119 EXP | Cross-site scripting (XSS) vulnerability in Tiny Server 1.1 allows remote attackers to inject arbitrary web script or HTML via the URL. | Patch early | 4.3 medium | 1.9% | 2004-12-31 |
| CVE-2004-0046 EXP | Cross-site scripting (XSS) vulnerability in SnapStream PVS LITE allows remote attackers to inject arbitrary web script or HTML via a GET request conta… | Patch early | 4.3 medium | 1.9% | 2004-02-03 |
| CVE-2006-1429 EXP | Cross-site scripting (XSS) vulnerability in accountlogon.cfm in classifiedZONE 1.2 and earlier allows remote attackers to inject arbitrary web script… | Patch early | 4.3 medium | 1.9% | 2006-03-28 |
| CVE-2006-1487 EXP | Cross-site scripting (XSS) vulnerability in ActiveCampaign SupportTrio 2.50.2 allows remote attackers to inject arbitrary web script or HTML via unspe… | Patch early | 4.3 medium | 1.9% | 2006-03-29 |
| CVE-2006-1567 EXP | Cross-site scripting (XSS) vulnerability in searchresults.asp in SiteSearch Indexer 3.5 and earlier allows remote attackers to inject arbitrary web sc… | Patch early | 4.3 medium | 1.9% | 2006-04-01 |
| CVE-2006-1801 EXP | Cross-site scripting (XSS) vulnerability in planetsearchplus.php in planetSearch+ allows remote attackers to inject arbitrary web script or HTML via t… | Patch early | 4.3 medium | 1.9% | 2006-04-18 |
| CVE-2006-1950 EXP | Multiple cross-site scripting (XSS) vulnerabilities in banners.cgi in PerlCoders BannerFarm 2.3 and earlier allow remote attackers to inject arbitrary… | Patch early | 4.3 medium | 1.9% | 2006-04-20 |
| CVE-2005-3695 EXP | Cross-site scripting (XSS) vulnerability in admin/config/confMgr.php in LiteSpeed Web Server 2.1.5 allows remote attackers to inject arbitrary web scr… | Patch early | 4.3 medium | 1.9% | 2005-11-20 |
| CVE-2005-3998 EXP | Cross-site scripting (XSS) vulnerability in search.asp in Solupress News 1.0 and earlier allows remote attackers to inject arbitrary web script or HTM… | Patch early | 4.3 medium | 1.9% | 2005-12-05 |
| CVE-2005-4000 EXP | Cross-site scripting (XSS) vulnerability in archive.asp in SiteBeater News System 4.00 and earlier allows remote attackers to inject arbitrary web scr… | Patch early | 4.3 medium | 1.9% | 2005-12-05 |
| CVE-2005-4177 EXP | Cross-site scripting (XSS) vulnerability in book.cfm in Magic Book Personal and Professional 2.0 allows remote attackers to inject arbitrary web scrip… | Patch early | 4.3 medium | 1.9% | 2005-12-12 |
| CVE-2006-1157 EXP | Cross-site scripting (XSS) vulnerability in Vz Scripts ADP Forum 2.0.3 and earlier allows remote attackers to inject arbitrary web script or HTML via… | Patch early | 4.3 medium | 1.9% | 2006-03-12 |
| CVE-2006-1199 EXP | Cross-site scripting (XSS) vulnerability in iframe.php in daverave Link Bank allows remote attackers to inject arbitrary web script or HTML via the si… | Patch early | 4.3 medium | 1.9% | 2006-03-14 |
| CVE-2014-3414 EXP | Cross-site request forgery (CSRF) vulnerability in Sharetronix before 3.4 allows remote attackers to hijack the authentication of administrators for r… | Patch early | 6.8 medium | 1.9% | 2014-05-29 |
| CVE-2013-6826 EXP | cgi-bin/module//sysmanager/admin/SYSAdminUserDialog in Fortinet FortiAnalyzer before 5.0.5 does not properly validate the csrf_token parameter, which… | Patch early | 6.8 medium | 1.9% | 2013-11-20 |
| CVE-2005-4288 EXP | Cross-site scripting (XSS) vulnerability in index.php in MarmaraWeb E-commerce allows remote attackers to inject arbitrary web script or HTML via the… | Patch early | 4.3 medium | 1.9% | 2005-12-16 |
| CVE-2006-2138 EXP | Cross-site scripting (XSS) vulnerability in neomail.pl in NeoMail 1.29 allows remote attackers to inject arbitrary web script or HTML via the sessioni… | Patch early | 4.3 medium | 1.9% | 2006-05-02 |
| CVE-2006-3927 EXP | Cross-site scripting (XSS) vulnerability in auctionsearch.php in PhpProBid 5.24 allows remote attackers to inject arbitrary web script or HTML via the… | Patch early | 4.3 medium | 1.9% | 2006-07-31 |
| CVE-2023-29848 EXP | Bang Resto 1.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the itemName parameter in the admin/menu.php Add New Me… | Patch early | 4.8 medium | 1.9% | 2023-04-24 |
| CVE-2004-2702 EXP | Cross-site scripting (XSS) vulnerability in login_up.php3 in Plesk 7.0 and 7.1 Reloaded allows remote attackers to inject arbitrary web script or HTML… | Patch early | 4.3 medium | 1.9% | 2004-12-31 |
| CVE-2007-5427 EXP | Cross-site scripting (XSS) vulnerability in the com_search component in Joomla! 1.0.13 and earlier allows remote attackers to inject arbitrary web scr… | Patch early | 4.3 medium | 1.9% | 2007-10-12 |
| CVE-2008-0026 EXP | SQL injection vulnerability in Cisco Unified CallManager/Communications Manager (CUCM) 5.0/5.1 before 5.1(3a) and 6.0/6.1 before 6.1(1a) allows remote… | Patch early | 6.5 medium | 1.9% | 2008-02-14 |
| CVE-2009-1468 EXP | Multiple SQL injection vulnerabilities in the search form in server/webmail.php in the Groupware component in IceWarp eMail Server and WebMail Server… | Patch early | 6.5 medium | 1.9% | 2009-05-05 |
| CVE-2008-3701 EXP | SQL injection vulnerability in staff/index.php in Kayako SupportSuite 3.20.02 and earlier allows remote authenticated users to execute arbitrary SQL c… | Patch early | 6.5 medium | 1.9% | 2008-08-15 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt