CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
403,696 CVEs
1,739 on KEV
17,300 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-09
170,928 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2009-2377 EXP | Buffer overflow in the Avax Vector ActiveX control in avPreview.ocx in AVAX-software Avax Vector ActiveX 1.3 allows remote attackers to cause a denial… | Patch early | 4.3 medium | 1.9% | 2009-07-08 |
| CVE-2006-6088 EXP | Multiple cross-site scripting (XSS) vulnerabilities in BlueCollar i-Gallery 3.4 allow remote attackers to inject arbitrary web script or HTML via the… | Patch early | 4.3 medium | 1.9% | 2006-11-24 |
| CVE-2005-3908 EXP | Cross-site scripting (XSS) vulnerability in search.php in GhostScripter Amazon Shop 5.0.0, and other versions before 5.0.2, allows remote attackers to… | Patch early | 4.3 medium | 1.9% | 2005-11-30 |
| CVE-2006-0442 EXP | Multiple cross-site scripting (XSS) vulnerabilities in usercp.php in MyBulletinBoard (MyBB) 1.02 allow remote attackers to inject arbitrary web script… | Patch early | 4.3 medium | 1.9% | 2006-01-26 |
| CVE-2007-4545 EXP | Multiple directory traversal vulnerabilities in Unreal Commander 0.92 build 565 and 573 allow user-assisted remote attackers to create or overwrite ar… | Patch early | 6.8 medium | 1.9% | 2007-08-27 |
| CVE-2007-6079 EXP | Directory traversal vulnerability in include/common.php in bcoos 1.0.10 allows remote attackers to include and execute arbitrary local files via a ..… | Patch early | 6.8 medium | 1.9% | 2007-11-21 |
| CVE-2009-0340 EXP | Multiple directory traversal vulnerabilities in Simple PHP Newsletter 1.5 allow remote attackers to read arbitrary files via a .. (dot dot) in the ola… | Patch early | 6.8 medium | 1.9% | 2009-01-29 |
| CVE-2009-0371 EXP | Directory traversal vulnerability in post.php in SiteXS CMS 0.1.1 and earlier allows remote attackers to include and execute arbitrary local files via… | Patch early | 6.8 medium | 1.9% | 2009-01-30 |
| CVE-2009-1407 EXP | Directory traversal vulnerability in config.php in NotFTP 1.3.1 allows remote attackers to read arbitrary files via a .. (dot dot) in a certain langua… | Patch early | 6.8 medium | 1.9% | 2009-04-24 |
| CVE-2009-1498 EXP | Directory traversal vulnerability in inc/profilemain.php in Game Maker 2k Internet Discussion Boards (iDB) 0.2.5 Pre-Alpha SVN 243 allows remote attac… | Patch early | 6.8 medium | 1.9% | 2009-05-01 |
| CVE-2008-2185 EXP | Directory traversal vulnerability in index.php in SMartBlog (aka SMBlog) 1.3 allows remote attackers to include arbitrary local files via directory tr… | Patch early | 4.3 medium | 1.9% | 2008-05-13 |
| CVE-2023-0961 EXP | A vulnerability was found in SourceCodester Music Gallery Site 1.0. It has been classified as critical. This affects an unknown part of the file view_… | Patch early | 6.3 medium | 1.9% | 2023-02-22 |
| CVE-2006-6786 EXP | Open Newsletter 2.5 and earlier allows remote authenticated administrators to execute arbitrary PHP code by inserting the code into the email paramete… | Patch early | 6.5 medium | 1.9% | 2006-12-28 |
| CVE-2018-15707 EXP | Advantech WebAccess 8.3.1 and 8.3.2 are vulnerable to cross-site scripting in the Bwmainleft.asp page. An attacker could leverage this vulnerability t… | Patch early | 5.4 medium | 1.9% | 2018-10-31 |
| CVE-2006-6518 EXP | Multiple cross-site scripting (XSS) vulnerabilities in ProNews 1.5 allow remote attackers to inject arbitrary web script or HTML via the (1) pseudo, (… | Patch early | 6.8 medium | 1.9% | 2006-12-14 |
| CVE-2006-2124 EXP | Multiple cross-site scripting (XSS) vulnerabilities in SunShop 3.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the (… | Patch early | 5.8 medium | 1.9% | 2006-05-01 |
| CVE-2006-2680 EXP | Cross-site scripting (XSS) vulnerability in index.php in AZ Photo Album Script Pro allows remote attackers to inject arbitrary web script or HTML via… | Patch early | 5.8 medium | 1.9% | 2006-05-31 |
| CVE-2006-3151 EXP | Cross-site scripting (XSS) vulnerability in index.php in AssoCIateD (aka ACID) 1.2.0 and earlier allows remote attackers to inject arbitrary web scrip… | Patch early | 4.3 medium | 1.9% | 2006-06-22 |
| CVE-2009-3449 EXP | MP3 Collector 2.3 allows remote attackers to cause a denial of service (application crash) via a long URL in a .m3u playlist file. | Patch early | 4.3 medium | 1.9% | 2009-09-29 |
| CVE-2011-4909 EXP | Multiple cross-site scripting (XSS) vulnerabilities in Joomla! before 1.5.12 allow remote attackers to inject arbitrary web script or HTML via the HTT… | Patch early | 4.3 medium | 1.9% | 2012-10-07 |
| CVE-2012-6523 EXP | Multiple cross-site scripting (XSS) vulnerabilities in w-CMS 2.01 allow remote attackers to inject arbitrary web script or HTML via (1) the p paramete… | Patch early | 4.3 medium | 1.9% | 2013-01-31 |
| CVE-2007-3542 EXP | Cross-site scripting (XSS) vulnerability in admin/auth.php in Pluxml 0.3.1 allows remote attackers to inject arbitrary web script or HTML via the msg… | Patch early | 4.3 medium | 1.9% | 2007-07-03 |
| CVE-2007-5600 EXP | Incomplete blacklist vulnerability in index.php in Artmedic CMS 3.4 and earlier allows remote attackers to execute arbitrary PHP code via a (1) UNC sh… | Patch early | 6.8 medium | 1.9% | 2007-10-19 |
| CVE-2007-0846 EXP | Cross-site scripting (XSS) vulnerability in forum.php in Open Tibia Server CMS (OTSCMS) 2.1.5 and earlier allows remote attackers to inject arbitrary… | Patch early | 6.8 medium | 1.9% | 2007-02-08 |
| CVE-2006-3904 EXP | SQL injection vulnerability in manager/index.php in Etomite CMS 0.6.1 and earlier, with magic_quotes_gpc disabled, allows remote attackers to execute… | Patch early | 6.8 medium | 1.9% | 2006-07-27 |
| CVE-2006-1404 EXP | Multiple cross-site scripting (XSS) vulnerabilities in bol.cgi in BlankOL 1.0 and earlier allow remote attackers to inject arbitrary web script or HTM… | Patch early | 5.8 medium | 1.9% | 2006-03-28 |
| CVE-2020-8825 EXP | index.php?p=/dashboard/settings/branding in Vanilla 2.6.3 allows stored XSS. | Patch early | 5.4 medium | 1.9% | 2020-02-10 |
| CVE-2005-4075 EXP | Multiple cross-site scripting (XSS) vulnerabilities in index.cfm in CF_Nuke 4.6 and earlier allow remote attackers to inject arbitrary web script or H… | Patch early | 4.3 medium | 1.9% | 2005-12-08 |
| CVE-2005-4381 EXP | Multiple cross-site scripting (XSS) vulnerabilities in Caravel CMS 3.0 Beta 1 and earlier allow remote attackers to inject arbitrary web script or HTM… | Patch early | 4.3 medium | 1.9% | 2005-12-20 |
| CVE-2006-0480 EXP | Cross-site scripting (XSS) vulnerability in the Articles module in sPaiz-Nuke allows remote attackers to inject arbitrary web script or HTML via the q… | Patch early | 4.3 medium | 1.9% | 2006-01-31 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt