CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
403,922 CVEs
1,739 on KEV
17,301 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-10
208,033 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2020-8776 EXP | Alfresco Enterprise before 5.2.7 and Alfresco Community before 6.2.0 (rb65251d6-b368) has XSS via the URL property of a file. | Patch early | 5.4 medium | 2.7% | 2020-03-02 |
| CVE-2006-3147 EXP | Unspecified vulnerability in Hosting Controller before 6.1 (aka Hotfix 3.2) allows remote authenticated attackers to gain host admin privileges, list… | Patch early | 6.5 medium | 2.7% | 2006-06-22 |
| CVE-2007-6405 EXP | Sergey Lyubka Simple HTTPD (shttpd) 1.38 and earlier on Windows allows remote attackers to download arbitrary CGI programs or scripts via a URI with a… | Patch early | 6.4 medium | 2.7% | 2007-12-17 |
| CVE-2006-3105 EXP | CRLF injection vulnerability in Bitweaver 1.3 allows remote attackers to conduct HTTP response splitting attacks by via CRLF sequences in multiple uns… | Patch early | 5.0 medium | 2.7% | 2006-06-21 |
| CVE-2007-6476 EXP | GF-3XPLORER 2.4 allows remote attackers to obtain configuration information via a direct request to explorer/phpinfo.php, which calls the phpinfo func… | Patch early | 5.0 medium | 2.7% | 2007-12-20 |
| CVE-2013-0397 EXP | Unspecified vulnerability in the Oracle Applications Framework component in Oracle E-Business Suite 11.5.10.2, 12.0.6, and 12.1.3 allows remote attack… | Patch early | 6.4 medium | 2.7% | 2013-01-17 |
| CVE-2006-2028 EXP | Cross-site scripting (XSS) vulnerability in imagelist.php in Jeremy Ashcraft Simplog 0.9.3 and earlier allows remote attackers to inject arbitrary web… | Patch early | 5.8 medium | 2.7% | 2006-04-26 |
| CVE-2008-4707 EXP | Directory traversal vulnerability in index.php in BbZL.PhP 0.92 allows remote attackers to access unauthorized directories via a .. (dot dot) in the l… | Patch early | 5.0 medium | 2.7% | 2008-10-23 |
| CVE-2008-4773 EXP | Directory traversal vulnerability in main/main.php in QuestCMS allows remote attackers to read arbitrary local files via a .. (dot dot) in the theme p… | Patch early | 5.0 medium | 2.7% | 2008-10-28 |
| CVE-2008-6010 EXP | Multiple directory traversal vulnerabilities in SG Real Estate Portal 2.0 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1)… | Patch early | 5.0 medium | 2.7% | 2009-01-30 |
| CVE-2008-6139 EXP | Directory traversal vulnerability in faqsupport/wce.download.php in WebBiscuits Modules Controller 1.1 allows remote attackers to read arbitrary files… | Patch early | 5.0 medium | 2.7% | 2009-02-14 |
| CVE-2008-6933 EXP | Directory traversal vulnerability in index.php in MiniGal b13 (aka MG2) allows remote attackers to read the source code of .php files, and possibly th… | Patch early | 5.0 medium | 2.7% | 2009-08-11 |
| CVE-2008-0542 EXP | Directory traversal vulnerability in thumbnail.php in Gerd Tentler Simple Forum 3.2 allows remote attackers to read arbitrary files via a .. (dot dot)… | Patch early | 5.0 medium | 2.7% | 2008-02-01 |
| CVE-2008-0813 EXP | Directory traversal vulnerability in Download.php in XPWeb 3.0.1, 3.3.2, and possibly other versions, allows remote attackers to read arbitrary files… | Patch early | 5.0 medium | 2.7% | 2008-02-19 |
| CVE-2008-0905 EXP | Directory traversal vulnerability in globsy_edit.php in Globsy 1.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the file para… | Patch early | 5.0 medium | 2.7% | 2008-02-22 |
| CVE-2008-1755 EXP | Directory traversal vulnerability in the showSource function in showSource.php in World of Phaos 4.0.1 allows remote attackers to read arbitrary files… | Patch early | 5.0 medium | 2.7% | 2008-04-11 |
| CVE-2008-1799 EXP | Directory traversal vulnerability in thumbnails.php in sabros.us 1.75 allows remote attackers to read arbitrary files via a .. (dot dot) in the img pa… | Patch early | 5.0 medium | 2.7% | 2008-04-15 |
| CVE-2008-1849 EXP | Directory traversal vulnerability in index.php in the joomlaXplorer (com_joomlaxplorer) Mambo/Joomla! component 1.6.2 and earlier allows remote attack… | Patch early | 5.0 medium | 2.7% | 2008-04-16 |
| CVE-2008-2342 EXP | Directory traversal vulnerability in attachments.php in News Manager 2.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the id… | Patch early | 5.0 medium | 2.7% | 2008-05-19 |
| CVE-2008-2838 EXP | Directory traversal vulnerability in index.php in Traindepot 0.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the module para… | Patch early | 5.0 medium | 2.7% | 2008-06-24 |
| CVE-2008-2961 EXP | Multiple directory traversal vulnerabilities in view/index.php in CMS Mini 0.2.2 allow remote attackers to read arbitrary local files via a .. (dot do… | Patch early | 5.0 medium | 2.7% | 2008-07-02 |
| CVE-2019-14804 EXP | studio/polyglot.php?page=etemplates in UNA 10.0.0-RC1 allows XSS via the System Name field under Emails during template editing. | Patch early | 4.8 medium | 2.7% | 2019-08-09 |
| CVE-2020-10596 EXP | OpenCart 3.0.3.2 allows remote authenticated users to conduct XSS attacks via a crafted filename in the users' image upload section. | Patch early | 5.4 medium | 2.7% | 2020-03-17 |
| CVE-2006-4418 EXP | Directory traversal vulnerability in index.php for Wikepage 2006.2a Opus 10 allows remote attackers to include arbitrary local files via the lng param… | Patch early | 4.0 medium | 2.7% | 2006-08-28 |
| CVE-2008-3607 EXP | The IMAP server in NoticeWare Email Server NG 4.6.3 and earlier allows remote attackers to cause a denial of service (daemon crash) via multiple long… | Patch early | 5.0 medium | 2.7% | 2008-08-12 |
| CVE-2006-6755 EXP | Ixprim 1.2 allows remote attackers to obtain sensitive information via a direct request for kernel/plugins/fckeditor2/ixprim_api.php, which reveals th… | Patch early | 5.0 medium | 2.7% | 2006-12-27 |
| CVE-2006-1508 EXP | Multiple cross-site scripting (XSS) vulnerabilities in MH Software Connect Daily Web Calendar Software 3.2.9 and earlier allow remote attackers to inj… | Patch early | 4.3 medium | 2.7% | 2006-03-30 |
| CVE-2004-2447 EXP | Cross-site scripting (XSS) vulnerability in 1st Class Mail Server 4.01 allows remote attackers to inject arbitrary web script or HTML via the Mailbox… | Patch early | 4.3 medium | 2.7% | 2004-12-31 |
| CVE-2006-0496 EXP | Cross-site scripting (XSS) vulnerability in Mozilla 1.7.12 and possibly earlier, Mozilla Firefox 1.0.7 and possibly earlier, and Netscape 8.1 and poss… | Patch early | 4.3 medium | 2.7% | 2006-02-01 |
| CVE-2007-4641 EXP | Directory traversal vulnerability in index.php in Pakupaku CMS 0.4 and earlier allows remote attackers to include and execute arbitrary local files vi… | Patch early | 6.4 medium | 2.7% | 2007-08-31 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt