CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
403,932 CVEs
1,739 on KEV
17,300 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-10
208,037 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2007-6271 EXP | Absolute News Manager.NET 5.1 allows remote attackers to obtain sensitive information via a direct request to getpath.aspx, which reveals the installa… | Patch early | 5.0 medium | 2.7% | 2007-12-07 |
| CVE-2003-1480 EXP | MySQL 3.20 through 4.1.0 uses a weak algorithm for hashed passwords, which makes it easier for attackers to decrypt the password via brute force metho… | Patch early | 4.3 medium | 2.7% | 2003-12-31 |
| CVE-2022-4944 EXP | A vulnerability, which was classified as problematic, has been found in kalcaddle KodExplorer up to 4.49. Affected by this issue is some unknown funct… | Patch early | 4.3 medium | 2.7% | 2023-04-22 |
| CVE-2007-6488 EXP | Multiple PHP remote file inclusion vulnerabilities in Falcon Series One CMS 1.4.3 allow remote attackers to execute arbitrary PHP code via a URL in (1… | Patch early | 6.8 medium | 2.7% | 2007-12-20 |
| CVE-2002-2403 EXP | Directory traversal vulnerability in KeyFocus web server 1.0.8 allows remote attackers to read arbitrary files for recognized MIME type files via "...… | Patch early | 5.0 medium | 2.7% | 2002-12-31 |
| CVE-2008-5579 EXP | Absolute path traversal vulnerability in mini-pub.php/front-end/cat.php in mini-pub 0.3 allows remote attackers to read arbitrary files via a full pat… | Patch early | 5.0 medium | 2.7% | 2008-12-15 |
| CVE-2006-4448 EXP | Multiple PHP remote file inclusion vulnerabilities in interact 2.2, when register_globals is enabled, allow remote attackers to execute arbitrary PHP… | Patch early | 5.1 medium | 2.7% | 2006-08-30 |
| CVE-2011-5025 EXP | Multiple cross-site scripting (XSS) vulnerabilities in the wiki application in Yaws 1.88 allow remote attackers to inject arbitrary web script or HTML… | Patch early | 4.3 medium | 2.7% | 2011-12-29 |
| CVE-2007-3492 EXP | Conti FtpServer 1.0 allows remote authenticated users to cause a denial of service (daemon crash) via a certain string containing "//A:" in the argume… | Patch early | 6.8 medium | 2.7% | 2007-06-29 |
| CVE-2002-2335 EXP | Killer Protection 1.0 stores the vars.inc include file under the web root with insufficient access control, which allows remote attackers to obtain us… | Patch early | 5.0 medium | 2.7% | 2002-12-31 |
| CVE-2005-1008 EXP | Cross-site scripting (XSS) vulnerability in posts.asp for ASP-DEv XM Forum RC3 allows remote attackers to inject arbitrary web script or HTML via a "j… | Patch early | 4.3 medium | 2.7% | 2005-05-02 |
| CVE-2015-4460 EXP | Cross-site request forgery (CSRF) vulnerability in SecuritySetting/UserSecurity/UserManagement.aspx in B.A.S C2Box before 4.0.0 (r19171) allows remote… | Patch early | 6.8 medium | 2.7% | 2015-07-16 |
| CVE-2014-5346 EXP | Multiple cross-site request forgery (CSRF) vulnerabilities in the Disqus Comment System plugin 2.77 for WordPress allow remote attackers to hijack the… | Patch early | 6.8 medium | 2.7% | 2014-08-19 |
| CVE-2010-1734 EXP | The SfnINSTRING function in win32k.sys in the kernel in Microsoft Windows 2000, XP, and Server 2003 allows local users to cause a denial of service (s… | Patch early | 4.9 medium | 2.7% | 2010-05-06 |
| CVE-2010-4313 EXP | Unrestricted file upload vulnerability in fileman_file_upload.php in Orbis CMS 1.0.2 allows remote authenticated users to execute arbitrary code by up… | Patch early | 6.0 medium | 2.7% | 2010-12-02 |
| CVE-2010-4258 EXP | The do_exit function in kernel/exit.c in the Linux kernel before 2.6.36.2 does not properly handle a KERNEL_DS get_fs value, which allows local users… | Patch early | 6.2 medium | 2.7% | 2010-12-30 |
| CVE-2007-1138 EXP | Absolute path traversal vulnerability in list_main_pages.php in Cromosoft Simple Plantilla PHP (SPP) allows remote attackers to list arbitrary directo… | Patch early | 5.0 medium | 2.7% | 2007-03-02 |
| CVE-2006-6598 EXP | Directory traversal vulnerability in viewnfo.php in (1) TorrentFlux before 2.2 and (2) torrentflux-b4rt before 2.1-b4rt-972 allows remote authenticate… | Patch early | 6.5 medium | 2.7% | 2006-12-15 |
| CVE-2002-2258 EXP | Moby NetSuite allows remote attackers to cause a denial of service (crash) via an HTTP POST request with a (1) large integer or (2) non-numeric value… | Patch early | 5.0 medium | 2.7% | 2002-12-31 |
| CVE-2008-1854 EXP | Unspecified vulnerability in SmarterMail Web Server (SMWebSvr.exe) in SmarterMail 5.0.2999 allows remote attackers to cause a denial of service (servi… | Patch early | 5.0 medium | 2.7% | 2008-04-16 |
| CVE-2009-3662 EXP | FileCopa FTP Server 5.01 allows remote attackers to cause a denial of service (server hang) via a large number of crafted NOOP commands. | Patch early | 5.0 medium | 2.7% | 2009-10-11 |
| CVE-2018-7177 EXP | SQL Injection exists in the Saxum Numerology 3.0.4 component for Joomla! via the publicid parameter. | Patch early | 9.8 critical | 2.7% | 2018-02-17 |
| CVE-2018-7179 EXP | SQL Injection exists in the SquadManagement 1.0.3 component for Joomla! via the id parameter. | Patch early | 9.8 critical | 2.7% | 2018-02-17 |
| CVE-2018-7312 EXP | SQL Injection exists in the Alexandria Book Library 3.1.2 component for Joomla! via the letter parameter. | Patch early | 9.8 critical | 2.7% | 2018-02-22 |
| CVE-2018-7315 EXP | SQL Injection exists in the Ek Rishta 2.9 component for Joomla! via the gender, age1, age2, religion, mothertounge, caste, or country parameter. | Patch early | 9.8 critical | 2.7% | 2018-02-22 |
| CVE-2018-7477 EXP | SQL Injection exists in PHP Scripts Mall School Management Script 3.0.4 via the Username and Password fields to parents/Parent_module/parent_login.php… | Patch early | 9.8 critical | 2.7% | 2018-02-28 |
| CVE-2018-5970 EXP | SQL Injection exists in the JGive 2.0.9 component for Joomla! via the filter_org_ind_type or campaign_countries parameter. | Patch early | 9.8 critical | 2.7% | 2018-02-17 |
| CVE-2018-5971 EXP | SQL Injection exists in the MediaLibrary Free 4.0.12 component for Joomla! via the id parameter or the mid array parameter. | Patch early | 9.8 critical | 2.7% | 2018-02-17 |
| CVE-2018-5974 EXP | SQL Injection exists in the SimpleCalendar 3.1.9 component for Joomla! via the catid array parameter. | Patch early | 9.8 critical | 2.7% | 2018-02-17 |
| CVE-2018-5975 EXP | SQL Injection exists in the Smart Shoutbox 3.0.0 component for Joomla! via the shoutauthor parameter to the archive URI. | Patch early | 9.8 critical | 2.7% | 2018-02-17 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt