CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
404,806 CVEs
1,739 on KEV
17,301 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-12
208,556 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2018-6005 EXP | SQL Injection exists in the Realpin through 1.5.04 component for Joomla! via the pinboard parameter. | Patch early | 9.8 critical | 2.7% | 2018-02-17 |
| CVE-2018-6368 EXP | SQL Injection exists in the JomEstate PRO through 3.7 component for Joomla! via the id parameter in a task=detailed action. | Patch early | 9.8 critical | 2.7% | 2018-02-17 |
| CVE-2018-6370 EXP | SQL Injection exists in the NeoRecruit 4.1 component for Joomla! via the (1) PATH_INFO or (2) name of a .html file under the all-offers/ URI. | Patch early | 9.8 critical | 2.7% | 2018-02-17 |
| CVE-2018-6372 EXP | SQL Injection exists in the JB Bus 2.3 component for Joomla! via the order_number parameter. | Patch early | 9.8 critical | 2.7% | 2018-02-17 |
| CVE-2018-6394 EXP | SQL Injection exists in the InviteX 3.0.5 component for Joomla! via the invite_type parameter in a view=invites action. | Patch early | 9.8 critical | 2.7% | 2018-02-17 |
| CVE-2018-6395 EXP | SQL Injection exists in the Visual Calendar 3.1.3 component for Joomla! via the id parameter in a view=load action. | Patch early | 9.8 critical | 2.7% | 2018-01-30 |
| CVE-2018-6398 EXP | SQL Injection exists in the CP Event Calendar 3.0.1 component for Joomla! via the id parameter in a task=load action. | Patch early | 9.8 critical | 2.7% | 2018-01-30 |
| CVE-2018-6575 EXP | SQL Injection exists in the JEXTN Classified 1.0.0 component for Joomla! via a view=boutique&sid= request. | Patch early | 9.8 critical | 2.7% | 2018-02-02 |
| CVE-2018-6576 EXP | SQL Injection exists in Event Manager 1.0 via the event.php id parameter or the page.php slug parameter. | Patch early | 9.8 critical | 2.7% | 2018-02-02 |
| CVE-2018-6581 EXP | SQL Injection exists in the JMS Music 1.1.1 component for Joomla! via a search with the keyword, artist, or username parameter. | Patch early | 9.8 critical | 2.7% | 2018-02-02 |
| CVE-2018-6585 EXP | SQL Injection exists in the JTicketing 2.0.16 component for Joomla! via a view=events action with a filter_creator or filter_events_cat parameter. | Patch early | 9.8 critical | 2.7% | 2018-02-17 |
| CVE-2018-6604 EXP | SQL Injection exists in the Zh YandexMap 6.2.1.0 component for Joomla! via the id parameter in a task=getPlacemarkDetails request. | Patch early | 9.8 critical | 2.7% | 2018-02-05 |
| CVE-2018-6609 EXP | SQL Injection exists in the JSP Tickets 1.1 component for Joomla! via the ticketcode parameter in a ticketlist edit action, or the id parameter in a s… | Patch early | 9.8 critical | 2.7% | 2018-02-05 |
| CVE-2006-5016 EXP | Unrestricted file upload vulnerability in admin/x_image.php in Szava Gyula and Csaba Tamas e-Vision CMS, probably 1.0, allows remote attackers to uplo… | Patch early | 5.0 medium | 2.7% | 2006-09-27 |
| CVE-2007-1516 EXP | PHP remote file inclusion vulnerability in functions/update.php in Cicoandcico CcMail 1.0 allows remote attackers to execute arbitrary PHP code via a… | Patch early | 6.8 medium | 2.7% | 2007-03-20 |
| CVE-2007-1907 EXP | PHP remote file inclusion vulnerability in warn.php in Pathos Content Management System (CMS) 0.92-2 allows remote attackers to execute arbitrary PHP… | Patch early | 6.8 medium | 2.7% | 2007-04-10 |
| CVE-2008-3368 EXP | PHP remote file inclusion vulnerability in tools/packages/import.php in ATutor 1.6.1 pl1 and earlier allows remote authenticated administrators to exe… | Patch early | 6.5 medium | 2.7% | 2008-07-30 |
| CVE-2009-0673 EXP | Eval injection vulnerability in the Custom Fields feature in the Your Account module in Raven Web Services RavenNuke 2.30 allows remote authenticated… | Patch early | 6.5 medium | 2.7% | 2009-02-22 |
| CVE-2014-8674 EXP | Multiple Cross-Site Scripting (XSS) vulnerabilities exist in Simple Online Planning (SOPlanning) before 1.33 via the document.cookie in nb_mois and mb… | Patch early | 5.4 medium | 2.6% | 2020-01-06 |
| CVE-2002-2351 EXP | Eudora 5.1 allows remote attackers to bypass security warnings and possibly execute arbitrary code via attachments with names containing a trailing ".… | Patch early | 6.4 medium | 2.6% | 2002-12-31 |
| CVE-2014-9236 EXP | Cross-site scripting (XSS) vulnerability in php/edit_photos.php in Zoph (aka Zoph Organizes Photos) 0.9.1 and earlier allows remote attackers to injec… | Patch early | 4.3 medium | 2.6% | 2014-12-03 |
| CVE-2011-1872 EXP | Hyper-V in Microsoft Windows Server 2008 Gold, SP2, R2, and R2 SP1 allows guest OS users to cause a denial of service (host OS infinite loop) via malf… | Patch early | 4.7 medium | 2.6% | 2011-06-16 |
| CVE-2016-6851 EXP | An issue was discovered in Open-Xchange OX Guard before 2.4.2-rev5. Script code can be provided as parameter to the OX Guard guest reader web applicat… | Patch early | 6.1 medium | 2.6% | 2016-12-15 |
| CVE-2013-6128 EXP | The KCHARTXYLib.KChartXY ActiveX control in KChartXY.ocx before 65.30.30000.10002 in WellinTech KingView before 6.53 does not properly restrict SaveTo… | Patch early | 5.8 medium | 2.6% | 2013-10-25 |
| CVE-2007-3535 EXP | Multiple directory traversal vulnerabilities in GL-SH Deaf Forum 6.4.4 and earlier allow remote attackers to include and execute arbitrary local files… | Patch early | 6.4 medium | 2.6% | 2007-07-03 |
| CVE-2005-0936 EXP | Cross-site scripting vulnerability in products1h.php in ESMI PayPal Storefront allows remote attackers to inject arbitrary web script or HTML via the… | Patch early | 5.0 medium | 2.6% | 2005-05-02 |
| CVE-2006-2608 EXP | artmedic newsletter 4.1 and possibly other versions, when register_globals is enabled, allows remote attackers to modify arbitrary files and execute a… | Patch early | 5.1 medium | 2.6% | 2006-05-26 |
| CVE-2014-4162 EXP | Multiple cross-site request forgery (CSRF) vulnerabilities in the Zyxel P-660HW-T1 (v3) wireless router allow remote attackers to hijack the authentic… | Patch early | 6.8 medium | 2.6% | 2014-06-16 |
| CVE-2014-7281 EXP | Cross-site request forgery (CSRF) vulnerability in Shenzhen Tenda Technology Tenda A32 Router with firmware 5.07.53_CN allows remote attackers to hija… | Patch early | 6.8 medium | 2.6% | 2014-10-23 |
| CVE-2009-4224 EXP | Multiple PHP remote file inclusion vulnerabilities in SweetRice 0.5.4, 0.5.3, and earlier allow remote attackers to execute arbitrary PHP code via a U… | Patch early | 6.8 medium | 2.6% | 2009-12-07 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt