CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
403,734 CVEs
1,739 on KEV
17,300 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-10
170,949 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2008-7073 EXP | PHP remote file inclusion vulnerability in lib/action/rss.php in RSS module 0.1 for Pie Web M{a,e}sher, when register_globals is enabled, allows remot… | Patch early | 6.8 medium | 1.8% | 2009-08-25 |
| CVE-2008-2220 EXP | Multiple PHP remote file inclusion vulnerabilities in Interact Learning Community Environment Interact 2.4.1, when register_globals is enabled, allow… | Patch early | 6.8 medium | 1.8% | 2008-05-14 |
| CVE-2008-2877 EXP | PHP remote file inclusion vulnerability in admin/include/lib.module.php in cmsWorks 2.2 RC4, when register_globals is enabled, allows remote attackers… | Patch early | 6.8 medium | 1.8% | 2008-06-26 |
| CVE-2007-4314 EXP | pixlie.php in Pixlie 1.7 allows remote attackers to trigger the reading and JPEG image processing of files in a remote directory tree via a URL in the… | Patch early | 6.8 medium | 1.8% | 2007-08-13 |
| CVE-2002-1805 EXP | Cross-site scripting (XSS) vulnerability in DaCode 1.2.0 allows remote attackers to inject arbitrary web script or HTML via Javascript in an IMG tag. | Patch early | 4.3 medium | 1.8% | 2002-12-31 |
| CVE-2005-0274 EXP | Multiple cross-site scripting (XSS) vulnerabilities in showgallery.php in PhotoPost before 4.86 allow remote attackers to inject arbitrary web script… | Patch early | 4.3 medium | 1.8% | 2005-01-03 |
| CVE-2005-2163 EXP | Cross-site scripting (XSS) vulnerability in index.php in AutoIndex PHP Script 1.5.2 allows remote attackers to inject arbitrary web script or HTML via… | Patch early | 4.3 medium | 1.8% | 2005-07-06 |
| CVE-2007-5915 EXP | Directory traversal vulnerability in index.php in phphelpdesk 0.6.16 allows remote attackers to include and execute arbitrary local files via a .. (do… | Patch early | 6.8 medium | 1.8% | 2007-11-10 |
| CVE-2007-0763 EXP | Cross-site scripting (XSS) vulnerability in the news comment functionality in F3Site 2.1 and earlier allows remote attackers to inject arbitrary web s… | Patch early | 6.8 medium | 1.8% | 2007-02-06 |
| CVE-2018-11332 EXP | Stored cross-site scripting (XSS) vulnerability in the "Site Name" field found in the "site" tab under configurations in ClipperCMS 1.3.3 allows remot… | Patch early | 4.8 medium | 1.8% | 2018-05-24 |
| CVE-2007-1506 EXP | Cross-site scripting (XSS) vulnerability in PORTAL.wwv_main.render_warning_screen in the Oracle Portal 10g allows remote attackers to inject arbitrary… | Patch early | 4.3 medium | 1.8% | 2007-03-19 |
| CVE-2007-3553 EXP | Cross-site scripting (XSS) vulnerability in Rapid Install Web Server in Oracle Application Server 11i allows remote attackers to inject arbitrary web… | Patch early | 4.3 medium | 1.8% | 2007-07-03 |
| CVE-2004-1499 EXP | Cross-site scripting (XSS) vulnerability in the compose message form in HELM 3.1.19 and earlier allows remote attackers to execute arbitrary web scrip… | Patch early | 4.3 medium | 1.8% | 2004-12-31 |
| CVE-2004-1872 EXP | Cross-site scripting (XSS) vulnerability in WebCT Campus Edition 4.1.1.5 allows remote attackers to inject arbitrary web script or HTML via the @impor… | Patch early | 4.3 medium | 1.8% | 2004-03-29 |
| CVE-2004-1935 EXP | Cross-site scripting (XSS) vulnerability in SCT Campus Pipeline allows remote attackers to inject arbitrary web script or HTML via onload, onmouseover… | Patch early | 4.3 medium | 1.8% | 2004-04-15 |
| CVE-2004-2096 EXP | Cross-site scripting (XSS) vulnerability in Mephistoles httpd 0.6.0 final allows remote attackers to execute arbitrary script as other users by inject… | Patch early | 4.3 medium | 1.8% | 2004-12-31 |
| CVE-2015-2999 EXP | Multiple SQL injection vulnerabilities in SysAid Help Desk before 15.2 allow remote administrators to execute arbitrary SQL commands via the (1) group… | Patch early | 6.5 medium | 1.8% | 2015-06-08 |
| CVE-2006-1613 EXP | Multiple SQL injection vulnerabilities in aWebNews 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) user123 variable in (a) lo… | Patch early | 5.0 medium | 1.8% | 2006-04-04 |
| CVE-2010-4513 EXP | Multiple cross-site scripting (XSS) vulnerabilities in Zimplit CMS 3.0, and possibly earlier, allow remote attackers to inject arbitrary web script or… | Patch early | 4.3 medium | 1.8% | 2010-12-09 |
| CVE-2010-4693 EXP | Multiple cross-site scripting (XSS) vulnerabilities in Coppermine Photo Gallery 1.5.10 and earlier allow remote attackers to inject arbitrary web scri… | Patch early | 4.3 medium | 1.8% | 2011-01-11 |
| CVE-2009-0541 EXP | Multiple cross-site scripting (XSS) vulnerabilities in Magento 1.2.0 and 1.2.1.1 allow remote attackers to inject arbitrary web script or HTML via (1)… | Patch early | 4.3 medium | 1.8% | 2009-02-25 |
| CVE-2007-3517 EXP | Multiple cross-site scripting (XSS) vulnerabilities in Claroline 1.8.3 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO… | Patch early | 4.3 medium | 1.8% | 2007-07-03 |
| CVE-2007-3137 EXP | Multiple cross-site scripting (XSS) vulnerabilities in 4print.asp in WmsCMS 2.0 and earlier allow remote attackers to inject arbitrary web script or H… | Patch early | 4.3 medium | 1.8% | 2007-06-08 |
| CVE-2010-4111 EXP | Cross-site scripting (XSS) vulnerability in HP Insight Diagnostics Online Edition before 8.5.1.3712 allows remote attackers to inject arbitrary web sc… | Patch early | 4.3 medium | 1.8% | 2010-12-22 |
| CVE-2009-3360 EXP | Multiple cross-site scripting (XSS) vulnerabilities in Datemill 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) return p… | Patch early | 4.3 medium | 1.8% | 2009-09-24 |
| CVE-2010-0415 EXP | The do_pages_move function in mm/migrate.c in the Linux kernel before 2.6.33-rc7 does not validate node values, which allows local users to read arbit… | Patch early | 4.6 medium | 1.8% | 2010-02-17 |
| CVE-2012-0988 EXP | Multiple cross-site scripting (XSS) vulnerabilities in config/dmsDefaults.php in KnowledgeTree 3.7.0.2 and possibly earlier allow remote attackers to… | Patch early | 4.3 medium | 1.8% | 2012-09-20 |
| CVE-2012-5102 EXP | Cross-site scripting (XSS) vulnerability in inc/extensions.php in VertrigoServ 2.25 allows remote attackers to inject arbitrary web script or HTML via… | Patch early | 4.3 medium | 1.8% | 2012-09-23 |
| CVE-2008-1556 EXP | Multiple cross-site scripting (XSS) vulnerabilities in BolinOS 4.6.1 allow remote attackers to inject arbitrary web script or HTML via the (1) url par… | Patch early | 4.3 medium | 1.8% | 2008-03-31 |
| CVE-2008-4876 EXP | Cross-site scripting (XSS) vulnerability in the web server component in Philips Electronics VOIP841 DECT Phone with firmware 1.0.4.50 and 1.0.4.80 all… | Patch early | 4.3 medium | 1.8% | 2008-11-01 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt