CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
403,813 CVEs
1,739 on KEV
17,300 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-10
170,990 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2005-4166 EXP | Cross-site scripting (XSS) vulnerability in password.asp in DUWare DUportal Pro 3.4.3 allows remote attackers to inject arbitrary web script or HTML v… | Patch early | 4.3 medium | 1.8% | 2005-12-11 |
| CVE-2005-4239 EXP | Cross-site scripting (XSS) vulnerability in Search/DisplayResults.php in PHP JackKnife 2.21 and earlier allows remote attackers to inject arbitrary we… | Patch early | 4.3 medium | 1.8% | 2005-12-14 |
| CVE-2005-4241 EXP | Cross-site scripting (XSS) vulnerability in the category page in VCD-db 0.98 and earlier allows remote attackers to inject arbitrary web script or HTM… | Patch early | 4.3 medium | 1.8% | 2005-12-14 |
| CVE-2005-4255 EXP | Cross-site scripting (XSS) vulnerability in TextSearch in WikkaWiki 1.1.6.0 allows remote attackers to inject arbitrary web script or HTML via a hex-e… | Patch early | 4.3 medium | 1.8% | 2005-12-15 |
| CVE-2005-4285 EXP | Cross-site scripting (XSS) vulnerability in pdestore.cgi in Dick Copits PDEstore 1.8 and earlier allows remote attackers to inject arbitrary web scrip… | Patch early | 4.3 medium | 1.8% | 2005-12-16 |
| CVE-2005-4290 EXP | Cross-site scripting (XSS) vulnerability in index.cgi in ECW-Cart 2.03 and earlier allows remote attackers to inject arbitrary web script or HTML via… | Patch early | 4.3 medium | 1.8% | 2005-12-16 |
| CVE-2005-4291 EXP | Cross-site scripting (XSS) vulnerability in cart.cgi in ECTOOLS Onlineshop 1.0 and earlier allows remote attackers to inject arbitrary web script or H… | Patch early | 4.3 medium | 1.8% | 2005-12-16 |
| CVE-2005-4314 EXP | Cross-site scripting (XSS) vulnerability in ppcal.cgi in PPCal Shopping Cart 3.3.0 and earlier allows remote attackers to inject arbitrary web script… | Patch early | 4.3 medium | 1.8% | 2005-12-17 |
| CVE-2005-4328 EXP | Cross-site scripting (XSS) vulnerability in webglimpse.cgi in Webglimpse 2.14.1 and earlier allows remote attackers to inject arbitrary web script or… | Patch early | 4.3 medium | 1.8% | 2005-12-17 |
| CVE-2005-4488 EXP | Multiple cross-site scripting (XSS) vulnerabilities in index.tpl in Redakto WCMS 3.2 and earlier allow remote attackers to inject arbitrary web script… | Patch early | 4.3 medium | 1.8% | 2005-12-22 |
| CVE-2006-0715 EXP | Cross-site scripting (XSS) vulnerability in sNews 1.3 allows remote attackers to inject arbitrary web script or HTML via the comment field. | Patch early | 4.3 medium | 1.8% | 2006-02-15 |
| CVE-2006-0792 EXP | Cross-site scripting (XSS) vulnerability in preferences.personal.php in V-webmail 1.6.2 allows remote attackers to inject arbitrary web script or HTML… | Patch early | 4.3 medium | 1.8% | 2006-02-19 |
| CVE-2006-1021 EXP | Cross-site scripting (XSS) vulnerability in sol_menu.php in PeHePe Uyelik Sistemi (aka PeHePe MemberShip Management System) 3 allows remote attackers… | Patch early | 4.3 medium | 1.8% | 2006-03-07 |
| CVE-2006-1131 EXP | Cross-site scripting (XSS) vulnerability in read.php in bitweaver CMS 1.2.1 allows remote attackers to inject arbitrary web script or HTML via the com… | Patch early | 4.3 medium | 1.8% | 2006-03-10 |
| CVE-2004-1537 EXP | Cross-site scripting (XSS) vulnerability in popup.php in PHPKIT 1.6.03 through 1.6.1 allows remote attackers to execute arbitrary web script via the i… | Patch early | 4.3 medium | 1.8% | 2004-12-31 |
| CVE-2004-2007 EXP | Cross-site scripting (XSS) vulnerability in modules.php in NukeJokes 1.7 and 2 Beta allows remote attackers to inject arbitrary HTML or web script via… | Patch early | 4.3 medium | 1.8% | 2004-05-08 |
| CVE-2005-0270 EXP | Multiple cross-site scripting (XSS) vulnerabilities in ReviewPost PHP Pro before 2.84 allow remote attackers to inject arbitrary web script or HTML vi… | Patch early | 4.3 medium | 1.8% | 2005-05-02 |
| CVE-2019-9553 EXP | Bolt 3.6.4 has XSS via the slug, teaser, or title parameter to editcontent/pages, a related issue to CVE-2017-11128 and CVE-2018-19933. | Patch early | 6.1 medium | 1.8% | 2019-12-31 |
| CVE-2008-6848 EXP | Cross-site scripting (XSS) vulnerability in index.php in phpGreetCards 3.7 allows remote attackers to inject arbitrary web script or HTML via the cate… | Patch early | 4.3 medium | 1.8% | 2009-07-07 |
| CVE-2008-6977 EXP | Cross-site scripting (XSS) vulnerability in album.asp in Full Revolution aspWebAlbum 3.2 allows remote attackers to inject arbitrary web script or HTM… | Patch early | 4.3 medium | 1.8% | 2009-08-19 |
| CVE-2011-1062 EXP | Multiple cross-site scripting (XSS) vulnerabilities in include/html/header.php in TaskFreak! 0.6.4 allow remote attackers to inject arbitrary web scri… | Patch early | 4.3 medium | 1.8% | 2011-02-23 |
| CVE-2018-12094 EXP | Cross-site scripting (XSS) vulnerability in news.php in Dimofinf CMS Version 3.0.0 allows remote attackers to inject arbitrary web script or HTML via… | Patch early | 5.4 medium | 1.8% | 2018-06-11 |
| CVE-2015-7566 EXP | The clie_5_attach function in drivers/usb/serial/visor.c in the Linux kernel through 4.4.1 allows physically proximate attackers to cause a denial of… | Patch early | 4.6 medium | 1.8% | 2016-02-08 |
| CVE-2005-1077 EXP | Multiple cross-site scripting (XSS) vulnerabilities in XAMPP 1.4.x allow remote attackers to inject arbitrary web script or HTML via (1) cds.php, (2)… | Patch early | 4.3 medium | 1.8% | 2005-04-12 |
| CVE-2008-6838 EXP | Cross-site scripting (XSS) vulnerability in search.php in Zoph 0.7.2.1 allows remote attackers to inject arbitrary web script or HTML via the _off par… | Patch early | 4.3 medium | 1.8% | 2009-06-27 |
| CVE-2002-2178 EXP | Cross-site scripting (XSS) vulnerability in article.php module for phpWebSite 0.8.3 allows remote attackers to execute arbitrary Javascript script via… | Patch early | 4.3 medium | 1.7% | 2002-12-31 |
| CVE-2012-2179 EXP | libodm.a in IBM AIX 5.3, 6.1, and 7.1 allows local users to overwrite arbitrary files via a symlink attack on a temporary file. | Patch early | 6.9 medium | 1.7% | 2012-06-22 |
| CVE-2006-2374 EXP | The Server Message Block (SMB) driver (MRXSMB.SYS) in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 and earlier allows local users t… | Patch early | 5.5 medium | 1.7% | 2006-06-13 |
| CVE-1999-0671 EXP | Buffer overflow in ToxSoft NextFTP client through CWD command. | Patch early | 5.1 medium | 1.7% | 1999-08-03 |
| CVE-2005-4400 EXP | Cross-site scripting (XSS) vulnerability in downloads/portal_ent in Liferay Portal Enterprise 3.6.1 and earlier allows remote attackers to inject arbi… | Patch early | 4.3 medium | 1.7% | 2005-12-20 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt