CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
404,373 CVEs
1,739 on KEV
17,299 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-11
150,843 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2018-5720 EXP | An issue was discovered on DODOCOOL DC38 3-in-1 N300 Mini Wireless Range Extend RTN2-AW.GD.R3465.1.20161103 devices. A Cross-site request forgery (CSR… | Patch early | 8.8 high | 2.7% | 2018-01-29 |
| CVE-2007-5488 EXP | Multiple SQL injection vulnerabilities in cdr_addon_mysql in Asterisk-Addons before 1.2.8, and 1.4.x before 1.4.4, allow remote attackers to execute a… | Patch early | 7.5 high | 2.7% | 2007-10-17 |
| CVE-2007-3201 EXP | Visual truncation vulnerability in Windows Privacy Tray (WinPT) 1.2.0 allows user-assisted remote attackers to install a key listed under the wrong us… | Patch early | 7.1 high | 2.7% | 2007-06-12 |
| CVE-2014-2022 EXP | SQL injection vulnerability in includes/api/4/breadcrumbs_create.php in vBulletin 4.2.2, 4.2.1, 4.2.0 PL2, and earlier allows remote authenticated use… | Patch early | 7.1 high | 2.7% | 2014-10-15 |
| CVE-2008-2346 EXP | AlkalinePHP 0.77.35 and earlier allows remote attackers to bypass authentication and gain administrative access by creating an admin account via a dir… | Patch early | 7.5 high | 2.7% | 2008-05-20 |
| CVE-2004-2036 EXP | SQL injection vulnerability in the art_print function in print.inc.php in unknown versions of jPortal before 2.3.1 allows remote attackers to inject a… | Patch early | 7.5 high | 2.7% | 2004-05-28 |
| CVE-2005-2323 EXP | Multiple SQL injection vulnerabilities in Class-1 Forum 0.24.4 and 0.23.2, and Clever Copy with forums installed, allow remote attackers to modify SQL… | Patch early | 7.5 high | 2.7% | 2005-07-19 |
| CVE-2015-1428 EXP | Multiple SQL injection vulnerabilities in Sefrengo before 1.6.2 allow (1) remote attackers to execute arbitrary SQL commands via the sefrengo cookie i… | Patch early | 7.5 high | 2.7% | 2015-02-03 |
| CVE-2004-1601 EXP | Directory traversal vulnerability in index.php in CoolPHP 1.0-stable allows remote attackers to access arbitrary files and execute local PHP scripts v… | Patch early | 7.5 high | 2.7% | 2004-10-16 |
| CVE-2006-6093 EXP | Multiple PHP remote file inclusion vulnerabilities in adminprint.php in PicturesPro Photo Cart 3.9 allow remote attackers to execute arbitrary PHP cod… | Patch early | 7.5 high | 2.7% | 2006-11-24 |
| CVE-2010-4839 EXP | SQL injection vulnerability in the Event Registration plugin 5.32 and earlier for WordPress allows remote attackers to execute arbitrary SQL commands… | Patch early | 7.5 high | 2.7% | 2011-09-14 |
| CVE-2001-1326 EXP | Eudora 5.1 allows remote attackers to execute arbitrary code when the "Use Microsoft Viewer" option is enabled and the "allow executables in HTML cont… | Patch early | 7.5 high | 2.7% | 2001-05-29 |
| CVE-2018-8584 EXP | An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC), aka "Windows ALPC Elevat… | Patch early | 7.8 high | 2.7% | 2018-11-14 |
| CVE-2021-36520 EXP | A SQL injection vulnerability in I-Tech Trainsmart r1044 exists via a evaluation/assign-evaluation?id= URI. | Patch early | 7.5 high | 2.7% | 2023-04-16 |
| CVE-2010-0233 EXP | Double free vulnerability in the kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold… | Patch early | 7.2 high | 2.7% | 2010-02-10 |
| CVE-2002-2106 EXP | PHP remote file inclusion vulnerability in WikkiTikkiTavi before 0.21 allows remote attackers to execute arbitrary PHP code via the TemplateDir variab… | Patch early | 7.5 high | 2.7% | 2002-12-31 |
| CVE-2006-1347 EXP | SQL injection vulnerability in loginfunction.php in Greg Neustaetter gCards 1.45 and earlier allows remote attackers to execute arbitrary SQL commands… | Patch early | 7.5 high | 2.7% | 2006-03-22 |
| CVE-2015-0058 EXP | Double free vulnerability in win32k.sys in the kernel-mode drivers in Microsoft Windows 8.1, Windows Server 2012 R2, and Windows RT 8.1 allows local u… | Patch early | 7.2 high | 2.7% | 2015-02-11 |
| CVE-2017-14842 EXP | Mojoomla SMSmaster Multipurpose SMS Gateway for WordPress allows SQL Injection via the id parameter. | Patch early | 8.8 high | 2.7% | 2017-09-28 |
| CVE-2017-14843 EXP | Mojoomla School Management System for WordPress allows SQL Injection via the id parameter. | Patch early | 8.8 high | 2.7% | 2017-09-28 |
| CVE-2017-14844 EXP | Mojoomla WPGYM WordPress Gym Management System allows SQL Injection via the id parameter. | Patch early | 8.8 high | 2.7% | 2017-09-28 |
| CVE-2017-14845 EXP | Mojoomla WPCHURCH Church Management System for WordPress allows SQL Injection via the id parameter. | Patch early | 8.8 high | 2.7% | 2017-09-28 |
| CVE-2017-14846 EXP | Mojoomla Hospital Management System for WordPress allows SQL Injection via the id parameter. | Patch early | 8.8 high | 2.7% | 2017-09-28 |
| CVE-2017-14847 EXP | Mojoomla WPAMS Apartment Management System for WordPress allows SQL Injection via the id parameter. | Patch early | 8.8 high | 2.7% | 2017-09-28 |
| CVE-2008-6496 EXP | Insecure method vulnerability in the VSPDFEditorX.VSPDFEdit ActiveX control in VSPDFEditorX.ocx 1.0.200.0 in VISAGESOFT eXPert PDF EditorX allows remo… | Patch early | 8.8 high | 2.7% | 2009-03-20 |
| CVE-2007-4341 EXP | PHP remote file inclusion vulnerability in adm/my_statistics.php in Omnistar Lib2 PHP 0.2 allows remote attackers to execute arbitrary PHP code via a… | Patch early | 7.5 high | 2.7% | 2007-08-14 |
| CVE-2006-3027 EXP | Multiple SQL injection vulnerabilities in Enthrallwebe ePhotos 2.2 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) CA… | Patch early | 7.5 high | 2.7% | 2006-06-15 |
| CVE-2009-2080 EXP | admin.php in MRCGIGUY The Ticket System 2.0 does not properly restrict access, which allows remote attackers to (1) obtain sensitive configuration inf… | Patch early | 7.5 high | 2.7% | 2009-06-16 |
| CVE-2006-1714 EXP | CRLF injection vulnerability in index.php in Christoph Roeder phpMyForum 4.0 allows remote attackers to inject HTTP headers via hex-encoded CRLF seque… | Patch early | 7.5 high | 2.7% | 2006-04-11 |
| CVE-2006-2521 EXP | PHP remote file inclusion vulnerability in cron.php in phpMyDirectory 10.4.4 and earlier allows remote attackers to execute arbitrary PHP code via a U… | Patch early | 7.5 high | 2.7% | 2006-05-22 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt