CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
404,381 CVEs
1,739 on KEV
17,299 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-12
150,843 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2006-6720 EXP | PHP remote file inclusion vulnerability in admin/index_sitios.php in Azucar CMS 1.3 allows remote attackers to execute arbitrary PHP code via a URL in… | Patch early | 7.5 high | 2.7% | 2006-12-23 |
| CVE-2017-14758 EXP | OpenText Document Sciences xPression (formerly EMC Document Sciences xPression) v4.5SP1 Patch 13 (older versions might be affected as well) is prone t… | Patch early | 8.8 high | 2.7% | 2017-10-03 |
| CVE-2004-1774 EXP | Buffer overflow in the SDO_CODE_SIZE procedure of the MD2 package (MDSYS.MD2.SDO_CODE_SIZE) in Oracle 10g before 10.1.0.2 Patch 2 allows local users t… | Patch early | 7.2 high | 2.7% | 2004-08-31 |
| CVE-2007-2307 EXP | PHP remote file inclusion vulnerability in engine/engine.inc.php in WebKalk2 1.9.0 allows remote attackers to execute arbitrary PHP code via a URL in… | Patch early | 7.5 high | 2.7% | 2007-04-26 |
| CVE-2007-2341 EXP | PHP remote file inclusion vulnerability in suite/index.php in phpBandManager 0.8 allows remote attackers to execute arbitrary PHP code via a URL in th… | Patch early | 7.5 high | 2.7% | 2007-04-27 |
| CVE-2007-2542 EXP | PHP remote file inclusion vulnerability in header.php in workbench survival guide 0.11 allows remote attackers to execute arbitrary PHP code via a URL… | Patch early | 7.5 high | 2.7% | 2007-05-09 |
| CVE-2017-7358 EXP | In LightDM through 1.22.0, a directory traversal issue in debian/guest-account.sh allows local attackers to own arbitrary directory path locations and… | Patch early | 7.3 high | 2.7% | 2017-04-05 |
| CVE-2019-0555 EXP | An elevation of privilege vulnerability exists in the Microsoft XmlDocument class that could allow an attacker to escape from the AppContainer sandbox… | Patch early | 7.8 high | 2.7% | 2019-01-08 |
| CVE-2015-6565 EXP | sshd in OpenSSH 6.8 and 6.9 uses world-writable permissions for TTY devices, which allows local users to cause a denial of service (terminal disruptio… | Patch early | 7.2 high | 2.7% | 2015-08-24 |
| CVE-2007-5706 EXP | Absolute path traversal vulnerability in download.php in Jeebles Directory 2.9.60 allows remote attackers to read arbitrary files via a full pathname… | Patch early | 9.3 high | 2.7% | 2007-10-29 |
| CVE-2008-6737 EXP | Crysis 1.21 and earlier allows remote attackers to obtain sensitive player information such as real IP addresses by sending a keyexchange packet witho… | Patch early | 7.8 high | 2.7% | 2009-04-21 |
| CVE-2008-4718 EXP | Directory traversal vulnerability in help/mini.php in X7 Chat 2.0.1 A1 and earlier allows remote attackers to include and execute arbitrary local file… | Patch early | 7.5 high | 2.7% | 2008-10-23 |
| CVE-2005-2782 EXP | PHP remote file inclusion vulnerability in al_initialize.php for AutoLinks Pro 2.1 allows remote attackers to execute arbitrary PHP code via an "ftp:/… | Patch early | 7.5 high | 2.7% | 2005-09-02 |
| CVE-2006-6592 EXP | Multiple PHP remote file inclusion vulnerabilities in Bloq 0.5.4 allow remote attackers to execute arbitrary PHP code via a URL in the page[path] para… | Patch early | 7.5 high | 2.7% | 2006-12-15 |
| CVE-2006-2179 EXP | Multiple SQL injection vulnerabilities in CyberBuild allow remote attackers to execute arbitrary SQL commands via the (1) SessionID parameter to login… | Patch early | 7.5 high | 2.7% | 2006-05-04 |
| CVE-2006-2214 EXP | Multiple SQL injection vulnerabilities in 4images 1.7.1 and earlier allow remote attackers to execute arbitrary SQL commands via the sessionid paramet… | Patch early | 7.5 high | 2.7% | 2006-05-05 |
| CVE-2006-5386 EXP | PHP remote file inclusion vulnerability in process.php in NuralStorm Webmail 0.98b and earlier, when register_globals is enabled, allows remote attack… | Patch early | 7.5 high | 2.7% | 2006-10-18 |
| CVE-2007-2007 EXP | admin.php in pL-PHP beta 0.9 allows remote attackers to bypass authentication by setting the is_admin parameter to 1. | Patch early | 7.5 high | 2.7% | 2007-04-12 |
| CVE-2008-6228 EXP | Pre Multi-Vendor Shopping Malls allows remote attackers to bypass authentication and gain administrative access by setting the (1) adminname and the (… | Patch early | 7.5 high | 2.7% | 2009-02-20 |
| CVE-2006-6202 EXP | PHP remote file inclusion vulnerability in modules/NukeAI/util.php in the NukeAI 0.0.3 Beta module for PHP-Nuke, aka Program E is an AIML chatterbot,… | Patch early | 7.5 high | 2.7% | 2006-12-01 |
| CVE-2006-6213 EXP | index.php in PEGames uses the extract function to overwrite critical variables, which allows remote attackers to conduct PHP remote file inclusion att… | Patch early | 7.5 high | 2.7% | 2006-12-01 |
| CVE-2006-1702 EXP | PHP remote file inclusion vulnerability in spip_login.php3 in SPIP 1.8.3 allows remote attackers to execute arbitrary PHP code via a URL in the url pa… | Patch early | 7.5 high | 2.7% | 2006-04-11 |
| CVE-2004-1401 EXP | SQL injection vulnerability in verify.asp in Asp-rider allows remote attackers to execute arbitrary SQL statements and bypass authentication via the u… | Patch early | 7.5 high | 2.7% | 2004-12-31 |
| CVE-2009-3158 EXP | admin/files.php in simplePHPWeb 0.2 does not require authentication, which allows remote attackers to perform unspecified administrative actions via u… | Patch early | 7.5 high | 2.7% | 2009-09-10 |
| CVE-2008-6083 EXP | Directory traversal vulnerability in header.php in TXTshop beta 1.0 allows remote attackers to include and execute arbitrary local files via a .. (dot… | Patch early | 7.5 high | 2.7% | 2009-02-06 |
| CVE-2005-0272 EXP | ReviewPost PHP Pro before 2.84 allows remote attackers to upload and execute arbitrary PHP files by posting a review file with multiple extensions, wh… | Patch early | 7.5 high | 2.7% | 2005-05-02 |
| CVE-2007-6177 EXP | PHP remote file inclusion vulnerability in Exchange/include.php in PHP_CON 1.3 allows remote attackers to execute arbitrary PHP code via a URL in the… | Patch early | 7.5 high | 2.7% | 2007-11-30 |
| CVE-2007-2091 EXP | PHP remote file inclusion vulnerability in blocks/tsdisplay4xoops_block2.php in tsdisplay4xoops (TSD4XOOPS, aka the TeamSpeak display module) 0.1 allo… | Patch early | 7.5 high | 2.7% | 2007-04-18 |
| CVE-2007-0091 EXP | newsCMSlite stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database con… | Patch early | 7.5 high | 2.7% | 2007-01-05 |
| CVE-2005-1820 EXP | zboard.php in Zeroboard version 4.1pl2 to 4.1pl5 allows remote attackers to execute arbitrary PHP code via improper quoting when using the preg_replac… | Patch early | 7.5 high | 2.7% | 2005-06-01 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt