CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
405,610 CVEs
1,740 on KEV
17,302 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-13
151,182 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2007-2232 EXP | The CHECK command in Cosign 2.0.1 and earlier allows remote attackers to bypass authentication requirements via CR (\r) sequences in the cosign cookie… | Patch early | 7.5 high | 2.5% | 2007-04-25 |
| CVE-2026-43284 EXP | In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: avoid in-place decrypt on shared skb frags MSG_SPLICE_PAGES can attac… | Patch early | 8.8 high | 2.5% | 2026-05-08 |
| CVE-2008-6553 EXP | microcms-admin-home.php in Implied by Design Micro CMS (Micro-CMS) 3.5 (aka 0.3.5) does not require authentication as an administrator, which allows r… | Patch early | 7.5 high | 2.5% | 2009-03-30 |
| CVE-2008-6716 EXP | homeadmin/adminhome.php in Pre ADS Portal 2.0 and earlier does not require administrative authentication, which allows remote attackers to have an uns… | Patch early | 7.5 high | 2.5% | 2009-04-13 |
| CVE-2008-6717 EXP | U&M Software Signup 1.0 and 1.1 does not require administrative authentication for all scripts in the admin/ directory, which allows remote attackers… | Patch early | 7.5 high | 2.5% | 2009-04-13 |
| CVE-2008-6719 EXP | U&M Software Event Lister (aka JustListIt) 1.0 does not require administrative authentication for all scripts in the admin/ directory, which allows re… | Patch early | 7.5 high | 2.5% | 2009-04-13 |
| CVE-2006-5423 EXP | PHP remote file inclusion vulnerability in admin/admin_module.php in Lou Portail 1.4.1, and possibly earlier, allows remote attackers to execute arbit… | Patch early | 7.5 high | 2.5% | 2006-10-20 |
| CVE-2006-6151 EXP | PHP remote file inclusion vulnerability in centre.php in Messagerie Locale as of 20061127 allows remote attackers to execute arbitrary PHP code via a… | Patch early | 7.5 high | 2.5% | 2006-11-28 |
| CVE-2006-6416 EXP | Multiple PHP remote file inclusion vulnerabilities in PhpLeague - Univert PhpLeague 0.81 allow remote attackers to execute arbitrary PHP code via a UR… | Patch early | 7.5 high | 2.5% | 2006-12-10 |
| CVE-2018-15844 EXP | An issue was discovered in DamiCMS 6.0.0. There is an CSRF vulnerability that can revise the administrator account's password via /admin.php?s=/Admin/… | Patch early | 8.8 high | 2.5% | 2018-08-25 |
| CVE-2006-4944 EXP | PHP remote file inclusion vulnerability in includes/pear/Net/DNS/RR.php in ProgSys 0.151 and earlier allows remote attackers to execute arbitrary PHP… | Patch early | 7.5 high | 2.5% | 2006-09-23 |
| CVE-2005-1417 EXP | Multiple SQL injection vulnerabilities in MaxWebPortal 2.x, 1.35, and other versions allow remote attackers to execute arbitrary SQL commands via (1)… | Patch early | 7.5 high | 2.5% | 2005-05-03 |
| CVE-2015-4137 EXP | SQL injection vulnerability in related.php in Milw0rm Clone Script 1.0 allows remote attackers to execute arbitrary SQL commands via the program param… | Patch early | 7.5 high | 2.5% | 2015-05-29 |
| CVE-2009-1771 EXP | index.php in Flyspeck CMS 6.8 does not require administrative authentication for the updateExistingContent action, which allows remote attackers to cr… | Patch early | 7.5 high | 2.5% | 2009-05-22 |
| CVE-2008-3564 EXP | Multiple directory traversal vulnerabilities in index.php in Dayfox Blog 4 allow remote attackers to include and execute arbitrary local files via a .… | Patch early | 7.5 high | 2.5% | 2008-08-10 |
| CVE-2008-5201 EXP | Directory traversal vulnerability in index.php in OTManager CMS 24a allows remote attackers to include and execute arbitrary local files via a .. (dot… | Patch early | 7.5 high | 2.5% | 2008-11-21 |
| CVE-2008-1493 EXP | Directory traversal vulnerability in login.php in Cuteflow Bin 1.5.0 allows remote attackers to include and execute arbitrary local files via a .. (do… | Patch early | 7.5 high | 2.5% | 2008-03-25 |
| CVE-2014-3868 EXP | Multiple SQL injection vulnerabilities in ZeusCart 4.x. | Patch early | 8.8 high | 2.5% | 2020-01-31 |
| CVE-2004-1291 EXP | Buffer overflow in qwik-smtpd allows remote attackers to use the server as an SMTP spam relay via a long HELO command, which overwrites the adjacent l… | Patch early | 7.5 high | 2.5% | 2005-01-10 |
| CVE-2001-0519 EXP | Aladdin eSafe Gateway versions 2.x allows a remote attacker to circumvent HTML SCRIPT filtering via a special arrangement of HTML tags which includes… | Patch early | 7.5 high | 2.5% | 2001-08-14 |
| CVE-2021-32403 EXP | Intelbras Router RF 301K Firmware 1.1.2 is vulnerable to Cross Site Request Forgery (CSRF) due to lack of security mechanisms for token protection and… | Patch early | 8.8 high | 2.5% | 2021-05-17 |
| CVE-2009-0444 EXP | Multiple PHP remote file inclusion vulnerabilities in GRBoard 1.8, when register_globals is enabled and magic_quotes_gpc is disabled, allow remote att… | Patch early | 7.5 high | 2.5% | 2009-02-10 |
| CVE-2009-1248 EXP | Multiple PHP remote file inclusion vulnerabilities in Acute Control Panel 1.0.0 allow remote attackers to execute arbitrary PHP code via a URL in the… | Patch early | 7.5 high | 2.5% | 2009-04-06 |
| CVE-2009-4056 EXP | Directory traversal vulnerability in admin/popup.php in Betsy CMS 3.5 allows remote attackers to include and execute arbitrary local files via a .. (d… | Patch early | 7.5 high | 2.5% | 2009-11-24 |
| CVE-2009-4929 EXP | admin/manage_users.php in TotalCalendar 2.4 does not require administrative authentication, which allows remote attackers to change arbitrary password… | Patch early | 7.5 high | 2.5% | 2010-07-12 |
| CVE-2012-2961 EXP | SQL injection vulnerability in the management console in Symantec Web Gateway 5.0.x before 5.0.3.18 allows remote attackers to execute arbitrary SQL c… | Patch early | 7.5 high | 2.5% | 2012-07-23 |
| CVE-2011-5213 EXP | Multiple SQL injection vulnerabilities in BrowserCRM 5.100.01 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) login[u… | Patch early | 7.5 high | 2.5% | 2012-10-25 |
| CVE-2009-4471 EXP | Multiple PHP remote file inclusion vulnerabilities in FreeSchool 1.1.0 and earlier allow remote attackers to execute arbitrary PHP code via a URL in t… | Patch early | 7.5 high | 2.5% | 2009-12-30 |
| CVE-2008-3721 EXP | PHP remote file inclusion vulnerability in user_language.php in DeeEmm CMS (DMCMS) 0.7.4 allows remote attackers to execute arbitrary PHP code via a U… | Patch early | 7.5 high | 2.5% | 2008-08-20 |
| CVE-2008-6223 EXP | PHP remote file inclusion vulnerability in visualizza.php in Way Of The Warrior (WOTW) 5.0 and earlier allows remote attackers to execute arbitrary PH… | Patch early | 7.5 high | 2.5% | 2009-02-20 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt