CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
407,162 CVEs
1,740 on KEV
17,302 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-13
152,231 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2006-6255 EXP | Direct static code injection vulnerability in util.php in the NukeAI 0.0.3 Beta module for PHP-Nuke, aka Program E is an AIML chatterbot, allows remot… | Patch early | 7.5 high | 2.4% | 2006-12-04 |
| CVE-2026-56766 EXP | Hydra through 9.7, fixed in commit 9cc84c2, contains a stack buffer overflow in NTLM authentication across SMTP, POP3, IMAP, NNTP, HTTP, HTTP-Proxy, a… | Patch early | 8.8 high | 2.4% | 2026-06-25 |
| CVE-2005-1026 EXP | Multiple SQL injection vulnerabilities in SnailSource phpBB 2.0.x mods allow remote attackers to execute arbitrary SQL commands via the (1) file_id pa… | Patch early | 7.5 high | 2.4% | 2005-05-02 |
| CVE-2005-2048 EXP | Multiple SQL injection vulnerabilities in DUware DUforum 3.1, and possibly other versions, allow remote attackers to execute arbitrary SQL commands vi… | Patch early | 7.5 high | 2.4% | 2005-06-22 |
| CVE-2010-4867 EXP | Directory traversal vulnerability in search.php3 (aka search.php) in W-Agora 4.2.1 and earlier allows remote attackers to include and execute arbitrar… | Patch early | 7.5 high | 2.4% | 2011-10-05 |
| CVE-2019-9625 EXP | JBMC DirectAdmin 1.55 allows CSRF via the /CMD_ACCOUNT_ADMIN URI to create a new admin account. | Patch early | 8.8 high | 2.4% | 2019-03-07 |
| CVE-2008-5896 EXP | CodeAvalanche RateMySite stores sensitive information under the web root with insufficient access control, which allows remote attackers to download t… | Patch early | 7.5 high | 2.4% | 2009-01-12 |
| CVE-2012-3839 EXP | Multiple SQL injection vulnerabilities in application/core/MY_Model.php in MyClientBase 0.12 allow remote attackers to execute arbitrary SQL commands… | Patch early | 7.5 high | 2.4% | 2012-07-03 |
| CVE-2005-2154 EXP | PHP local file inclusion vulnerability in (1) view.php and (2) open.php in osTicket 1.3.1 beta and earlier allows remote attackers to include and poss… | Patch early | 7.5 high | 2.4% | 2005-07-06 |
| CVE-2007-1849 EXP | Directory traversal vulnerability in 404.php in Drake CMS allows remote attackers to include and execute arbitrary local arbitrary files via a .. (dot… | Patch early | 7.5 high | 2.4% | 2007-04-03 |
| CVE-2007-2008 EXP | Directory traversal vulnerability in admin.php in pL-PHP beta 0.9 allows remote attackers to include and execute arbitrary local files via a .. (dot d… | Patch early | 7.5 high | 2.4% | 2007-04-12 |
| CVE-2004-0077 EXP | The do_mremap function for the mremap system call in Linux 2.2 to 2.2.25, 2.4 to 2.4.24, and 2.6 to 2.6.2, does not properly check the return value fr… | Patch early | 7.2 high | 2.4% | 2004-03-03 |
| CVE-2008-2894 EXP | Directory traversal vulnerability in the FTP client in NCH Software Classic FTP 1.02 for Windows allows remote FTP servers to create or overwrite arbi… | Patch early | 9.3 high | 2.4% | 2008-06-27 |
| CVE-2019-1170 EXP | An elevation of privilege vulnerability exists when reparse points are created by sandboxed processes allowing sandbox escape. An attacker who success… | Patch early | 7.9 high | 2.4% | 2019-08-14 |
| CVE-2011-5200 EXP | Multiple SQL injection vulnerabilities in DeDeCMS, possibly 5.6, allow remote attackers to execute arbitrary SQL commands via the id parameter to (1)… | Patch early | 7.5 high | 2.4% | 2012-09-23 |
| CVE-2006-6281 EXP | PHP remote file inclusion vulnerability in check_status.php in dicshunary 0.1 alpha allows remote attackers to execute arbitrary PHP code via a URL in… | Patch early | 7.5 high | 2.4% | 2006-12-04 |
| CVE-2006-6593 EXP | PHP remote file inclusion vulnerability in zufallscodepart.php in AMAZONIA MOD for phpBB allows remote attackers to execute arbitrary PHP code via a U… | Patch early | 7.5 high | 2.4% | 2006-12-15 |
| CVE-2001-0082 EXP | Check Point VPN-1/FireWall-1 4.1 SP2 with Fastmode enabled allows remote attackers to bypass access restrictions via malformed, fragmented packets. | Patch early | 7.5 high | 2.4% | 2001-02-12 |
| CVE-2004-1873 EXP | SQL injection vulnerability in category.asp in A-CART Pro and A-CART 2.0 allows remote attackers to gain privileges via the catcode parameter. | Patch early | 7.5 high | 2.4% | 2004-12-31 |
| CVE-2007-1480 EXP | Creative Guestbook 1.0 allows remote attackers to add an administrative account via a direct request to createadmin.php with Name, Email, and PASSWORD… | Patch early | 7.5 high | 2.4% | 2007-03-16 |
| CVE-2007-4846 EXP | SQL injection vulnerability in start.php in Webace-Linkscript (wls) 1.3 Special Edition (SE) allows remote attackers to execute arbitrary SQL commands… | Patch early | 7.5 high | 2.4% | 2007-09-12 |
| CVE-2001-0579 EXP | lpadmin in SCO OpenServer 5.0.6 can allow a local attacker to gain additional privileges via a buffer overflow attack in the first argument to the com… | Patch early | 7.5 high | 2.4% | 2001-08-22 |
| CVE-2008-3251 EXP | Multiple SQL injection vulnerabilities in tplSoccerSite 1.0 allow remote attackers to execute arbitrary SQL commands via (1) the opp parameter to tamp… | Patch early | 7.5 high | 2.4% | 2008-07-21 |
| CVE-2008-3498 EXP | SQL injection vulnerability in the nBill (com_netinvoice) component 1.2.0 SP1 for Joomla! allows remote attackers to execute arbitrary SQL commands vi… | Patch early | 7.5 high | 2.4% | 2008-08-06 |
| CVE-2008-3563 EXP | Multiple SQL injection vulnerabilities in Plogger 3.0 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the checked array p… | Patch early | 7.5 high | 2.4% | 2008-08-10 |
| CVE-2008-4886 EXP | SQL injection vulnerability in index.php in YourFreeWorld Shopping Cart Script allows remote attackers to execute arbitrary SQL commands via the c par… | Patch early | 7.5 high | 2.4% | 2008-11-04 |
| CVE-2015-6911 EXP | SQL injection vulnerability in Synology Video Station before 1.5-0763 allows remote attackers to execute arbitrary SQL commands via the id parameter t… | Patch early | 7.5 high | 2.4% | 2015-09-11 |
| CVE-2008-2977 EXP | Multiple PHP remote file inclusion vulnerabilities in Ourvideo CMS 9.5 allow remote attackers to execute arbitrary PHP code via a URL in the include_c… | Patch early | 7.5 high | 2.4% | 2008-07-02 |
| CVE-2008-3570 EXP | PHP remote file inclusion vulnerability in index.php in Africa Be Gone (ABG) 1.0a allows remote attackers to execute arbitrary PHP code via a URL in t… | Patch early | 7.5 high | 2.4% | 2008-08-10 |
| CVE-2008-5577 EXP | PHP remote file inclusion vulnerability in index.php in sCssBoard 1.0, 1.1, 1.11, and 1.12 allows remote attackers to execute arbitrary PHP code via a… | Patch early | 7.5 high | 2.4% | 2008-12-15 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt