CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
407,162 CVEs
1,740 on KEV
17,302 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-13
152,231 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2009-4472 EXP | Multiple PHP remote file inclusion vulnerabilities in PHPope 1.0.0 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the (… | Patch early | 7.5 high | 2.4% | 2009-12-30 |
| CVE-2005-4218 EXP | SQL injection vulnerability in forum.php in PHPWebThings 1.4 allows remote attackers to execute arbitrary SQL commands via the msg parameter, a differ… | Patch early | 7.5 high | 2.4% | 2005-12-14 |
| CVE-2008-2296 EXP | PHP remote file inclusion vulnerability in include/bbs.lib.inc.php in Rgboard 3.0.12 allows remote attackers to execute arbitrary PHP code via a URL i… | Patch early | 7.5 high | 2.4% | 2008-05-18 |
| CVE-2008-2110 EXP | Unrestricted file upload vulnerability in qtofm.php in QTOFileManager 1.0 allows remote attackers to execute arbitrary PHP code by uploading a file wi… | Patch early | 7.5 high | 2.4% | 2008-05-07 |
| CVE-2007-2725 EXP | The DB Software Laboratory DeWizardX (DEWizardAX.ocx) ActiveX control allows remote attackers to overwrite arbitrary files via the SaveToFile function… | Patch early | 7.5 high | 2.4% | 2007-05-16 |
| CVE-2008-5593 EXP | Multiple directory traversal vulnerabilities in index.php in Mini CMS 1.0.1 allow remote attackers to include and execute arbitrary local files via a… | Patch early | 7.5 high | 2.4% | 2008-12-16 |
| CVE-2009-1504 EXP | Absolute Form Processor XE 1.5 allows remote attackers to bypass authentication and gain administrative access by setting the xlaAFPadmin cookie to "l… | Patch early | 7.5 high | 2.4% | 2009-05-01 |
| CVE-2009-1678 EXP | Directory traversal vulnerability in the saveFeed function in rss/feedcreator.class.php in Bitweaver 2.6 and earlier allows remote attackers to create… | Patch early | 7.5 high | 2.4% | 2009-05-18 |
| CVE-2009-1854 EXP | Million Dollar Text Links 1.0 allows remote attackers to bypass authentication and gain administrative access by setting the userid cookie to 1. | Patch early | 7.5 high | 2.4% | 2009-06-01 |
| CVE-2014-5284 EXP | host-deny.sh in OSSEC before 2.8.1 writes to temporary files with predictable filenames without verifying ownership, which allows local users to modif… | Patch early | 7.2 high | 2.4% | 2014-12-02 |
| CVE-2026-46300 EXP | In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() ca… | Patch early | 7.8 high | 2.4% | 2026-05-23 |
| CVE-2006-6051 EXP | PHP remote file inclusion vulnerability in reporter.logic.php in the MosReporter (com_reporter) component for Mambo and Joomla! allows remote attacker… | Patch early | 7.5 high | 2.4% | 2006-11-22 |
| CVE-2006-6586 EXP | Multiple PHP remote file inclusion vulnerabilities in Vortex Blog (vBlog, aka C12) a0.1_nonfunc allow remote attackers to execute arbitrary PHP code v… | Patch early | 7.5 high | 2.4% | 2006-12-15 |
| CVE-2006-6633 EXP | PHP remote file inclusion vulnerability in include/yapbb_session.php in YapBB 1.2 Beta2 and earlier allows remote attackers to execute arbitrary PHP c… | Patch early | 7.5 high | 2.4% | 2006-12-18 |
| CVE-2006-6635 EXP | PHP remote file inclusion vulnerability in includes/functions.php in JumbaCMS 0.0.1 allows remote attackers to execute arbitrary PHP code via a URL in… | Patch early | 7.5 high | 2.4% | 2006-12-18 |
| CVE-2006-6645 EXP | PHP remote file inclusion vulnerability in language/lang_english/lang_admin.php in the Web Links (mx_links) 2.05 and earlier module for mxBB allows re… | Patch early | 7.5 high | 2.4% | 2006-12-20 |
| CVE-2006-6711 EXP | PHP remote file inclusion vulnerability in compteur/mapage.php in Newxooper 0.9.1 allows remote attackers to execute arbitrary PHP code via a URL in t… | Patch early | 7.5 high | 2.4% | 2006-12-23 |
| CVE-2006-6795 EXP | PHP remote file inclusion vulnerability in gallery/displayCategory.php in the My_eGallery 2.5.6 module in myPHPNuke (MPN) allows remote attackers to e… | Patch early | 7.5 high | 2.4% | 2006-12-28 |
| CVE-2006-6809 EXP | Multiple PHP remote file inclusion vulnerabilities in process.php in Vladimir Menshakov buratinable templator (aka bubla) 1.0.0rc2 and earlier allow r… | Patch early | 7.5 high | 2.4% | 2006-12-29 |
| CVE-2006-6823 EXP | PHP remote file inclusion vulnerability in plugins/metasearch/plug.inc.php in Yrch! 1.0 allows remote attackers to execute arbitrary PHP code via a UR… | Patch early | 7.5 high | 2.4% | 2006-12-29 |
| CVE-2006-6830 EXP | PHP remote file inclusion vulnerability in b2verifauth.php in b2 Blog 0.5 and earlier allows remote attackers to execute arbitrary PHP code via a URL… | Patch early | 7.5 high | 2.4% | 2006-12-31 |
| CVE-2001-0263 EXP | Gene6 G6 FTP Server 2.0 (aka BPFTP Server 2.10) allows attackers to read file attributes outside of the web root via the (1) SIZE and (2) MDTM command… | Patch early | 7.5 high | 2.4% | 2001-06-18 |
| CVE-2008-1409 EXP | Multiple directory traversal vulnerabilities in the Default theme in Exero CMS 1.0.1 allow remote attackers to include and execute arbitrary local fil… | Patch early | 7.5 high | 2.4% | 2008-03-20 |
| CVE-2008-2782 EXP | Multiple directory traversal vulnerabilities in OtomiGenX 2.2 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) i… | Patch early | 7.5 high | 2.4% | 2008-06-19 |
| CVE-2008-3593 EXP | Directory traversal vulnerability in index.php in SyzygyCMS 0.3 allows remote attackers to include and execute arbitrary local files via a .. (dot dot… | Patch early | 7.5 high | 2.4% | 2008-08-11 |
| CVE-2008-5953 EXP | Directory traversal vulnerability in KTP Computer Customer Database (KTPCCD) CMS, when magic_quotes_gpc is disabled, allows remote attackers to includ… | Patch early | 7.5 high | 2.4% | 2009-01-23 |
| CVE-2011-5110 EXP | Multiple SQL injection vulnerabilities in Blogs Manager 1.101 and earlier allow remote attackers to execute arbitrary SQL commands via the SearchField… | Patch early | 7.5 high | 2.4% | 2012-08-23 |
| CVE-2012-5912 EXP | Multiple SQL injection vulnerabilities in PicoPublisher 2.0 allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) page.… | Patch early | 7.5 high | 2.4% | 2012-11-17 |
| CVE-2009-2642 EXP | index.php in Desi Short URL Script 1.0 allows remote attackers to bypass authentication by setting the logged cookie to 1 and the uid cookie to an int… | Patch early | 7.5 high | 2.4% | 2009-07-28 |
| CVE-2007-1613 EXP | Directory traversal vulnerability in view.php in MPM Chat 2.5 allows remote attackers to include and execute arbitrary local files via a .. (dot dot)… | Patch early | 7.5 high | 2.4% | 2007-03-23 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt