CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
404,370 CVEs
1,739 on KEV
17,299 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-11
208,324 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2006-5137 EXP | Multiple direct static code injection vulnerabilities in Groupee UBB.threads 6.5.1.1 allow remote attackers to (1) inject PHP code via a theme[] array… | Patch early | 5.1 medium | 2.2% | 2006-10-03 |
| CVE-2008-4146 EXP | Addalink 1.0 beta 4 and earlier allows remote attackers to (1) approve web-site additions via a modified approved field and (2) change the visit-count… | Patch early | 5.0 medium | 2.2% | 2008-09-24 |
| CVE-2010-3026 EXP | Cross-site request forgery (CSRF) vulnerability in application/modules/admin/controllers/users.php in Tomaz Muraus Open Blog 1.2.1, and possibly earli… | Patch early | 4.3 medium | 2.2% | 2010-08-16 |
| CVE-2006-4960 EXP | Cross-site scripting (XSS) vulnerability in index.php Php Blue Dragon 2.9.1 and earlier allows remote attackers to inject arbitrary web script or HTML… | Patch early | 6.8 medium | 2.2% | 2006-09-23 |
| CVE-2013-3083 EXP | Cross-site request forgery (CSRF) vulnerability in cgi-bin/system_setting.exe in Belkin F5D8236-4 v2 allows remote attackers to hijack the authenticat… | Patch early | 6.8 medium | 2.2% | 2014-09-29 |
| CVE-2024-55889 EXP | phpMyFAQ is an open source FAQ web application. Prior to version 3.2.10, a vulnerability exists in the FAQ Record component where a privileged attacke… | Patch early | 4.9 medium | 2.2% | 2024-12-13 |
| CVE-2004-1655 EXP | Cross-site scripting (XSS) vulnerability in phpWebsite 0.9.3-4 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1)… | Patch early | 4.3 medium | 2.2% | 2004-09-01 |
| CVE-2004-2411 EXP | The CleanseMessage function in shop$db.asp for VP-ASP Shopping Cart 4.0 through 5.0 does not sufficiently cleanse inputs, which allows remote attacker… | Patch early | 4.3 medium | 2.2% | 2004-12-31 |
| CVE-2004-2618 EXP | Cross-site scripting (XSS) vulnerability in Pegasi Web Server (PWS) 0.2.2 allows remote attackers to inject arbitrary web script or HTML via the URI,… | Patch early | 4.3 medium | 2.2% | 2004-12-31 |
| CVE-2005-3902 EXP | Cross-site scripting (XSS) vulnerability in gui/errordocs/index.php in Virtual Hosting Control System (VHCS) 2.2.0 through 2.4.6.2 allows remote attac… | Patch early | 4.3 medium | 2.2% | 2005-11-29 |
| CVE-2006-0650 EXP | Cross-site scripting (XSS) vulnerability in cpaint2.inc.php in the CPAINT library before 2.0.3, as used in multiple scripts, allows remote attackers t… | Patch early | 4.3 medium | 2.2% | 2006-02-13 |
| CVE-2007-6504 EXP | Unspecified vulnerability in IIS/iibind.asp in Hosting Controller 6.1 Hot fix 3.3 and earlier allows remote authenticated users to change the headers… | Patch early | 5.5 medium | 2.2% | 2007-12-20 |
| CVE-2013-2108 EXP | WordPress WP Cleanfix Plugin 2.4.4 has CSRF | Patch early | 5.4 medium | 2.2% | 2020-02-10 |
| CVE-2006-6613 EXP | Directory traversal vulnerability in language.php in phpAlbum 0.4.1 Beta 6 and earlier, when magic_quotes_gpc is disabled and register_globals is enab… | Patch early | 6.8 medium | 2.2% | 2006-12-18 |
| CVE-2018-1000638 EXP | MiniCMS version 1.1 contains a Cross Site Scripting (XSS) vulnerability in http://example.org/mc-admin/page.php?date={payload} that can result in code… | Patch early | 6.1 medium | 2.2% | 2018-08-20 |
| CVE-2009-3545 EXP | DataWizard Technologies FtpXQ FTP Server 3.0 allows remote authenticated users to cause a denial of service (crash) via a long ABOR command. | Patch early | 4.0 medium | 2.2% | 2009-10-05 |
| CVE-2018-9183 EXP | The Joom Sky JS Jobs extension before 1.2.1 for Joomla! has XSS. | Patch early | 5.4 medium | 2.2% | 2018-04-02 |
| CVE-2008-5639 EXP | Directory traversal vulnerability in index.php in TxtBlog 1.0 Alpha allows remote attackers to read arbitrary files via a .. (dot dot) in the m parame… | Patch early | 4.3 medium | 2.2% | 2008-12-17 |
| CVE-2006-6919 EXP | Firefox Sage extension 1.3.8 and earlier allows remote attackers to execute arbitrary Javascript in the local context via an RSS feed with an img tag… | Patch early | 6.8 medium | 2.2% | 2007-01-11 |
| CVE-2008-1134 EXP | OMEGA (aka Omegasoft) INterneSErvicesLosungen (INSEL) 7 supports authentication with a cookie that lacks a shared secret, which allows remote attacker… | Patch early | 6.4 medium | 2.2% | 2008-03-04 |
| CVE-2007-6191 EXP | Multiple PHP remote file inclusion vulnerabilities in Armin Burger p.mapper 3.2.0 beta3 allow remote attackers to execute arbitrary PHP code via a URL… | Patch early | 6.8 medium | 2.2% | 2007-11-30 |
| CVE-2019-13346 EXP | In MyT 1.5.1, the User[username] parameter has XSS. | Patch early | 6.1 medium | 2.2% | 2019-07-17 |
| CVE-2018-5370 EXP | BizLogic xnami 1.0 has XSS via the comment parameter in an addComment action to the /media/ajax URI. | Patch early | 6.1 medium | 2.2% | 2018-01-16 |
| CVE-2017-16962 EXP | The WebMail components (Crystal, pronto, and pronto4) in CommuniGate Pro before 6.2.1 have stored XSS vulnerabilities via (1) the location or details… | Patch early | 6.1 medium | 2.2% | 2017-11-27 |
| CVE-2017-16356 EXP | Reflected XSS in Kubik-Rubik SIGE (aka Simple Image Gallery Extended) before 3.3.0 allows attackers to execute JavaScript in a victim's browser by hav… | Patch early | 6.1 medium | 2.2% | 2018-02-20 |
| CVE-2016-8855 EXP | Cross-Site Scripting (XSS) in "/sitecore/client/Applications/List Manager/Taskpages/Contact list" in Sitecore Experience Platform 8.1 rev. 160519 (8.1… | Patch early | 6.1 medium | 2.2% | 2017-03-19 |
| CVE-2007-5374 EXP | cp_memberedit.php in LightBlog 8.4.1.1 does not check for administrative credentials when processing an admin action, which allows remote authenticate… | Patch early | 6.5 medium | 2.2% | 2007-10-11 |
| CVE-2006-0923 EXP | Multiple cross-site scripting (XSS) vulnerabilities in MyPHPNuke (MPN) 1.88 and earlier allow remote attackers to inject arbitrary web script or HTML… | Patch early | 4.3 medium | 2.2% | 2006-02-28 |
| CVE-2008-3758 EXP | Multiple cross-site scripting (XSS) vulnerabilities in Lussumo Vanilla 1.1.4 and earlier (1) allow remote attackers to inject arbitrary web script or… | Patch early | 4.3 medium | 2.2% | 2008-08-21 |
| CVE-2006-5060 EXP | Cross-site scripting (XSS) vulnerability in login.php in Jamroom 3.0.16 and possibly earlier allows remote attackers to inject arbitrary web script or… | Patch early | 5.1 medium | 2.2% | 2006-09-28 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt