CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
407,357 CVEs
1,740 on KEV
17,302 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-13
152,320 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2019-10847 EXP | Computrols CBAS 18.0.0 allows Cross-Site Request Forgery. | Patch early | 8.8 high | 2.4% | 2019-05-24 |
| CVE-2009-2558 EXP | system/message.php in Admin News Tools 2.5 does not properly restrict access, which allows remote attackers to post news messages via a direct request… | Patch early | 7.5 high | 2.4% | 2009-07-21 |
| CVE-2008-5901 EXP | iyzi Forum 1.0 beta 3 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the… | Patch early | 7.5 high | 2.4% | 2009-01-12 |
| CVE-2009-4106 EXP | Unrestricted file upload vulnerability in admintools/editpage-2.php in Agoko CMS 0.4 and earlier allows remote attackers to inject and execute arbitra… | Patch early | 7.5 high | 2.4% | 2009-11-29 |
| CVE-2009-4674 EXP | admin/admin.php in Mole Group Sky Hunter Airline Ticket Sale Script and Bus Ticket Script allows remote attackers to change an arbitrary password via… | Patch early | 7.5 high | 2.4% | 2010-03-05 |
| CVE-2014-2347 EXP | Amtelco miSecureMessages (aka MSM) 6.2 does not properly manage sessions, which allows remote authenticated users to obtain sensitive information via… | Patch early | 7.0 high | 2.4% | 2014-05-06 |
| CVE-2024-23733 EXP | The /WmAdmin/,/invoke/vm.server/login login page in the Integration Server in Software AG webMethods 10.15.0 before Core_Fix7 allows remote attackers… | Patch early | 7.5 high | 2.4% | 2025-01-29 |
| CVE-2009-4625 EXP | SQL injection vulnerability in the updateOnePage function in components/com_bfsurvey_pro/controller.php in BF Survey Pro Free (com_bfsurvey_profree) 1… | Patch early | 7.5 high | 2.4% | 2010-01-18 |
| CVE-2008-5058 EXP | SQL injection vulnerability in siteadmin/loginsucess.php in Pre Simple CMS allows remote attackers to execute arbitrary SQL commands via the user para… | Patch early | 7.5 high | 2.4% | 2008-11-13 |
| CVE-2006-6790 EXP | Direct static code injection vulnerability in chat/login.php in Ultimate PHP Board (UPB) 2.0b1 and earlier allows remote attackers to inject arbitrary… | Patch early | 7.5 high | 2.4% | 2006-12-28 |
| CVE-2002-1505 EXP | SQL injection vulnerability in board.php for WoltLab Burning Board (wBB) 2.0 RC 1 and earlier allows remote attackers to modify the database and possi… | Patch early | 7.5 high | 2.4% | 2003-04-02 |
| CVE-2007-3963 EXP | Multiple cross-site scripting (XSS) vulnerabilities in UseBB 1.0.7, and possibly other 1.0.x versions, allow remote attackers to inject arbitrary web… | Patch early | 9.3 high | 2.4% | 2007-07-25 |
| CVE-2007-2298 EXP | Multiple PHP remote file inclusion vulnerabilities in Garennes 0.6.1 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the… | Patch early | 7.5 high | 2.4% | 2007-04-26 |
| CVE-2007-2572 EXP | PHP remote file inclusion vulnerability in modules/noevents/templates/mfa_theme.php in NoAh (aka PHP Content Architect, phparch) 0.9 pre 1.2 and earli… | Patch early | 7.5 high | 2.4% | 2007-05-09 |
| CVE-2007-5786 EXP | Multiple PHP remote file inclusion vulnerabilities in GoSamba 1.0.1 allow remote attackers to execute arbitrary PHP code via a URL in the include_path… | Patch early | 7.5 high | 2.4% | 2007-11-01 |
| CVE-2007-6229 EXP | PHP remote file inclusion vulnerability in common/classes/class_HeaderHandler.lib.php in Rayzz Script 2.0 allows remote attackers to execute arbitrary… | Patch early | 7.5 high | 2.4% | 2007-12-04 |
| CVE-2004-1536 EXP | SQL injection vulnerability in index.php in the ibProArcade module for Invision Power Board (IPB) 1.x and 2.x allows remote attackers to execute arbit… | Patch early | 7.5 high | 2.4% | 2004-12-31 |
| CVE-2004-2062 EXP | SQL injection vulnerability in antiboard.php in AntiBoard 0.7.2 and earlier allows remote attackers to execute arbitrary SQL via the (1) thread_id, (2… | Patch early | 7.5 high | 2.4% | 2004-12-31 |
| CVE-2005-3326 EXP | SQL injection vulnerability in usercp.php in MyBulletinBoard (MyBB) allows remote attackers to execute arbitrary SQL commands via the awayday paramete… | Patch early | 7.5 high | 2.4% | 2005-10-27 |
| CVE-2005-3865 EXP | SQL injection vulnerability in index.php in AllWeb search 3.0 and earlier allows remote attackers to execute arbitrary SQL commands via the search par… | Patch early | 7.5 high | 2.4% | 2005-11-29 |
| CVE-2006-6710 EXP | Multiple PHP remote file inclusion vulnerabilities in PgmReloaded 0.8.5 and earlier allow remote attackers to execute arbitrary PHP code via a URL in… | Patch early | 7.5 high | 2.4% | 2006-12-23 |
| CVE-2015-6519 EXP | SQL injection vulnerability in Arab Portal 3 allows remote attackers to execute arbitrary SQL commands via the showemail parameter in a signup action… | Patch early | 7.5 high | 2.4% | 2015-08-18 |
| CVE-2002-0991 EXP | Buffer overflows in the cifslogin command for HP CIFS/9000 Client A.01.06 and earlier, based on the Sharity package, allows local users to gain root p… | Patch early | 7.2 high | 2.4% | 2002-10-04 |
| CVE-2009-4222 EXP | phpBazar 2.1.1fix and earlier does not require administrative authentication for admin/admin.php, which allows remote attackers to obtain access to th… | Patch early | 7.5 high | 2.4% | 2009-12-07 |
| CVE-2007-4933 EXP | Direct static code injection vulnerability in includes/admin/sub/conf_appearence.php in Shop-Script FREE 2.0 and earlier allows remote attackers to in… | Patch early | 7.5 high | 2.4% | 2007-09-18 |
| CVE-2007-5055 EXP | Multiple directory traversal vulnerabilities in iziContents 1 RC6 and earlier allow remote attackers to include and execute arbitrary local files via… | Patch early | 7.5 high | 2.4% | 2007-09-24 |
| CVE-2007-6396 EXP | Direct static code injection vulnerability in index.php in Flat PHP Board 1.2 and earlier allows remote attackers to inject arbitrary PHP code via the… | Patch early | 7.5 high | 2.4% | 2007-12-17 |
| CVE-2005-0781 EXP | SQL injection vulnerability in (1) viewall.php and (2) category.php in paFileDB 3.1 and earlier allows remote attackers to execute arbitrary SQL comma… | Patch early | 7.5 high | 2.4% | 2005-05-02 |
| CVE-2005-1236 EXP | Multiple SQL injection vulnerabilities in DUware DUportal 3.1.2 and 3.1.2 SQL allow remote attackers to execute arbitrary SQL commands via the (1) iCh… | Patch early | 7.5 high | 2.4% | 2005-05-02 |
| CVE-2005-2049 EXP | Multiple SQL injection vulnerabilities in DUware DUclassmate 1.2 allow remote attackers to execute arbitrary SQL commands via the (1) iState parameter… | Patch early | 7.5 high | 2.4% | 2005-06-22 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt