CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
404,373 CVEs
1,739 on KEV
17,299 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-11
208,326 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2003-1419 EXP | Netscape 7.0 allows remote attackers to cause a denial of service (crash) via a web page with an invalid regular expression argument to the JavaScript… | Patch early | 4.3 medium | 2.2% | 2003-12-31 |
| CVE-2017-15958 EXP | D-Park Pro Domain Parking Script 1.0 allows SQL Injection via the username to admin/loginform.php. | Patch early | 9.8 critical | 2.1% | 2017-10-29 |
| CVE-2017-15960 EXP | Article Directory Script 3.0 allows SQL Injection via the id parameter to author.php or category.php. | Patch early | 9.8 critical | 2.1% | 2017-10-29 |
| CVE-2017-15961 EXP | iProject Management System 1.0 allows SQL Injection via the ID parameter to index.php. | Patch early | 9.8 critical | 2.1% | 2017-10-29 |
| CVE-2017-15964 EXP | Job Board Script Software allows SQL Injection via the PATH_INFO to a /job-details URI. | Patch early | 9.8 critical | 2.1% | 2017-10-29 |
| CVE-2024-42049 EXP | TightVNC (Server for Windows) before 2.8.84 allows attackers to connect to the control pipe via a network connection. | Patch early | 9.1 critical | 2.1% | 2024-07-28 |
| CVE-2007-4635 EXP | Yahoo! Messenger 8.1.0.209 and 8.1.0.402 allows remote attackers to cause a denial of service (application crash) via certain file-transfer packets, p… | Patch early | 5.0 medium | 2.1% | 2007-08-31 |
| CVE-2012-4909 EXP | Google Chrome before 18.0.1025308 on Android allows remote attackers to obtain cookie information via a crafted application. | Patch early | 4.3 medium | 2.1% | 2012-09-13 |
| CVE-2013-7184 EXP | Gretech GOM Media Player 2.2.56.5158 and earlier allows remote attackers to cause a denial of service (memory corruption) via a crafted AVI file. | Patch early | 4.3 medium | 2.1% | 2014-01-24 |
| CVE-2006-6928 EXP | Multiple cross-site scripting (XSS) vulnerabilities in Rialto 1.6 allow remote attackers to inject arbitrary web script or HTML via the (1) cat parame… | Patch early | 6.8 medium | 2.1% | 2007-01-13 |
| CVE-2018-6936 EXP | Cross Site Scripting (XSS) exists on the D-Link DIR-600M C1 3.01 via the SSID or the name of a user account. | Patch early | 5.4 medium | 2.1% | 2018-02-21 |
| CVE-2008-0158 EXP | Directory traversal vulnerability in index.php in Shop-Script 2.0 and possibly other versions allows remote attackers to read arbitrary files via a ..… | Patch early | 5.0 medium | 2.1% | 2008-01-09 |
| CVE-2022-41413 EXP | perfSONAR v4.x <= v4.4.5 was discovered to contain a Cross-Site Request Forgery (CSRF) which is triggered when an attacker injects crafted input into… | Patch early | 4.3 medium | 2.1% | 2022-11-30 |
| CVE-2006-1820 EXP | Cross-site scripting (XSS) vulnerability in index.php in ModX 0.9.1 allows remote attackers to inject arbitrary web script or HTML via the id paramete… | Patch early | 5.8 medium | 2.1% | 2006-04-18 |
| CVE-2021-3298 EXP | Collabtive 3.1 allows XSS when an authenticated user enters an XSS payload into the address section of the profile edit page, aka the manageuser.php?a… | Patch early | 5.4 medium | 2.1% | 2021-01-29 |
| CVE-2006-6390 EXP | Multiple directory traversal vulnerabilities in Open Solution Quick.Cart 2.0, when register_globals is enabled and magic_quotes_gpc is disabled, allow… | Patch early | 6.8 medium | 2.1% | 2006-12-08 |
| CVE-2017-5223 EXP | An issue was discovered in PHPMailer before 5.2.22. PHPMailer's msgHTML method applies transformations to an HTML document to make it usable as an ema… | Patch early | 5.5 medium | 2.1% | 2017-01-16 |
| CVE-2006-6153 EXP | Multiple cross-site scripting (XSS) vulnerabilities in vSpin.net Classified System 2004 allow remote attackers to inject arbitrary web script or HTML… | Patch early | 4.3 medium | 2.1% | 2006-11-28 |
| CVE-2005-3308 EXP | Multiple cross-site scripting (XSS) vulnerabilities in Zomplog 3.4 allow remote attackers to inject arbitrary web script or HTML via the (1) name or (… | Patch early | 4.3 medium | 2.1% | 2005-10-26 |
| CVE-2006-1697 EXP | Cross-site scripting (XSS) vulnerability in Matt Wright Guestbook 2.3.1 allows remote attackers to execute arbitrary web script or HTML via the (1) Yo… | Patch early | 4.3 medium | 2.1% | 2006-04-11 |
| CVE-2006-1971 EXP | Cross-site scripting (XSS) vulnerability in login.php in KRANKIKOM ContentBoxX allows remote attackers to inject arbitrary web script or HTML via the… | Patch early | 4.3 medium | 2.1% | 2006-04-21 |
| CVE-2004-1640 EXP | Multiple cross-site scripting (XSS) vulnerabilities in XOOPS 0.94 and 1.0 allow remote attackers to execute arbitrary web script and HTML via the (1)… | Patch early | 4.3 medium | 2.1% | 2004-08-28 |
| CVE-2006-5958 EXP | Multiple cross-site scripting (XSS) vulnerabilities in INFINICART allow remote attackers to inject arbitrary web script or HTML via the (1) username a… | Patch early | 6.8 medium | 2.1% | 2006-11-17 |
| CVE-2006-6479 EXP | Multiple cross-site scripting (XSS) vulnerabilities in AnnonceScriptHP 2.0 allow remote attackers to inject arbitrary web script or HTML via the email… | Patch early | 6.8 medium | 2.1% | 2006-12-12 |
| CVE-2006-6520 EXP | Multiple cross-site scripting (XSS) vulnerabilities in Messageriescripthp 2.0 allow remote attackers to inject arbitrary web script or HTML via the (1… | Patch early | 6.8 medium | 2.1% | 2006-12-14 |
| CVE-2007-0119 EXP | Multiple cross-site scripting (XSS) vulnerabilities in EditTag 1.2 allow remote attackers to inject arbitrary web script or HTML via the plain paramet… | Patch early | 6.8 medium | 2.1% | 2007-01-09 |
| CVE-2008-5274 EXP | Todd Woolums ASP News Management 2.2 allows remote attackers to obtain news items via a direct request to (1) rss.asp, (2) viewheadings.asp, or (3) vi… | Patch early | 5.0 medium | 2.1% | 2008-11-28 |
| CVE-2008-1606 EXP | Multiple directory traversal vulnerabilities in Elastic Path (EP) 4.1 and 4.1.1 allow remote attackers to (1) download arbitrary files via a .. (dot d… | Patch early | 6.0 medium | 2.1% | 2008-04-01 |
| CVE-2006-4836 EXP | SQL injection vulnerability in login.php in DCP-Portal SE 6.0 allows remote attackers to execute arbitrary SQL commands via the username parameter. N… | Patch early | 5.1 medium | 2.1% | 2006-09-15 |
| CVE-2008-4210 EXP | fs/open.c in the Linux kernel before 2.6.22 does not properly strip setuid and setgid bits when there is a write to a file, which allows local users t… | Patch early | 4.6 medium | 2.1% | 2008-09-29 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt