CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
407,382 CVEs
1,741 on KEV
17,302 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-14
152,329 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2007-0314 EXP | Multiple PHP remote file inclusion vulnerabilities in Article System 1.0 allow remote attackers to execute arbitrary PHP code via a URL in the INCLUDE… | Patch early | 7.5 high | 2.4% | 2007-01-18 |
| CVE-2010-5289 EXP | Buffer overflow in the Authenticate method in the INCREDISPOOLERLib.Pop ActiveX control in ImSpoolU.dll in IncrediMail 2.0 allows remote attackers to… | Patch early | 7.5 high | 2.4% | 2013-08-25 |
| CVE-2013-5117 EXP | SQL injection vulnerability in the RSS page (DNNArticleRSS.aspx) in the ZLDNN DNNArticle module before 10.1 for DotNetNuke allows remote attackers to… | Patch early | 7.5 high | 2.4% | 2014-03-12 |
| CVE-2008-0850 EXP | Multiple SQL injection vulnerabilities in Dokeos 1.8.4 allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to whoisonlin… | Patch early | 7.5 high | 2.4% | 2008-02-21 |
| CVE-2008-2912 EXP | Multiple PHP remote file inclusion vulnerabilities in Contenido CMS 4.8.4 allow remote attackers to execute arbitrary PHP code via a URL in the (1) co… | Patch early | 7.5 high | 2.4% | 2008-06-30 |
| CVE-2001-0520 EXP | Aladdin eSafe Gateway versions 3.0 and earlier allows a remote attacker to circumvent filtering of SCRIPT tags by embedding the scripts within certain… | Patch early | 7.5 high | 2.4% | 2001-08-14 |
| CVE-2001-0521 EXP | Aladdin eSafe Gateway versions 3.0 and earlier allows a remote attacker to circumvent HTML SCRIPT filtering via the UNICODE encoding of SCRIPT tags wi… | Patch early | 7.5 high | 2.4% | 2001-08-14 |
| CVE-2004-1553 EXP | SQL injection vulnerability in aspWebAlbum allows remote attackers to execute arbitrary SQL statements via (1) the username field on the login page or… | Patch early | 7.5 high | 2.4% | 2004-12-31 |
| CVE-2002-0607 EXP | members.asp in Snitz Forums 2000 version 3.3.03 and earlier allows remote attackers to execute arbitrary code via a SQL injection attack on the parame… | Patch early | 7.5 high | 2.4% | 2002-06-18 |
| CVE-2013-3294 EXP | Multiple SQL injection vulnerabilities in Exponent CMS before 2.2.0 release candidate 1 allow remote attackers to execute arbitrary SQL commands via t… | Patch early | 7.5 high | 2.4% | 2014-02-11 |
| CVE-2014-2211 EXP | SQL injection vulnerability in portal/addtoapplication.php in POSH (aka Posh portal or Portaneo) 3.0 before 3.3.0 allows remote attackers to execute a… | Patch early | 7.5 high | 2.4% | 2014-03-03 |
| CVE-2018-14575 EXP | Trash Bin plugin 1.1.3 for MyBB has cross-site scripting (XSS) via a thread subject and a cross-site request forgery (CSRF) via a post subject. | Patch early | 8.8 high | 2.4% | 2019-03-21 |
| CVE-2007-2673 EXP | SQL injection vulnerability in includes/funcs_vendors.php in Censura 1.15.04, and other versions before 1.16.04, allows remote attackers to execute ar… | Patch early | 7.5 high | 2.4% | 2007-05-14 |
| CVE-2006-2255 EXP | Multiple SQL injection vulnerabilities in Creative Community Portal 1.1 and earlier allow remote attackers to execute arbitrary SQL commands via the (… | Patch early | 7.5 high | 2.4% | 2006-05-09 |
| CVE-2004-0132 EXP | Multiple PHP remote file inclusion vulnerabilities in ezContents 2.0.2 and earlier allow remote attackers to execute arbitrary PHP code from a remote… | Patch early | 7.5 high | 2.4% | 2004-03-03 |
| CVE-2007-4456 EXP | SQL injection vulnerability in index.php in the SimpleFAQ (com_simplefaq) 2.11 component for Mambo allows remote attackers to execute arbitrary SQL co… | Patch early | 7.5 high | 2.4% | 2007-08-21 |
| CVE-2007-6566 EXP | SQL injection vulnerability in post.php in XZero Community Classifieds 4.95.11 and earlier allows remote attackers to execute arbitrary SQL commands v… | Patch early | 7.5 high | 2.4% | 2007-12-28 |
| CVE-2008-5336 EXP | SQL injection vulnerability in index.php in WebStudio CMS allows remote attackers to execute arbitrary SQL commands via the pageid parameter. | Patch early | 7.5 high | 2.4% | 2008-12-05 |
| CVE-2010-4721 EXP | SQL injection vulnerability in news.php in Immo Makler allows remote attackers to execute arbitrary SQL commands via the id parameter. | Patch early | 7.5 high | 2.4% | 2011-02-01 |
| CVE-2019-0943 EXP | An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC). An attacker who successf… | Patch early | 7.8 high | 2.4% | 2019-06-12 |
| CVE-2008-5571 EXP | SQL injection vulnerability in admin/login.asp in Professional Download Assistant 0.1 allows remote attackers to execute arbitrary SQL commands via th… | Patch early | 7.5 high | 2.4% | 2008-12-15 |
| CVE-2008-6837 EXP | SQL injection vulnerability in Zoph 0.7.2.1 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, a different issue than… | Patch early | 7.5 high | 2.4% | 2009-06-27 |
| CVE-2008-2993 EXP | Multiple directory traversal vulnerabilities in index.php in FOG Forum 0.8.1 allow remote attackers to include and execute arbitrary local files via a… | Patch early | 7.5 high | 2.4% | 2008-07-03 |
| CVE-2008-4519 EXP | Multiple directory traversal vulnerabilities in Fastpublish CMS 1.9999 d allow remote attackers to include and execute arbitrary local files via a ..… | Patch early | 7.5 high | 2.4% | 2008-10-09 |
| CVE-2011-4337 EXP | Static code injection vulnerability in translate.php in Support Incident Tracker (aka SiT!) 3.45 through 3.65 allows remote attackers to inject arbitr… | Patch early | 7.5 high | 2.4% | 2012-01-29 |
| CVE-2008-0609 EXP | Directory traversal vulnerability in index.php in DivideConcept VHD Web Pack 2.0 allows remote attackers to include and execute arbitrary local files… | Patch early | 7.5 high | 2.4% | 2008-02-06 |
| CVE-2008-2343 EXP | News Manager 2.0 allows remote attackers to bypass restrictions and obtain sensitive information via a direct request to (1) db/connect_str.php and (2… | Patch early | 7.5 high | 2.4% | 2008-05-19 |
| CVE-2008-2353 EXP | Directory traversal vulnerability in admin.php in GNU/Gallery 1.1.1.0 and earlier allows remote attackers to include and execute arbitrary local files… | Patch early | 7.5 high | 2.4% | 2008-05-20 |
| CVE-2001-1127 EXP | Buffer overflow in Progress database 8.3D and 9.1C could allow a local user to execute arbitrary code via (1) _proapsv, (2) _mprosrv, (3) _mprshut, (4… | Patch early | 7.2 high | 2.4% | 2001-10-05 |
| CVE-2009-4465 EXP | DeluxeBB 1.3 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain user and config… | Patch early | 7.5 high | 2.4% | 2009-12-30 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt