CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
404,381 CVEs
1,739 on KEV
17,299 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-12
208,333 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2016-0400 EXP | CRLF injection vulnerability in IBM WebSphere eXtreme Scale 7.1.0 before 7.1.0.3, 7.1.1 before 7.1.1.1, 8.5 before 8.5.0.3, and 8.6 before 8.6.0.8 all… | Patch early | 6.1 medium | 2.1% | 2016-07-02 |
| CVE-2021-37391 EXP | A user without privileges in Chamilo LMS 1.11.14 can send an invitation message to another user, e.g., the administrator, through main/social/search.p… | Patch early | 5.4 medium | 2.1% | 2021-08-10 |
| CVE-2006-2294 EXP | Cross-site scripting (XSS) vulnerability in Dynamic Galerie 1.0 allows remote attackers to inject arbitrary web script or HTML via the pfad parameter… | Patch early | 6.8 medium | 2.1% | 2006-05-10 |
| CVE-2006-4293 EXP | Multiple cross-site scripting (XSS) vulnerabilities in cPanel 10 allow remote attackers to inject arbitrary web script or HTML via the (1) dir paramet… | Patch early | 4.3 medium | 2.1% | 2006-08-22 |
| CVE-2005-4209 EXP | WorldClient webmail in Alt-N MDaemon 8.1.3 allows remote attackers to prevent arbitrary users from accessing their inboxes via script tags in the Subj… | Patch early | 4.3 medium | 2.1% | 2005-12-13 |
| CVE-2013-5039 EXP | Cross-site request forgery (CSRF) vulnerability in goform/wlanBasicSecurity on the HOT HOTBOX router with software 2.1.11 allows remote attackers to h… | Patch early | 5.4 medium | 2.1% | 2013-12-30 |
| CVE-2006-4563 EXP | Cross-site scripting (XSS) vulnerability in the MyHeadlines before 4.3.2 module for PHP-Nuke allows remote attackers to inject arbitrary web script or… | Patch early | 6.8 medium | 2.1% | 2006-09-06 |
| CVE-2007-6539 EXP | PHP local file inclusion vulnerability in index.php in IDevspot iSupport 1.8 allows remote attackers to include local files via the include_file param… | Patch early | 6.8 medium | 2.1% | 2007-12-27 |
| CVE-2007-1212 EXP | Buffer overflow in the Graphics Device Interface (GDI) in Microsoft Windows 2000 SP4; XP SP2; Server 2003 Gold, SP1, and SP2; and Vista allows local u… | Patch early | 6.6 medium | 2.1% | 2007-04-04 |
| CVE-2008-0210 EXP | Uebimiau Webmail 2.7.10 and 2.7.2 does not protect authentication state variables from being set through HTTP requests, which allows remote attackers… | Patch early | 6.4 medium | 2.1% | 2008-01-10 |
| CVE-2017-1000474 EXP | Soyket Chowdhury Vehicle Sales Management System version 2017-07-30 is vulnerable to multiple SQL Injecting in login/vehicle.php, login/profile.php, l… | Patch early | 9.8 critical | 2.1% | 2018-01-24 |
| CVE-2006-6764 EXP | PHP remote file inclusion vulnerability in authenticate.php in Keep It Simple Guest Book (KISGB), when executing PHP through CGI, allows remote attack… | Patch early | 6.8 medium | 2.1% | 2006-12-27 |
| CVE-2006-6765 EXP | Multiple PHP file inclusion vulnerabilities in src/admin/pt_upload.php in Pagetool 1.07 allow remote attackers to execute arbitrary PHP code via (1) a… | Patch early | 6.8 medium | 2.1% | 2006-12-27 |
| CVE-2006-6774 EXP | PHP remote file inclusion vulnerability in socios/maquetacion_socio.php (members/maquetacion_member.php) in Ciberia Content Federator 1.0 allows remot… | Patch early | 6.8 medium | 2.1% | 2006-12-27 |
| CVE-2006-6796 EXP | PHP remote file inclusion vulnerability in admin/admin_settings.php in MTCMS 2.0 and earlier allows remote attackers to execute arbitrary PHP code via… | Patch early | 6.8 medium | 2.1% | 2006-12-28 |
| CVE-2006-6801 EXP | PHP remote file inclusion vulnerability in misc.php in SH-News 0.93, when register_globals is enabled, allows remote attackers to execute arbitrary PH… | Patch early | 6.8 medium | 2.1% | 2006-12-28 |
| CVE-2008-0184 EXP | Absolute path traversal vulnerability in index.php in Sys-Hotel on Line System allows remote attackers to read arbitrary files via an encoded "/" ("%2… | Patch early | 6.4 medium | 2.1% | 2008-01-09 |
| CVE-2005-0629 EXP | Multiple cross-site scripting (XSS) vulnerabilities in profile.php in 427BB 2.2 allow remote attackers to inject arbitrary web script or HTML via the… | Patch early | 4.3 medium | 2.1% | 2005-03-01 |
| CVE-2009-1677 EXP | Multiple static code injection vulnerabilities in the saveFeed function in rss/feedcreator.class.php in Bitweaver 2.6 and earlier allow (1) remote aut… | Patch early | 6.5 medium | 2.1% | 2009-05-18 |
| CVE-2018-1202 EXP | Dell EMC Isilon versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, and 8.0.0.0 - 8.0.0.6, and version 7.1.1.11 is affected by a cross-site scripti… | Patch early | 4.8 medium | 2.1% | 2018-03-26 |
| CVE-2006-0310 EXP | Cross-site scripting (XSS) vulnerability in aoblogger 2.3 allows remote attackers to inject arbitrary Javascript via a javascript URI in the BBcode ur… | Patch early | 4.3 medium | 2.1% | 2006-01-19 |
| CVE-2006-0361 EXP | Cross-site scripting (XSS) vulnerability in addcomment.php in Bit 5 Blog 8.01 allows remote attackers to inject arbitrary web script or HTML via a jav… | Patch early | 4.3 medium | 2.1% | 2006-01-22 |
| CVE-2006-0443 EXP | Cross-site scripting (XSS) vulnerability in archive.php in CheesyBlog 1.0 allows remote attackers to inject arbitrary web script or HTML via the (1) r… | Patch early | 4.3 medium | 2.1% | 2006-01-26 |
| CVE-2008-6726 EXP | Multiple directory traversal vulnerabilities in CMScout 2.06, when register_globals is enabled, allow remote attackers to include and execute arbitrar… | Patch early | 6.0 medium | 2.1% | 2009-04-17 |
| CVE-2008-6193 EXP | Sam Crew MyBlog stores passwords in cleartext in a MySQL database, which allows context-dependent attackers to obtain sensitive information. | Patch early | 5.0 medium | 2.1% | 2009-02-19 |
| CVE-2009-2037 EXP | Multiple directory traversal vulnerabilities in Online Grades & Attendance 3.2.5 and earlier, and possibly 3.2.6, when register_globals is enabled, al… | Patch early | 6.8 medium | 2.1% | 2009-06-12 |
| CVE-2005-4454 EXP | Validate-before-filter vulnerability in cleanhtml.pl 1.129 in LiveJournal CVS before Dec 7 2005, when the cleancss option is enabled, allows remote at… | Patch early | 4.3 medium | 2.1% | 2005-12-21 |
| CVE-2018-6193 EXP | A Cross-Site Scripting (XSS) vulnerability was found in Routers2 2.24, affecting the 'rtr' GET parameter in a page=graph action to cgi-bin/routers2.pl… | Patch early | 4.7 medium | 2.1% | 2018-01-24 |
| CVE-2005-2441 EXP | Multiple cross-site scripting (XSS) vulnerabilities in VBzoom allow remote attackers to inject arbitrary web script and HTML via the (1) UserName para… | Patch early | 4.3 medium | 2.1% | 2005-08-03 |
| CVE-2015-4118 EXP | SQL injection vulnerability in monitor/show_sys_state.php in ISPConfig before 3.0.5.4p7 allows remote authenticated users with monitor permissions to… | Patch early | 6.5 medium | 2.1% | 2015-06-15 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt