CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
407,410 CVEs
1,741 on KEV
17,302 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-14
152,345 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2009-4096 EXP | RADIO istek scripti 2.5 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain user… | Patch early | 7.5 high | 2.3% | 2009-11-29 |
| CVE-2010-4988 EXP | PHP remote file inclusion vulnerability in mod_chatting/themes/default/header.php in Family Connections Who is Chatting 2.2.3 allows remote attackers… | Patch early | 7.5 high | 2.3% | 2011-11-01 |
| CVE-2009-1226 EXP | core/admin/delete.php in Podcast Generator 1.1 and earlier does not properly restrict access to administrative functions, which allows remote attacker… | Patch early | 7.5 high | 2.3% | 2009-04-02 |
| CVE-2014-100031 EXP | Multiple SQL injection vulnerabilities in Ganesha Digital Library (GDL) 4.2 allow remote attackers to execute arbitrary SQL commands via the id parame… | Patch early | 7.5 high | 2.3% | 2015-01-13 |
| CVE-2014-10020 EXP | SQL injection vulnerability in login.php in Simple e-document 1.31 allows remote attackers to execute arbitrary SQL commands via the username paramete… | Patch early | 7.5 high | 2.3% | 2015-01-13 |
| CVE-2014-10038 EXP | SQL injection vulnerability in agenda/indexdate.php in DomPHP 0.83 and earlier allows remote attackers to execute arbitrary SQL commands via the ids p… | Patch early | 7.5 high | 2.3% | 2015-01-13 |
| CVE-2014-3962 EXP | Multiple SQL injection vulnerabilities in Videos Tube 1.0 allow remote attackers to execute arbitrary SQL commands via the url parameter to (1) videoc… | Patch early | 7.5 high | 2.3% | 2014-06-04 |
| CVE-2014-4736 EXP | SQL injection vulnerability in E2 before 2.4 (2845) allows remote attackers to execute arbitrary SQL commands via the note-id parameter to @actions/co… | Patch early | 7.5 high | 2.3% | 2014-07-24 |
| CVE-2014-4960 EXP | Multiple SQL injection vulnerabilities in models\gallery.php in Youtube Gallery (com_youtubegallery) component 4.x through 4.1.7, and possibly 3.x, fo… | Patch early | 7.5 high | 2.3% | 2014-07-21 |
| CVE-2014-5097 EXP | Multiple SQL injection vulnerabilities in Free Reprintables ArticleFR 3.0.4 and earlier allow remote attackers to execute arbitrary SQL commands via t… | Patch early | 7.5 high | 2.3% | 2014-08-22 |
| CVE-2006-7107 EXP | PHP remote file inclusion vulnerability in upgrade.php in Coalescent Systems freePBX 2.1.3 allows remote attackers to execute arbitrary PHP code via a… | Patch early | 7.5 high | 2.3% | 2007-03-03 |
| CVE-2014-7201 EXP | Multiple SQL injection vulnerabilities in the search function in pi1/class.tx_dmmjobcontrol_pi1.php in the JobControl (dmmjobcontrol) extension 2.14.0… | Patch early | 7.5 high | 2.3% | 2014-10-10 |
| CVE-2014-8295 EXP | SQL injection vulnerability in joblogs.php in Bacula-Web 5.2.10 allows remote attackers to execute arbitrary SQL commands via the jobid parameter. | Patch early | 7.5 high | 2.3% | 2014-10-15 |
| CVE-2014-9095 EXP | Multiple SQL injection vulnerabilities in Raritan Power IQ 4.1.0 and 4.2.1 allow remote attackers to execute arbitrary SQL commands via the (1) sort o… | Patch early | 7.5 high | 2.3% | 2014-11-26 |
| CVE-2014-9345 EXP | SQL injection vulnerability in Guruperl.net Advertise With Pleasure! Professional (aka AWP PRO) 6.6 and earlier allows remote attackers to execute arb… | Patch early | 7.5 high | 2.3% | 2014-12-08 |
| CVE-2014-9348 EXP | SQL injection vulnerability in the formulaireRobot function in admin/robots.lib.php in RobotStats 1.0 allows remote attackers to execute arbitrary SQL… | Patch early | 7.5 high | 2.3% | 2014-12-08 |
| CVE-2014-9440 EXP | SQL injection vulnerability in browse.php in phpMyRecipes 1.2.2 allows remote attackers to execute arbitrary SQL commands via the category parameter. | Patch early | 7.5 high | 2.3% | 2015-01-02 |
| CVE-2018-10312 EXP | index.php?m=member&v=pw_reset in WUZHI CMS 4.1.0 allows CSRF to change the password of a common member. | Patch early | 8.8 high | 2.3% | 2018-04-24 |
| CVE-2018-7176 EXP | FrontAccounting 2.4.3 suffers from a CSRF flaw, which leads to adding a user account via admin/users.php (aka the "add user" feature of the User Permi… | Patch early | 8.8 high | 2.3% | 2018-02-16 |
| CVE-2007-5844 EXP | Directory traversal vulnerability in inc/includes.inc in GuppY 4.6.3 allows remote attackers to include and execute arbitrary local files via a .. (do… | Patch early | 7.5 high | 2.3% | 2007-11-06 |
| CVE-2009-0765 EXP | Directory traversal vulnerability in index.php in Kipper 2.01 allows remote attackers to include and execute arbitrary local files via a .. (dot dot)… | Patch early | 7.5 high | 2.3% | 2009-03-06 |
| CVE-2009-1319 EXP | Directory traversal vulnerability in includes/ini.inc.php in GuestCal 2.1 allows remote attackers to include and execute arbitrary files via a .. (dot… | Patch early | 7.5 high | 2.3% | 2009-04-17 |
| CVE-2009-1502 EXP | Directory traversal vulnerability in plugin.php in S-Cms 1.1 Stable and 1.5.2 allows remote attackers to include and execute arbitrary local files via… | Patch early | 7.5 high | 2.3% | 2009-05-01 |
| CVE-2009-1649 EXP | Directory traversal vulnerability in arch.php in beLive 0.2.3 allows remote attackers to read arbitrary files via a .. (dot dot) in the arch parameter… | Patch early | 7.5 high | 2.3% | 2009-05-16 |
| CVE-2009-1847 EXP | Directory traversal vulnerability in index.php in Easy PX 41 CMS 9.0 B1 allows remote attackers to include and execute arbitrary local files via a ..… | Patch early | 7.5 high | 2.3% | 2009-06-01 |
| CVE-2009-2124 EXP | Directory traversal vulnerability in page.php in Elvin 1.2.0 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) i… | Patch early | 7.5 high | 2.3% | 2009-06-19 |
| CVE-2009-3507 EXP | Directory traversal vulnerability in modules.php in CMSphp 0.21 allows remote attackers to include and execute arbitrary local files via a .. (dot dot… | Patch early | 7.5 high | 2.3% | 2009-10-01 |
| CVE-2009-4723 EXP | Directory traversal vulnerability in confirm.php in Netpet CMS 1.9 allows remote attackers to include and execute arbitrary local files via a .. (dot… | Patch early | 7.5 high | 2.3% | 2010-03-18 |
| CVE-2006-7119 EXP | PHP remote file inclusion vulnerability in kernel/system/startup.php in J. He PHPGiggle 12.08 and earlier, as distributed on comscripts.com, allows re… | Patch early | 7.5 high | 2.3% | 2007-03-06 |
| CVE-2024-27620 EXP | An issue in Ladder v.0.0.1 thru v.0.0.21 allows a remote attacker to obtain sensitive information via a crafted request to the API. | Patch early | 7.5 high | 2.3% | 2024-04-06 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt