CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
404,394 CVEs
1,739 on KEV
17,299 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-12
208,344 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2007-5674 EXP | Directory traversal vulnerability in index.php in InstaGuide Weather (aka Weather for PHP) 1.0, when magic_quotes_gpc is disabled, allows remote attac… | Patch early | 6.8 medium | 2.1% | 2007-10-24 |
| CVE-2009-4661 EXP | Multiple buffer overflows in BigAnt Server 2.50 SP6 and earlier allow user-assisted remote attackers to cause a denial of service (application crash)… | Patch early | 4.3 medium | 2.1% | 2010-03-03 |
| CVE-2008-5870 EXP | FastStone Image Viewer 3.6 allows user-assisted attackers to cause a denial of service (application crash) via a malformed BMP image with large width… | Patch early | 4.3 medium | 2.1% | 2009-01-08 |
| CVE-2007-4384 EXP | Multiple PHP remote file inclusion vulnerabilities in depouilg.php3 in Stephane Pineau VOTE 1c allow remote attackers to execute arbitrary PHP code vi… | Patch early | 6.8 medium | 2.1% | 2007-08-17 |
| CVE-2006-6778 EXP | Cross-site scripting (XSS) vulnerability in shownews.php in TimberWolf 1.2.2 allows remote attackers to inject arbitrary web script or HTML via the ni… | Patch early | 6.8 medium | 2.1% | 2006-12-28 |
| CVE-2019-11193 EXP | The FileManager in InfinitumIT DirectAdmin through v1.561 has XSS via CMD_FILE_MANAGER, CMD_SHOW_USER, and CMD_SHOW_RESELLER; an attacker can bypass t… | Patch early | 6.1 medium | 2.1% | 2019-04-30 |
| CVE-2006-6289 EXP | Woltlab Burning Board (wBB) Lite 1.0.2 does not properly unset variables when the input data includes a numeric parameter with a value matching an alp… | Patch early | 6.8 medium | 2.1% | 2006-12-05 |
| CVE-2004-0271 EXP | Multiple cross-site scripting vulnerabilities (XSS) in MaxWebPortal allow remote attackers to execute arbitrary web script as other users via (1) the… | Patch early | 6.8 medium | 2.1% | 2004-11-23 |
| CVE-2005-4460 EXP | Cross-site scripting (XSS) vulnerability in Beehive Forum 0.6.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1)… | Patch early | 5.1 medium | 2.1% | 2005-12-21 |
| CVE-2006-2048 EXP | Multiple cross-site scripting (XSS) vulnerabilities in index.php in Edwin van Wijk phpWebFTP 2.3 allow remote attackers to inject arbitrary web script… | Patch early | 4.3 medium | 2.1% | 2006-04-26 |
| CVE-2006-6364 EXP | Cross-site scripting (XSS) vulnerability in error.php in Inside Systems Mail (ISMail) 2.0 and earlier allows remote attackers to inject arbitrary web… | Patch early | 6.8 medium | 2.1% | 2006-12-07 |
| CVE-2007-1714 EXP | Cross-site scripting (XSS) vulnerability in index.php in CcCounter 2.0 allows remote attackers to inject arbitrary web script or HTML via dir paramete… | Patch early | 6.8 medium | 2.1% | 2007-03-27 |
| CVE-2011-5258 EXP | Multiple cross-site scripting (XSS) vulnerabilities in OrangeHRM before 2.6.11.2 allow remote attackers to inject arbitrary web script or HTML via the… | Patch early | 4.3 medium | 2.1% | 2013-02-12 |
| CVE-2005-4206 EXP | Blackboard Learning and Community Portal System in Academic Suite 6.3.1.424, 6.2.3.23, and other versions before 6 allows remote attackers to redirect… | Patch early | 6.1 medium | 2.1% | 2005-12-13 |
| CVE-2012-6042 EXP | GPSMapEdit 1.1.73.2 allows user-assisted remote attackers to cause a denial of service (crash) via a long string in a lst file. | Patch early | 4.3 medium | 2.1% | 2012-11-26 |
| CVE-2006-5096 EXP | Multiple cross-site scripting (XSS) vulnerabilities in index.php in VirtueMart (formerly known as mambo-phpShop) Joomla! eCommerce Edition CMS 1.0.11,… | Patch early | 6.8 medium | 2.1% | 2006-09-29 |
| CVE-2006-5524 EXP | Cross-site scripting (XSS) vulnerability in index.php in phplist 2.10.2 allows remote attackers to inject arbitrary web script or HTML via the p param… | Patch early | 6.8 medium | 2.1% | 2006-10-26 |
| CVE-2010-2618 EXP | PHP remote file inclusion vulnerability in inc/smarty/libs/init.php in AdaptCMS 2.0.0 Beta, when register_globals is enabled, allows remote attackers… | Patch early | 6.8 medium | 2.1% | 2010-07-02 |
| CVE-2009-4977 EXP | PHP remote file inclusion vulnerability in index.php in MyBackup 1.4.0 allows remote authenticated users to execute arbitrary PHP code via a URL in th… | Patch early | 6.5 medium | 2.1% | 2010-08-25 |
| CVE-2007-6470 EXP | phpRPG 0.8 stores sensitive information under the web root with insufficient access control, which allows remote attackers to read session ID values i… | Patch early | 6.4 medium | 2.1% | 2007-12-20 |
| CVE-2006-2423 EXP | Cross-site scripting (XSS) vulnerability in ftplogin/index.php in Confixx 3.1.2 allows remote attackers to inject arbitrary web script or HTML via the… | Patch early | 4.3 medium | 2.1% | 2006-05-17 |
| CVE-2006-5975 EXP | Multiple cross-site scripting (XSS) vulnerabilities in comments.asp in BlogMe 3.0 allow remote attackers to inject arbitrary web script or HTML via th… | Patch early | 6.8 medium | 2.1% | 2006-11-20 |
| CVE-2007-3166 EXP | Buffer overflow in Qualcomm Eudora 7.1.0.9 allows user-assisted, remote IMAP servers to execute arbitrary code via a long FLAGS response to a SELECT I… | Patch early | 6.8 medium | 2.1% | 2007-06-11 |
| CVE-2009-1826 EXP | modules/admuser.php in myGesuad 0.9.14 (aka 0.9) does not require administrative authentication, which allows remote authenticated users to list user… | Patch early | 6.5 medium | 2.1% | 2009-05-29 |
| CVE-2019-6979 EXP | An issue was discovered in the User IP History Logs (aka IP_History_Logs) plugin 1.0.2 for MyBB. There is XSS via the admin/modules/tools/ip_history_l… | Patch early | 6.1 medium | 2.1% | 2019-01-28 |
| CVE-2009-4512 EXP | Directory traversal vulnerability in index.php in Oscailt 3.3, when Use Friendly URL's is disabled, allows remote attackers to include and execute arb… | Patch early | 5.1 medium | 2.1% | 2009-12-31 |
| CVE-2006-6523 EXP | Cross-site scripting (XSS) vulnerability in mail/manage.html in BoxTrapper in cPanel 11 allows remote attackers to inject arbitrary web script or HTML… | Patch early | 6.8 medium | 2.1% | 2006-12-14 |
| CVE-2017-16994 EXP | The walk_hugetlb_range function in mm/pagewalk.c in the Linux kernel before 4.14.2 mishandles holes in hugetlb ranges, which allows local users to obt… | Patch early | 5.5 medium | 2.1% | 2017-11-27 |
| CVE-2009-1767 EXP | admin/edituser.php in 2daybiz Template Monster Clone does not require administrative authentication, which allows remote attackers to modify arbitrary… | Patch early | 5.0 medium | 2.1% | 2009-05-22 |
| CVE-2006-4479 EXP | Cross-site scripting (XSS) vulnerability in loginreq2.php in Visual Shapers ezContents 2.0.3 allows remote attackers to inject arbitrary web script or… | Patch early | 4.3 medium | 2.1% | 2006-08-31 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt