CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
407,432 CVEs
1,741 on KEV
17,302 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-14
152,352 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2009-2305 EXP | The ARD-9808 DVR card security camera allows remote attackers to cause a denial of service via a long URI composed of //.\ (slash slash dot backslash)… | Patch early | 7.8 high | 2.3% | 2009-07-02 |
| CVE-2009-1444 EXP | PHP remote file inclusion vulnerability in indexk.php in WebPortal CMS 0.8-beta allows remote attackers to execute arbitrary PHP code via a URL in the… | Patch early | 7.5 high | 2.3% | 2009-04-27 |
| CVE-2009-1452 EXP | Multiple PHP remote file inclusion vulnerabilities in theme/format.php in SMA-DB 0.3.13 allow remote attackers to execute arbitrary PHP code via a URL… | Patch early | 7.5 high | 2.3% | 2009-04-28 |
| CVE-2008-6022 EXP | PHP remote file inclusion vulnerability in includes/todofleetcontrol.php in an older version of Xnova, possibly 0.8 sp1, allows remote attackers to ex… | Patch early | 7.5 high | 2.3% | 2009-02-02 |
| CVE-2008-6023 EXP | PHP remote file inclusion vulnerability in includes/todofleetcontrol.php in a newer version of Xnova, possibly 0.8 sp1, allows remote attackers to exe… | Patch early | 7.5 high | 2.3% | 2009-02-02 |
| CVE-2009-4220 EXP | PHP remote file inclusion vulnerability in includes/classes/pctemplate.php in PointComma 3.8b2 and earlier allows remote attackers to execute arbitrar… | Patch early | 7.5 high | 2.3% | 2009-12-07 |
| CVE-2009-4604 EXP | PHP remote file inclusion vulnerability in mamboleto.php in the Fernando Soares Mamboleto (com_mamboleto) component 2.0 RC3 for Joomla! allows remote… | Patch early | 7.5 high | 2.3% | 2010-01-12 |
| CVE-2014-9528 EXP | SQL injection vulnerability in the actionIndex function in protected/modules_core/notification/controllers/ListController.php in HumHub 0.10.0-rc.1 an… | Patch early | 7.5 high | 2.3% | 2015-01-06 |
| CVE-2009-0458 EXP | Multiple SQL injection vulnerabilities in admin/login_submit.php in Whole Hog Ware Support 1.x allow remote attackers to execute arbitrary SQL command… | Patch early | 7.5 high | 2.3% | 2009-02-10 |
| CVE-2005-4821 EXP | Multiple SQL injection vulnerabilities in Land Down Under (LDU) v801 and earlier allow remote attackers to execute arbitrary SQL commands via paramete… | Patch early | 7.5 high | 2.3% | 2005-12-31 |
| CVE-2007-1961 EXP | PHP remote file inclusion vulnerability in mutant_functions.php in the Mutant 0.9.2 portal for phpBB 2.2 allows remote attackers to execute arbitrary… | Patch early | 7.5 high | 2.3% | 2007-04-11 |
| CVE-2007-2302 EXP | PHP remote file inclusion vulnerability in autoindex.php in Expow 0.8 allows remote attackers to execute arbitrary PHP code via a URL in the cfg_file… | Patch early | 7.5 high | 2.3% | 2007-04-26 |
| CVE-2007-3136 EXP | PHP remote file inclusion vulnerability in inc/nuke_include.php in newsSync 1.5.0rc6 allows remote attackers to execute arbitrary PHP code via a URL i… | Patch early | 7.5 high | 2.3% | 2007-06-08 |
| CVE-2007-3585 EXP | PHP remote file inclusion vulnerability in games.php in MyCMS 0.9.8 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the… | Patch early | 7.5 high | 2.3% | 2007-07-05 |
| CVE-2008-0737 EXP | SQL injection vulnerability in admin/utilities_ConfigHelp.asp in CandyPress (CP) 4.1.1.26, and other 4.x and 3.x versions, allows remote attackers to… | Patch early | 7.5 high | 2.3% | 2008-02-13 |
| CVE-2008-3374 EXP | SQL injection vulnerability in ajax.php in Gregarius 0.5.4 and earlier allows remote attackers to execute arbitrary SQL commands via the rsargs array… | Patch early | 7.5 high | 2.3% | 2008-07-30 |
| CVE-2010-4918 EXP | PHP remote file inclusion vulnerability in iJoomla Magazine (com_magazine) component 3.0.1 for Joomla! allows remote attackers to execute arbitrary PH… | Patch early | 7.5 high | 2.3% | 2011-10-08 |
| CVE-2009-4796 EXP | Multiple SQL injection vulnerabilities in the ExecuteQueries function in private/system/classes/listfactory.class.php in glFusion 1.1.2 and earlier al… | Patch early | 7.5 high | 2.3% | 2010-04-22 |
| CVE-2010-2148 EXP | SQL injection vulnerability in the My Car (com_mycar) component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the pagi… | Patch early | 7.5 high | 2.3% | 2010-06-03 |
| CVE-2008-5945 EXP | Nukeviet 2.0 Beta allows remote attackers to bypass authentication and gain administrative access by setting the admf cookie to 1. NOTE: the provenan… | Patch early | 7.5 high | 2.3% | 2009-01-22 |
| CVE-2007-5062 EXP | account.php in Adam Scheinberg Flip 3.0 and earlier allows remote attackers to create administrative accounts via the un parameter in a register actio… | Patch early | 7.5 high | 2.3% | 2007-09-24 |
| CVE-2008-0245 EXP | admin.php in UploadImage 1.0 does not check for the original password before making a change to a new password, which allows remote attackers to gain… | Patch early | 7.5 high | 2.3% | 2008-01-12 |
| CVE-2006-7024 EXP | Multiple PHP remote file inclusion vulnerabilities in Harpia CMS 1.0.5 and earlier allow remote attackers to execute arbitrary PHP code via a URL in t… | Patch early | 7.5 high | 2.3% | 2007-02-15 |
| CVE-2008-4735 EXP | PHP remote file inclusion vulnerability in header.php in Concord Asset, Software, and Ticket system (CoAST) 0.95 allows remote attackers to execute ar… | Patch early | 8.5 high | 2.3% | 2008-10-24 |
| CVE-2008-6545 EXP | PHP remote file inclusion vulnerability in news/include/createdb.php in Web Server Creator Web Portal 0.1 allows remote attackers to execute arbitrary… | Patch early | 7.5 high | 2.3% | 2009-03-30 |
| CVE-2009-0399 EXP | Chipmunk Blogger Script allows remote attackers to gain administrator privileges via a direct request to admin/reguser.php. NOTE: this is only a vuln… | Patch early | 7.5 high | 2.3% | 2009-02-03 |
| CVE-2009-0448 EXP | Directory traversal vulnerability in admin/modules/aa/preview.php in Syntax Desktop 2.7 allows remote attackers to include and execute arbitrary local… | Patch early | 7.5 high | 2.3% | 2009-02-10 |
| CVE-2009-1748 EXP | Multiple directory traversal vulnerabilities in index.php in Catviz 0.4.0 Beta 1 allow remote attackers to read arbitrary files via a .. (dot dot) in… | Patch early | 7.5 high | 2.3% | 2009-05-22 |
| CVE-2009-1770 EXP | Directory traversal vulnerability in includes/database/examples/addressbook.php in Flyspeck CMS 6.8 allows remote attackers to include and execute arb… | Patch early | 7.5 high | 2.3% | 2009-05-22 |
| CVE-2007-4820 EXP | Absolute path traversal vulnerability in blanko.preview.php in Sisfo Kampus 2006 allows remote attackers to read arbitrary local files, and possibly e… | Patch early | 7.5 high | 2.3% | 2007-09-11 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt