CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
407,432 CVEs
1,741 on KEV
17,302 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-14
152,352 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2007-5489 EXP | Directory traversal vulnerability in index.php in Artmedic CMS 3.4 and earlier allows remote attackers to include and execute arbitrary local files vi… | Patch early | 7.5 high | 2.3% | 2007-10-17 |
| CVE-2008-2284 EXP | PHP remote file inclusion vulnerability in fusebox5.php in Fusebox 5.5.1 allows remote attackers to execute arbitrary PHP code via a URL in the FUSEBO… | Patch early | 7.5 high | 2.3% | 2008-05-18 |
| CVE-2009-1486 EXP | Directory traversal vulnerability in pmscript.php in Flatchat 3.0 allows remote attackers to include and execute arbitrary local files via a .. (dot d… | Patch early | 7.5 high | 2.3% | 2009-04-29 |
| CVE-2009-2792 EXP | Directory traversal vulnerability in plugings/pagecontent.php in Really Simple CMS (RSCMS) 0.3a allows remote attackers to include and execute arbitra… | Patch early | 7.5 high | 2.3% | 2009-08-17 |
| CVE-2008-4334 EXP | PHP infoBoard V.7 Plus allows remote attackers to bypass authentication and gain administrative access by setting the infouser cookie to 1. | Patch early | 7.5 high | 2.3% | 2008-09-30 |
| CVE-2012-5685 EXP | SQL injection vulnerability in ZPanel 10.0.1 and earlier allows remote attackers to execute arbitrary SQL commands via the inEmailAddress parameter in… | Patch early | 7.5 high | 2.3% | 2014-08-14 |
| CVE-2009-3596 EXP | JoxTechnology Ajox Poll does not properly restrict access to admin/managepoll.php, which allows remote attackers to bypass authentication and gain adm… | Patch early | 7.5 high | 2.3% | 2009-10-08 |
| CVE-2009-3825 EXP | Multiple directory traversal vulnerabilities in GenCMS 2006 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in… | Patch early | 7.5 high | 2.3% | 2009-10-28 |
| CVE-2014-9215 EXP | SQL injection vulnerability in the CheckEmail function in includes/functions.class.php in PBBoard 3.0.1 before 20141128 allows remote attackers to exe… | Patch early | 7.5 high | 2.3% | 2014-12-05 |
| CVE-2007-2575 EXP | PHP remote file inclusion vulnerability in watermark.php in the vm (aka Jean-Francois Laflamme) watermark 0.4.1 mod for Gallery allows remote attacker… | Patch early | 7.5 high | 2.3% | 2007-05-09 |
| CVE-2008-0488 EXP | Directory traversal vulnerability in tseekdir.cgi in VB Marketing allows remote attackers to include and execute arbitrary local files via directory t… | Patch early | 7.5 high | 2.3% | 2008-01-30 |
| CVE-2008-1565 EXP | Directory traversal vulnerability in forum/irc/irc.php in the PJIRC 0.5 module for phpBB allows remote attackers to include and execute arbitrary loca… | Patch early | 7.5 high | 2.3% | 2008-03-31 |
| CVE-2005-0368 EXP | Multiple SQL injection vulnerabilities in CMScore allow remote attackers to execute arbitrary SQL commands via the (1) EntryID or (2) searchterm param… | Patch early | 7.5 high | 2.3% | 2005-05-02 |
| CVE-2008-7155 EXP | NetRisk 1.9.7 does not properly restrict access to admin/change_submit.php, which allows remote attackers to change the password of arbitrary users vi… | Patch early | 7.5 high | 2.3% | 2009-09-02 |
| CVE-2009-2960 EXP | CuteFlow 2.10.3 and 2.11.0_c does not properly restrict access to pages/edituser.php, which allows remote attackers to modify usernames and passwords… | Patch early | 7.5 high | 2.3% | 2009-08-25 |
| CVE-2000-0244 EXP | The Citrix ICA (Independent Computing Architecture) protocol uses weak encryption (XOR) for user authentication. | Patch early | 10.0 high | 2.3% | 2000-03-29 |
| CVE-2010-4851 EXP | Multiple SQL injection vulnerabilities in Eclime 1.1.2b allow remote attackers to execute arbitrary SQL commands via the (1) ref or (2) poll_id parame… | Patch early | 7.5 high | 2.3% | 2011-09-27 |
| CVE-2006-1706 EXP | Multiple SQL injection vulnerabilities in Shopweezle 2.0 allow remote attackers to execute arbitrary SQL commands via the (1) itemID parameter to (a)… | Patch early | 7.5 high | 2.3% | 2006-04-11 |
| CVE-2006-0135 EXP | SQL injection vulnerability in login.php in TheWebForum (twf) 1.2.1 allows remote attackers to execute arbitrary SQL commands and bypass login authent… | Patch early | 7.5 high | 2.3% | 2006-01-09 |
| CVE-2008-6772 EXP | login/register_form.php in YourPlace 1.0.2 and earlier does not check that a username already exists when a new account is created, which allows remot… | Patch early | 7.5 high | 2.3% | 2009-04-29 |
| CVE-2010-4810 EXP | Multiple PHP remote file inclusion vulnerabilities in AR Web Content Manager (AWCM) 2.1 final allow remote attackers to execute arbitrary PHP code via… | Patch early | 7.5 high | 2.3% | 2011-07-08 |
| CVE-2010-4924 EXP | PHP remote file inclusion vulnerability in logic/controller.class.php in clearBudget 0.9.8 allows remote attackers to execute arbitrary PHP code via a… | Patch early | 7.5 high | 2.3% | 2011-10-09 |
| CVE-2013-4879 EXP | SQL injection vulnerability in core/inc/bigtree/cms.php in BigTree CMS 4.0 RC2 and earlier allows remote attackers to execute arbitrary SQL commands v… | Patch early | 7.5 high | 2.3% | 2013-08-14 |
| CVE-2006-7104 EXP | PHP remote file inclusion vulnerability in htmltemplate.php in the Chad Auld MOStlyContent Editor (MOStlyCE) as created on May 2006, a component for M… | Patch early | 7.5 high | 2.3% | 2007-03-03 |
| CVE-2008-6189 EXP | SQL injection vulnerability in GForge 4.5.19 allows remote attackers to execute arbitrary SQL commands via the offset parameter to (1) new/index.php,… | Patch early | 7.5 high | 2.3% | 2009-02-19 |
| CVE-2009-0535 EXP | Directory traversal vulnerability in export.php in Thyme 1.3 and earlier, when register_globals is disabled, allows remote attackers to read arbitrary… | Patch early | 7.5 high | 2.3% | 2009-02-11 |
| CVE-2009-4974 EXP | Directory traversal vulnerability in box_display.php in TotalCalendar 2.4 allows remote attackers to read arbitrary files and possibly have unspecifie… | Patch early | 7.5 high | 2.3% | 2010-07-28 |
| CVE-2006-4867 EXP | SQL injection vulnerability in mods.php in GNUTurk 2G and earlier allows remote attackers to execute arbitrary SQL commands via the t_id parameter whe… | Patch early | 7.5 high | 2.3% | 2006-09-19 |
| CVE-2006-4906 EXP | SQL injection vulnerability in modules/calendar/week.php in More.groupware 0.74 allows remote attackers to execute arbitrary SQL commands via the new_… | Patch early | 7.5 high | 2.3% | 2006-09-21 |
| CVE-2007-1481 EXP | SQL injection vulnerability in index.php in WBBlog allows remote attackers to execute arbitrary SQL commands via the e_id parameter in a viewentry cmd… | Patch early | 7.5 high | 2.3% | 2007-03-16 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt