CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
407,543 CVEs
1,741 on KEV
17,302 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-14
152,376 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2007-4458 EXP | PHP remote file inclusion vulnerability in includes/class/class_tpl.php in Firesoft allows remote attackers to execute arbitrary PHP code via a URL in… | Patch early | 7.5 high | 2.3% | 2007-08-21 |
| CVE-2003-0394 EXP | objects.inc.php4 in BLNews 2.1.3 allows remote attackers to execute arbitrary PHP code via a Server[path] parameter that points to malicious code on a… | Patch early | 7.5 high | 2.3% | 2003-07-02 |
| CVE-2008-4911 EXP | PHP remote file inclusion vulnerability in read.php in Chattaitaliano Istant-Replay allows remote attackers to execute arbitrary PHP code via a URL in… | Patch early | 7.5 high | 2.3% | 2008-11-04 |
| CVE-2009-4094 EXP | PHP remote file inclusion vulnerability in class/php/d4m_ajax_pagenav.php in the D4J eZine (com_ezine) component 2.1 for Joomla! allows remote attacke… | Patch early | 7.5 high | 2.3% | 2009-11-29 |
| CVE-2010-2681 EXP | PHP remote file inclusion vulnerability in the SEF404x (com_sef) component for Joomla! allows remote attackers to execute arbitrary PHP code via a URL… | Patch early | 7.5 high | 2.3% | 2010-07-12 |
| CVE-2013-6341 EXP | SQL injection vulnerability in Dokeos 2.2 RC2 and earlier allows remote attackers to execute arbitrary SQL commands via the language parameter to inde… | Patch early | 7.5 high | 2.3% | 2013-12-05 |
| CVE-2014-1619 EXP | Multiple SQL injection vulnerabilities in Cubic CMS 5.1.1, 5.1.2, and 5.2 allow remote attackers to execute arbitrary SQL commands via the (1) resourc… | Patch early | 7.5 high | 2.3% | 2014-01-21 |
| CVE-2008-6491 EXP | PHP remote file inclusion vulnerability in connexion.php in PHPGKit 0.9 allows remote attackers to execute arbitrary PHP code via a URL in the DOCUMEN… | Patch early | 7.5 high | 2.3% | 2009-03-19 |
| CVE-2019-9769 EXP | PilusCart 1.4.1 is vulnerable to index.php?module=users&action=newUser CSRF, leading to the addition of a new user as administrator. | Patch early | 8.8 high | 2.3% | 2019-03-14 |
| CVE-2019-11569 EXP | Veeam ONE Reporter 9.5.0.3201 allows CSRF. | Patch early | 8.8 high | 2.3% | 2019-05-06 |
| CVE-2026-44403 EXP | Wing FTP Server before 8.1.3 contains an authenticated remote code execution vulnerability in the session serialization mechanism that allows authenti… | Patch early | 7.2 high | 2.3% | 2026-05-12 |
| CVE-2007-4942 EXP | PHP remote file inclusion vulnerability in modules/Discipline/StudentFieldBreakdown.php in Focus/SIS 1.0 allows remote attackers to execute arbitrary… | Patch early | 7.5 high | 2.3% | 2007-09-18 |
| CVE-2007-5567 EXP | PHP remote file inclusion vulnerability in _lib/fckeditor/upload_config.php in Galmeta Post 0.11 allows remote attackers to execute arbitrary PHP code… | Patch early | 7.5 high | 2.3% | 2007-10-18 |
| CVE-2006-5209 EXP | PHP remote file inclusion vulnerability in admin/admin_topic_action_logging.php in Admin Topic Action Logging Mod 0.95 and earlier, as used in phpBB 2… | Patch early | 7.5 high | 2.3% | 2006-10-10 |
| CVE-2006-6890 EXP | Voodoo chat 1.0RC1b stores sensitive information under the web root with insufficient access control, which allows remote attackers to download passwo… | Patch early | 7.5 high | 2.3% | 2006-12-31 |
| CVE-2025-47917 EXP | Mbed TLS before 3.6.4 allows a use-after-free in certain situations of applications that are developed in accordance with the documentation. The funct… | Patch early | 8.9 high | 2.3% | 2025-07-20 |
| CVE-2008-3575 EXP | PHP remote file inclusion vulnerability in modules/calendar/minicalendar.php in ezContents CMS allows remote attackers to execute arbitrary PHP code v… | Patch early | 7.5 high | 2.3% | 2008-08-10 |
| CVE-2009-4085 EXP | PHP remote file inclusion vulnerability in assets/plugins/mp3_id/mp3_id.php in PHP Traverser 0.8.0 allows remote attackers to execute arbitrary PHP co… | Patch early | 7.5 high | 2.3% | 2009-11-29 |
| CVE-2007-2014 EXP | PHP remote file inclusion vulnerability in include/blocks/week_events.php in MyNews 4.2.2 allows remote attackers to execute arbitrary PHP code via a… | Patch early | 7.5 high | 2.3% | 2007-04-12 |
| CVE-2007-2710 EXP | PHP remote file inclusion vulnerability in functions/prepend_adm.php in NagiosQL 2.00-P00 and earlier allows remote attackers to execute arbitrary PHP… | Patch early | 7.5 high | 2.3% | 2007-05-16 |
| CVE-2026-34472 EXP | Unauthenticated credential disclosure in the wizard interface in ZTE ZXHN H188A V6.0.10P2_TE and V6.0.10P3N3_TE allows unauthenticated attackers on th… | Patch early | 7.1 high | 2.3% | 2026-03-30 |
| CVE-2006-2887 EXP | Multiple SQL injection vulnerabilities in myNewsletter 1.1.2 and earlier allow remote attackers to execute arbitrary SQL commands via the UserName par… | Patch early | 7.5 high | 2.3% | 2006-06-07 |
| CVE-2007-6568 EXP | PHP remote file inclusion vulnerability in config.inc.php in XZero Community Classifieds 4.95.11 and earlier allows remote attackers to execute arbitr… | Patch early | 7.5 high | 2.3% | 2007-12-28 |
| CVE-2008-1712 EXP | PHP remote file inclusion vulnerability in includes/functions_weblog.php in mxBB mx_blogs 2.0.0 beta allows remote attackers to execute arbitrary PHP… | Patch early | 7.5 high | 2.3% | 2008-04-09 |
| CVE-2009-3966 EXP | Arcade Trade Script 1.0 allows remote attackers to bypass authentication and gain administrative access by setting the adminLoggedIn cookie to true. | Patch early | 7.5 high | 2.3% | 2009-11-18 |
| CVE-2009-4671 EXP | Login.php in RoomPHPlanning 1.6 allows remote attackers to bypass authentication and obtain administrative access by setting the room_phplanning cooki… | Patch early | 7.5 high | 2.3% | 2010-03-05 |
| CVE-2011-1985 EXP | win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, an… | Patch early | 7.1 high | 2.3% | 2011-10-12 |
| CVE-2006-4876 EXP | Multiple SQL injection vulnerabilities in Jupiter CMS allow remote attackers to execute arbitrary SQL commands via (1) the user name during login, or… | Patch early | 7.5 high | 2.3% | 2006-09-19 |
| CVE-2007-0342 EXP | WebCore in Apple WebKit build 18794 allows remote attackers to cause a denial of service (null dereference and application crash) via a TD element wit… | Patch early | 7.5 high | 2.3% | 2007-01-18 |
| CVE-2007-1615 EXP | SQL injection vulnerability in index.php in ScriptMagix Jokes 2.0 and earlier allows remote attackers to execute arbitrary SQL commands via the catid… | Patch early | 7.5 high | 2.3% | 2007-03-23 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt