CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
407,615 CVEs
1,741 on KEV
17,302 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-14
152,416 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2010-5056 EXP | SQL injection vulnerability in the GBU Facebook (com_gbufacebook) component 1.0.5 for Joomla! allows remote attackers to execute arbitrary SQL command… | Patch early | 7.5 high | 2.3% | 2011-11-23 |
| CVE-2010-5057 EXP | SQL injection vulnerability in detResolucion.php in CMS Ariadna 1.1 allows remote attackers to execute arbitrary SQL commands via the tipodoc_id param… | Patch early | 7.5 high | 2.3% | 2011-11-23 |
| CVE-2010-5062 EXP | SQL injection vulnerability in search.php in MH Products kleinanzeigenmarkt allows remote attackers to execute arbitrary SQL commands via the c parame… | Patch early | 7.5 high | 2.3% | 2011-11-23 |
| CVE-2011-1060 EXP | SQL injection vulnerability in the member function in classes/member.php in WSN Guest 1.24 allows remote attackers to execute arbitrary SQL commands v… | Patch early | 7.5 high | 2.3% | 2011-02-23 |
| CVE-2008-2448 EXP | Multiple SQL injection vulnerabilities in Meto Forum 1.1 allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to (a) admi… | Patch early | 7.5 high | 2.3% | 2008-05-27 |
| CVE-2008-5651 EXP | SQL injection vulnerability in plugins/bookmarker/bookmarker_backend.php in MyioSoft EasyBookMarker 4.0 allows remote attackers to execute arbitrary S… | Patch early | 7.5 high | 2.3% | 2008-12-17 |
| CVE-2008-6952 EXP | SQL injection vulnerability in Rss.php in MauryCMS 0.53.2 and earlier allows remote attackers to execute arbitrary SQL commands via the c parameter. | Patch early | 7.5 high | 2.3% | 2009-08-12 |
| CVE-2008-6446 EXP | Static code injection vulnerability in the Guestbook component in CMS MAXSITE allows remote attackers to inject arbitrary PHP code into the guestbook… | Patch early | 7.5 high | 2.3% | 2009-03-09 |
| CVE-2018-6007 EXP | CSRF exists in the JS Support Ticket 1.1.0 component for Joomla! and allows attackers to inject HTML or edit a ticket. | Patch early | 8.8 high | 2.3% | 2018-01-29 |
| CVE-2005-0691 EXP | PHP remote file inclusion vulnerability in article mode for modules.php in SocialMPN allows remote attackers to execute arbitrary PHP code by modifyin… | Patch early | 7.5 high | 2.3% | 2005-03-06 |
| CVE-2007-6091 EXP | Multiple SQL injection vulnerabilities in files/login.asp in JiRo's Banner System (JBS) 2.0, and possibly JiRo's Upload Manager (aka JiRo's Upload Sys… | Patch early | 7.5 high | 2.3% | 2007-11-22 |
| CVE-2007-6518 EXP | Multiple SQL injection vulnerabilities in search.php in WoltLab Burning Board (wBB) Lite 1.0.2 pl3e allow remote attackers to execute arbitrary SQL co… | Patch early | 7.5 high | 2.3% | 2007-12-24 |
| CVE-2008-3058 EXP | Multiple SQL injection vulnerabilities in Octeth Oempro 3.5.5.1, and possibly other versions before 4, allow remote attackers to execute arbitrary SQL… | Patch early | 7.5 high | 2.3% | 2008-12-03 |
| CVE-2006-7167 EXP | Unspecified vulnerability in ProRat Server 1.9 Fix2 allows remote attackers to bypass the authentication mechanism for remote login via unspecified ve… | Patch early | 7.5 high | 2.3% | 2007-03-20 |
| CVE-2018-15686 EXP | A vulnerability in unit_deserialize of systemd allows an attacker to supply arbitrary state across systemd re-execution via NotifyAccess. This can be… | Patch early | 7.8 high | 2.3% | 2018-10-26 |
| CVE-2006-4372 EXP | PHP remote file inclusion vulnerability in admin.lurm_constructor.php in the Lurm Constructor component (com_lurm_constructor) 0.6b and earlier for Ma… | Patch early | 7.5 high | 2.3% | 2006-08-26 |
| CVE-2006-7172 EXP | Multiple SQL injection vulnerabilities in php-stats.recphp.php in PHP-Stats 0.1.9.1b and earlier allow remote attackers to execute arbitrary code via… | Patch early | 7.5 high | 2.3% | 2007-03-20 |
| CVE-2007-6221 EXP | TuMusika Evolution 1.7R5 allows remote attackers to obtain configuration information via a direct request to phpinfo.php, which calls the phpinfo func… | Patch early | 7.8 high | 2.3% | 2007-12-04 |
| CVE-2026-43500 EXP | In the Linux kernel, the following vulnerability has been resolved: rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present The DATA-… | Patch early | 7.8 high | 2.3% | 2026-05-11 |
| CVE-2006-0961 EXP | SQL injection vulnerability in yazdir.asp in Cilem Hiber 1.1 allows remote attackers to execute arbitrary SQL commands via the haber_id parameter. NO… | Patch early | 7.5 high | 2.3% | 2006-03-02 |
| CVE-2012-2629 EXP | Multiple cross-site request forgery (CSRF) and cross-site scripting (XSS) vulnerabilities in Axous 1.1.1 and earlier allow remote attackers to hijack… | Patch early | 8.8 high | 2.3% | 2020-02-20 |
| CVE-2024-12905 EXP | An Improper Link Resolution Before File Access ("Link Following") and Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal").… | Patch early | 7.5 high | 2.3% | 2025-03-27 |
| CVE-2006-4114 EXP | SQL injection vulnerability in view_com.php in Nicolas Grandjean PHPMyRing 4.2.0 and earlier allows remote attackers to execute arbitrary SQL commands… | Patch early | 7.5 high | 2.3% | 2006-08-14 |
| CVE-2002-2287 EXP | PHP remote file inclusion vulnerability in quick_reply.php for phpBB Advanced Quick Reply Hack 1.0.0 and 1.1.0 allows remote attackers to execute arbi… | Patch early | 7.5 high | 2.3% | 2002-12-31 |
| CVE-2019-13961 EXP | A CSRF vulnerability was found in flatCore before 1.5, leading to the upload of arbitrary .php files via acp/core/files.upload-script.php. | Patch early | 8.8 high | 2.3% | 2019-07-18 |
| CVE-2017-1000370 EXP | The offset2lib patch as used in the Linux Kernel contains a vulnerability that allows a PIE binary to be execve()'ed with 1GB of arguments or environm… | Patch early | 7.8 high | 2.3% | 2017-06-19 |
| CVE-2010-1467 EXP | Multiple PHP remote file inclusion vulnerabilities in openUrgence Vaccin 1.03 allow remote attackers to execute arbitrary PHP code via a URL in the pa… | Patch early | 7.5 high | 2.3% | 2010-04-16 |
| CVE-2009-4670 EXP | admin/delitem.php in RoomPHPlanning 1.6 does not require authentication, which allows remote attackers to (1) delete arbitrary users via the user para… | Patch early | 7.5 high | 2.3% | 2010-03-05 |
| CVE-2009-4801 EXP | EZ-Blog Beta 1 does not require authentication, which allows remote attackers to create or delete arbitrary posts via requests to PHP scripts. | Patch early | 7.5 high | 2.3% | 2010-04-23 |
| CVE-2008-5310 EXP | SQL injection vulnerability in image.php in NetArt Media Car Portal 2.0 allows remote attackers to execute arbitrary SQL commands via the id parameter… | Patch early | 7.5 high | 2.3% | 2008-12-02 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt