CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
407,798 CVEs
1,741 on KEV
17,302 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-14
152,470 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2012-1672 EXP | SQL injection vulnerability in getcity.php in Hotel Booking Portal 0.1 allows remote attackers to execute arbitrary SQL commands via the country param… | Patch early | 7.5 high | 2.2% | 2012-04-11 |
| CVE-2012-1673 EXP | SQL injection vulnerability in loginscript.php in e-ticketing allows remote attackers to execute arbitrary SQL commands via the password parameter. | Patch early | 7.5 high | 2.2% | 2012-04-11 |
| CVE-2026-26235 EXP | JUNG Smart Visu Server 1.1.1050 contains a denial of service vulnerability that allows unauthenticated attackers to remotely shutdown or reboot the se… | Patch early | 7.5 high | 2.2% | 2026-02-12 |
| CVE-2003-0590 EXP | Cross-site scripting (XSS) vulnerability in Splatt Forum allows remote attackers to insert arbitrary HTML and web script via the post icon (image_subj… | Patch early | 7.1 high | 2.2% | 2003-08-18 |
| CVE-2006-0167 EXP | SQL injection vulnerability in MyPhPim 01.05 allows remote attackers to execute arbitrary SQL commands via the (1) cal_id parameter in calendar.php3 a… | Patch early | 7.5 high | 2.2% | 2006-01-11 |
| CVE-2007-1107 EXP | SQL injection vulnerability in thumbnails.php in Coppermine Photo Gallery (CPG) 1.3.x allows remote authenticated users to execute arbitrary SQL comma… | Patch early | 7.5 high | 2.2% | 2007-02-26 |
| CVE-2009-3065 EXP | PHP remote file inclusion vulnerability in editor/edit_htmlarea.php in Ve-EDIT 0.1.4 allows remote attackers to execute arbitrary PHP code via a URL i… | Patch early | 7.5 high | 2.2% | 2009-09-03 |
| CVE-2015-7714 EXP | Multiple SQL injection vulnerabilities in the Realtyna RPL (com_rpl) component before 8.9.5 for Joomla! allow remote administrators to execute arbitra… | Patch early | 7.2 high | 2.2% | 2017-10-18 |
| CVE-2008-6002 EXP | Absolute path traversal vulnerability in sendfile.php in web-cp 0.5.7, when register_globals is enabled, allows remote attackers to read arbitrary fil… | Patch early | 7.1 high | 2.2% | 2009-01-28 |
| CVE-2007-0498 EXP | PHP remote file inclusion vulnerability in up.php in MySpeach 2.1 beta and possibly earlier allows remote attackers to execute arbitrary PHP code via… | Patch early | 7.5 high | 2.2% | 2007-01-25 |
| CVE-2006-5961 EXP | Buffer overflow in Mercury Mail Transport System 4.01b for Windows has unknown impact and attack vectors, as originally reported in a GLEG VulnDisco p… | Patch early | 7.5 high | 2.2% | 2006-11-17 |
| CVE-2005-4380 EXP | Multiple SQL injection vulnerabilities in Bitweaver 1.1 and 1.1.1 beta allow remote attackers to execute arbitrary SQL commands via the (1) sort_mode… | Patch early | 7.5 high | 2.2% | 2005-12-20 |
| CVE-2017-0358 EXP | Jann Horn of Google Project Zero discovered that NTFS-3G, a read-write NTFS driver for FUSE, does not scrub the environment before executing modprobe… | Patch early | 7.8 high | 2.2% | 2018-04-13 |
| CVE-2025-47165 EXP | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | Patch early | 7.8 high | 2.2% | 2025-06-10 |
| CVE-2008-1904 EXP | Cicoandcico CcMail 1.0.1 and earlier does not verify that the this_cookie cookie corresponds to an authenticated session, which allows remote attacker… | Patch early | 7.5 high | 2.2% | 2008-04-22 |
| CVE-2007-1566 EXP | SQL injection vulnerability in News/page.asp in NetVIOS Portal allows remote attackers to execute arbitrary SQL commands via the NewsID parameter. NO… | Patch early | 7.5 high | 2.2% | 2007-03-21 |
| CVE-2006-0870 EXP | SQL injection vulnerability in pages.asp in Mini-Nuke CMS System 1.8.2 and earlier allows remote attackers to execute arbitrary SQL commands via the i… | Patch early | 7.5 high | 2.2% | 2006-02-23 |
| CVE-2007-1838 EXP | SQL injection vulnerability in view.php in the Friendfinder 3.3 and earlier module for Xoops allows remote attackers to execute arbitrary SQL commands… | Patch early | 7.5 high | 2.2% | 2007-04-03 |
| CVE-2005-4169 EXP | Multiple SQL injection vulnerabilities in eFiction 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) let parameter in a viewlis… | Patch early | 7.5 high | 2.2% | 2005-12-11 |
| CVE-2014-3934 EXP | SQL injection vulnerability in the Submit_News module for PHP-Nuke 8.3 allows remote attackers to execute arbitrary SQL commands via the topics[] para… | Patch early | 7.5 high | 2.2% | 2014-06-02 |
| CVE-2006-0491 EXP | SQL injection vulnerability in SZUserMgnt.class.php in SZUserMgnt 1.4 allows remote attackers to execute arbitrary SQL commands via the username param… | Patch early | 7.5 high | 2.2% | 2006-02-01 |
| CVE-2007-1705 EXP | SQL injection vulnerability in default.asp in Active Trade 2 allows remote attackers to execute arbitrary SQL commands via the catid parameter. | Patch early | 7.5 high | 2.2% | 2007-03-27 |
| CVE-2007-1846 EXP | SQL injection vulnerability in index.php in the MyAds 2.04jp and earlier module for Xoops allows remote attackers to execute arbitrary SQL commands vi… | Patch early | 7.5 high | 2.2% | 2007-04-03 |
| CVE-2007-1979 EXP | SQL injection vulnerability in index.php in the PopnupBlog 2.52 and earlier module for Xoops allows remote attackers to execute arbitrary SQL commands… | Patch early | 7.5 high | 2.2% | 2007-04-12 |
| CVE-2008-7178 EXP | Directory traversal vulnerability in Uploader module 1.1 for XOOPS allows remote attackers to read arbitrary files via a .. (dot dot) in the filename… | Patch early | 7.5 high | 2.2% | 2009-09-08 |
| CVE-2005-3423 EXP | Multiple SQL injection vulnerabilities in Subdreamer 2.2.1 allow remote attackers to execute arbitrary SQL commands via (1) the loginusername paramete… | Patch early | 7.5 high | 2.2% | 2005-11-01 |
| CVE-2006-4085 EXP | PHP remote file inclusion vulnerability in Olaf Noehring The Search Engine Project (TSEP) 0.942 and earlier allows remote attackers to execute arbitra… | Patch early | 7.5 high | 2.2% | 2006-08-11 |
| CVE-2006-4217 EXP | PHP remote file inclusion vulnerability in modules/usersonline/users.php in WEBInsta CMS 0.3.1 allows remote attackers to execute arbitrary PHP code v… | Patch early | 7.5 high | 2.2% | 2006-08-17 |
| CVE-2006-4749 EXP | Multiple PHP remote file inclusion vulnerabilities in PHP Advanced Transfer Manager (phpATM) 1.20 allow remote attackers to execute arbitrary PHP code… | Patch early | 7.5 high | 2.2% | 2006-09-13 |
| CVE-2015-8255 EXP | AXIS Communications products allow CSRF, as demonstrated by admin/pwdgrp.cgi, vaconfig.cgi, and admin/local_del.cgi. | Patch early | 8.8 high | 2.2% | 2017-04-10 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt