CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
408,024 CVEs
1,741 on KEV
17,306 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-14
152,576 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2006-5089 EXP | PHP remote file inclusion vulnerability in mybic_server.php in Jim Plush My-BIC 0.6.5 allows remote attackers to execute arbitrary PHP code via a URL… | Patch early | 7.5 high | 2.2% | 2006-09-29 |
| CVE-2006-5739 EXP | PHP remote file inclusion vulnerability in cpadmin/cpa_index.php in Leicestershire communityPortals 1.0_2005-10-18_12-31-18 allows remote attackers to… | Patch early | 7.5 high | 2.2% | 2006-11-06 |
| CVE-2006-6763 EXP | Multiple PHP remote file inclusion vulnerabilities in the Keep It Simple Guest Book (KISGB) allow remote attackers to execute arbitrary PHP code via a… | Patch early | 7.5 high | 2.2% | 2006-12-27 |
| CVE-2005-3305 EXP | Multiple SQL injection vulnerabilities in Nuked Klan 1.7 allow remote attackers to execute arbitrary SQL commands via the (1) forum_id or (2) thread_i… | Patch early | 7.5 high | 2.2% | 2005-10-26 |
| CVE-2007-4046 EXP | SQL injection vulnerability in index.php in the Pony Gallery (com_ponygallery) 1.5 and earlier component for Joomla! allows remote attackers to execut… | Patch early | 7.5 high | 2.2% | 2007-07-27 |
| CVE-2006-5707 EXP | SQL injection vulnerability in index.php in PHPEasyData Pro 1.4.1 and 2.2.1 allows remote attackers to execute arbitrary SQL commands via the cat para… | Patch early | 7.5 high | 2.2% | 2006-11-04 |
| CVE-2010-1498 EXP | Multiple SQL injection vulnerabilities in dl_stats before 2.0 allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) dow… | Patch early | 7.5 high | 2.2% | 2010-04-23 |
| CVE-2007-2889 EXP | SQL injection vulnerability in tracking/courseLog.php in Dokeos 1.6.5 and earlier allows remote attackers to execute arbitrary SQL commands via the sc… | Patch early | 7.5 high | 2.2% | 2007-05-30 |
| CVE-2005-4140 EXP | SQL injection vulnerability in admin/login/index.php in Website Baker 2.6.0 allows remote attackers to execute arbitrary SQL commands via the username… | Patch early | 7.5 high | 2.2% | 2005-12-09 |
| CVE-2005-1287 EXP | Multiple SQL injection vulnerabilities in BK Forum 4.0 allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to member.asp… | Patch early | 7.5 high | 2.2% | 2005-04-23 |
| CVE-2012-4281 EXP | Multiple SQL injection vulnerabilities in Travelon Express 6.2.2 allow remote attackers to execute arbitrary SQL commands via the hid parameter to (1)… | Patch early | 7.5 high | 2.2% | 2012-08-13 |
| CVE-2005-1612 EXP | SQL injection vulnerability in read.php in Open Bulletin Board (OpenBB) 1.0.8 allows remote attackers to execute arbitrary SQL commands via the TID pa… | Patch early | 7.5 high | 2.2% | 2005-05-16 |
| CVE-2006-5251 EXP | PHP remote file inclusion vulnerability in index.php in Deep CMS 2.0a allows remote attackers to execute arbitrary PHP code via a URL in the ConfigDir… | Patch early | 7.5 high | 2.2% | 2006-10-12 |
| CVE-2007-5053 EXP | Multiple incomplete blacklist vulnerabilities in iziContents 1 RC6 and earlier allow remote attackers to execute arbitrary PHP code via a URL in (1) t… | Patch early | 7.5 high | 2.2% | 2007-09-24 |
| CVE-2010-4400 EXP | SQL injection vulnerability in _rights.php in DynPG CMS 4.2.0 allows remote attackers to execute arbitrary SQL commands via the giveRights_UserId para… | Patch early | 7.5 high | 2.2% | 2010-12-06 |
| CVE-2016-2494 EXP | Off-by-one error in sdcard/sdcard.c in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-06-01 allows attackers to… | Patch early | 7.8 high | 2.2% | 2016-06-13 |
| CVE-2000-0449 EXP | Omnis Studio 2.4 uses weak encryption (trivial encoding) for encrypting database fields. | Patch early | 10.0 high | 2.2% | 2000-05-01 |
| CVE-2009-4657 EXP | The administrator package for Xerver 4.32 does not require authentication, which allows remote attackers to alter application settings by connecting t… | Patch early | 7.5 high | 2.2% | 2010-03-03 |
| CVE-2017-16939 EXP | The XFRM dump policy implementation in net/xfrm/xfrm_user.c in the Linux kernel before 4.13.11 allows local users to gain privileges or cause a denial… | Patch early | 7.8 high | 2.2% | 2017-11-24 |
| CVE-2006-0673 EXP | Multiple SQL injection vulnerabilities in cms/index.php in Magic Calendar Lite 1.02, with magic_quotes_gpc disabled, allow remote attackers to execute… | Patch early | 7.5 high | 2.2% | 2006-02-13 |
| CVE-2009-4779 EXP | Multiple PHP remote file inclusion vulnerabilities in NukeHall 0.3 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the s… | Patch early | 7.5 high | 2.1% | 2010-04-21 |
| CVE-2012-2115 EXP | SQL injection vulnerability in interface/login/validateUser.php in OpenEMR 4.1.0 and possibly earlier allows remote attackers to execute arbitrary SQL… | Patch early | 7.5 high | 2.1% | 2012-09-09 |
| CVE-2019-2721 EXP | Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are Prior to 5… | Patch early | 8.8 high | 2.1% | 2019-04-23 |
| CVE-2001-0833 EXP | Buffer overflow in otrcrep in Oracle 8.0.x through 9.0.1 allows local users to execute arbitrary code via a long ORACLE_HOME environment variable, aka… | Patch early | 7.2 high | 2.1% | 2001-12-06 |
| CVE-2006-7091 EXP | PHP remote file inclusion vulnerability in config.php in phpht Topsites FREE 1.022b allows remote attackers to execute arbitrary PHP code via a URL in… | Patch early | 7.5 high | 2.1% | 2007-03-02 |
| CVE-2006-0637 EXP | Buffer overflow in cram.dll in QUALCOMM Eudora WorldMail 3.0 allows remote attackers to execute arbitrary code via an IMAP APPEND command with a long… | Patch early | 7.5 high | 2.1% | 2006-02-10 |
| CVE-2014-5104 EXP | Multiple SQL injection vulnerabilities in ol-commerce 2.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) a_country parameter i… | Patch early | 7.5 high | 2.1% | 2014-07-28 |
| CVE-2025-4255 EXP | A vulnerability classified as critical has been found in PCMan FTP Server 2.0.7. This affects an unknown part of the component RMD Command Handler. Th… | Patch early | 7.3 high | 2.1% | 2025-05-05 |
| CVE-2009-0459 EXP | Multiple SQL injection vulnerabilities in admin/login_submit.php in Whole Hog Password Protect: Enhanced 1.x allow remote attackers to execute arbitra… | Patch early | 7.5 high | 2.1% | 2009-02-10 |
| CVE-1999-0834 EXP | Buffer overflow in RSAREF2 via the encryption and decryption functions in the RSAREF library. | Patch early | 10.0 high | 2.1% | 1999-12-01 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt