CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
404,381 CVEs
1,739 on KEV
17,299 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-12
171,279 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2008-1479 EXP | Cross-site scripting (XSS) vulnerability in index.php in cyberfrogs.net cfnetgs 0.24 allows remote attackers to inject arbitrary web script or HTML vi… | Patch early | 4.3 medium | 1.2% | 2008-03-24 |
| CVE-2008-1500 EXP | Cross-site scripting (XSS) vulnerability in index.php in TinyPortal 0.8.6 and 1.0.3 allows remote attackers to inject arbitrary web script or HTML via… | Patch early | 4.3 medium | 1.2% | 2008-03-25 |
| CVE-2008-2814 EXP | Cross-site scripting (XSS) vulnerability in WallCity-Server Shoutcast Admin Panel 2.0 allows remote attackers to inject arbitrary web script or HTML v… | Patch early | 4.3 medium | 1.2% | 2008-06-23 |
| CVE-2008-2871 EXP | Multiple cross-site scripting (XSS) vulnerabilities in template2.php in PEGames allow remote attackers to inject arbitrary web script or HTML via the… | Patch early | 4.3 medium | 1.2% | 2008-06-26 |
| CVE-2008-4803 EXP | Cross-site scripting (XSS) vulnerability in index.php in Simple PHP Scripts gallery 0.1, 0.3, and 0.4 allows remote attackers to inject arbitrary web… | Patch early | 4.3 medium | 1.2% | 2008-10-31 |
| CVE-2007-5142 EXP | Cross-site scripting (XSS) vulnerability in buscar.asp in Solidweb Novus 1.0 allows remote attackers to inject arbitrary web script or HTML via the p… | Patch early | 4.3 medium | 1.2% | 2007-09-28 |
| CVE-2007-6003 EXP | Cross-site scripting (XSS) vulnerability in cgi/b/ic/connect in the Thomson SpeedTouch 716 with firmware 5.4.0.14 allows remote attackers to inject ar… | Patch early | 4.3 medium | 1.2% | 2007-11-15 |
| CVE-2005-3928 EXP | Buffer overflow in phgrafx in QNX 6.2.1 and 6.3.0 allows local users to execute arbitrary code via a long command line argument. | Patch early | 4.6 medium | 1.2% | 2005-11-30 |
| CVE-2012-1897 EXP | Multiple cross-site request forgery (CSRF) vulnerabilities in Wolf CMS 0.75 and earlier allow remote attackers to hijack the authentication of adminis… | Patch early | 6.8 medium | 1.2% | 2012-10-01 |
| CVE-2000-0492 EXP | PassWD 1.2 uses weak encryption (trivial encoding) to store passwords, which allows an attacker who can read the password file to easliy decrypt the p… | Patch early | 5.0 medium | 1.2% | 2000-06-04 |
| CVE-2008-1504 EXP | Cross-site scripting (XSS) vulnerability in setup.php3 in phpHeaven phpMyChat 0.14.5 allows remote attackers to inject arbitrary web script or HTML vi… | Patch early | 4.3 medium | 1.2% | 2008-03-25 |
| CVE-2008-1800 EXP | Multiple cross-site scripting (XSS) vulnerabilities in index.php in DivXDB 2002 0.94b allow remote attackers to inject arbitrary web script or HTML vi… | Patch early | 4.3 medium | 1.2% | 2008-04-15 |
| CVE-2008-2264 EXP | Cross-site scripting (XSS) vulnerability in index.php in CyrixMED 1.4 allows remote attackers to inject arbitrary web script or HTML via the msg_erreu… | Patch early | 4.3 medium | 1.2% | 2008-05-16 |
| CVE-2008-3161 EXP | Multiple cross-site scripting (XSS) vulnerabilities in jsp/common/system/debug.jsp in IBM Maximo 4.1 and 5.2 allow remote attackers to inject arbitrar… | Patch early | 4.3 medium | 1.2% | 2008-07-14 |
| CVE-2009-2907 EXP | Multiple cross-site scripting (XSS) vulnerabilities in SpringSource tc Server 6.0.20.B and earlier, Application Management Suite (AMS) before 2.0.0.SR… | Patch early | 4.3 medium | 1.2% | 2010-03-24 |
| CVE-2009-3647 EXP | Cross-site scripting (XSS) vulnerability in emaullinks.php in YABSoft Mega File Hosting Script (aka MFH or MFHS) 1.2 allows remote attackers to inject… | Patch early | 4.3 medium | 1.2% | 2009-10-09 |
| CVE-2009-4209 EXP | Multiple cross-site scripting (XSS) vulnerabilities in admin/index.php in moziloCMS 1.11.1 allow remote attackers to inject arbitrary web script or HT… | Patch early | 4.3 medium | 1.2% | 2009-12-04 |
| CVE-2009-0430 EXP | Multiple cross-site scripting (XSS) vulnerabilities in Active Bids allow remote attackers to inject arbitrary web script or HTML via the (1) search pa… | Patch early | 4.3 medium | 1.2% | 2009-02-05 |
| CVE-2009-1225 EXP | Cross-site scripting (XSS) vulnerability in index.php in Turnkey Ebook Store 1.1 allows remote attackers to inject arbitrary web script or HTML via th… | Patch early | 4.3 medium | 1.2% | 2009-04-02 |
| CVE-2009-1349 EXP | Cross-site scripting (XSS) vulnerability in C2Net Stronghold 2.3 allows remote attackers to inject arbitrary web script or HTML via the URI. | Patch early | 4.3 medium | 1.2% | 2009-04-21 |
| CVE-2009-1620 EXP | Multiple cross-site scripting (XSS) vulnerabilities in input.php in MataChat allow remote attackers to inject arbitrary web script or HTML via the (1)… | Patch early | 4.3 medium | 1.2% | 2009-05-12 |
| CVE-2013-5091 EXP | SQL injection vulnerability in CalendarCommon.php in vTiger CRM 5.4.0 and possibly earlier allows remote authenticated users to execute arbitrary SQL… | Patch early | 6.5 medium | 1.2% | 2013-10-04 |
| CVE-2007-1019 EXP | SQL injection vulnerability in news.php in webSPELL 4.01.02, when register_globals is enabled, allows remote attackers to execute arbitrary SQL comman… | Patch early | 6.8 medium | 1.2% | 2007-02-21 |
| CVE-2020-12704 EXP | UliCMS before 2020.2 has PageController stored XSS. | Patch early | 6.1 medium | 1.2% | 2020-05-07 |
| CVE-2012-4877 EXP | Cross-site request forgery (CSRF) vulnerability in controlcenter.php in FlatnuX CMS 2011 08.09.2 and earlier allows remote attackers to hijack the aut… | Patch early | 6.8 medium | 1.2% | 2012-09-06 |
| CVE-2018-12904 EXP | In arch/x86/kvm/vmx.c in the Linux kernel before 4.17.2, when nested virtualization is used, local attackers could cause L1 KVM guests to VMEXIT, pote… | Patch early | 4.9 medium | 1.2% | 2018-06-27 |
| CVE-2010-4151 EXP | SQL injection vulnerability in misc.php in DeluxeBB 1.3, and possibly earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute a… | Patch early | 6.8 medium | 1.2% | 2010-11-03 |
| CVE-2016-6828 EXP | The tcp_check_send_head function in include/net/tcp.h in the Linux kernel before 4.7.5 does not properly maintain certain SACK state after a failed da… | Patch early | 5.5 medium | 1.2% | 2016-10-16 |
| CVE-2007-4863 EXP | SQL injection vulnerability in example.php in SAXON 5.4 allows remote attackers to execute arbitrary SQL commands via the template parameter. | Patch early | 6.8 medium | 1.2% | 2007-10-30 |
| CVE-2018-4863 EXP | Sophos Endpoint Protection 10.7 allows local users to bypass an intended tamper protection mechanism by deleting the HKEY_LOCAL_MACHINE\SYSTEM\Current… | Patch early | 5.5 medium | 1.2% | 2018-04-05 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt