CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
404,394 CVEs
1,739 on KEV
17,299 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-12
171,289 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2007-1293 EXP | SQL injection vulnerability in Rigter Portal System (RPS) 6.2, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL com… | Patch early | 5.8 medium | 1.2% | 2007-03-07 |
| CVE-2010-2700 EXP | Cross-site scripting (XSS) vulnerability in index.php in Edge PHP Clickbank Affiliate Marketplace Script (CBQuick) allows remote attackers to inject a… | Patch early | 4.3 medium | 1.2% | 2010-07-12 |
| CVE-2009-3420 EXP | Multiple cross-site scripting (XSS) vulnerabilities in index.php in the Publisher module 2.0 for Miniweb allow remote attackers to inject arbitrary we… | Patch early | 4.3 medium | 1.2% | 2009-09-25 |
| CVE-2009-4552 EXP | Cross-site scripting (XSS) vulnerability in the Survey Pro module for Miniweb 2.0 allows remote attackers to inject arbitrary web script or HTML via t… | Patch early | 4.3 medium | 1.2% | 2010-01-04 |
| CVE-2009-4651 EXP | Multiple cross-site scripting (XSS) vulnerabilities in the Webee Comments (com_webeecomment) component 1.1.1, 1.2, and 2.0 for Joomla! allow remote at… | Patch early | 4.3 medium | 1.2% | 2010-02-22 |
| CVE-2009-4780 EXP | Multiple cross-site scripting (XSS) vulnerabilities in index.php in phpMyFAQ before 2.5.5 allow remote attackers to inject arbitrary web script or HTM… | Patch early | 4.3 medium | 1.2% | 2010-04-21 |
| CVE-2008-6597 EXP | Cross-site scripting (XSS) vulnerability in upload/install/index.php in PHCDownload 1.1 allows remote attackers to inject arbitrary web script or HTML… | Patch early | 4.3 medium | 1.2% | 2009-04-03 |
| CVE-2003-1310 EXP | The DeviceIoControl function in the Norton Device Driver (NAVAP.sys) in Symantec Norton AntiVirus 2002 allows local users to gain privileges by overwr… | Patch early | 4.6 medium | 1.2% | 2003-12-31 |
| CVE-2001-0653 EXP | Sendmail 8.10.0 through 8.11.5, and 8.12.0 beta, allows local users to modify process memory and possibly gain privileges via a large value in the 'ca… | Patch early | 4.6 medium | 1.2% | 2001-09-20 |
| CVE-2006-5829 EXP | Multiple SQL injection vulnerabilities in All In One Control Panel (AIOCP) 1.3.007 and earlier allow remote attackers to execute arbitrary SQL command… | Patch early | 6.8 medium | 1.2% | 2006-11-10 |
| CVE-2005-1708 EXP | templates.admin.users.user_form_processing in Blue Coat Reporter before 7.1.2 allows authenticated users to gain administrator privileges via an HTTP… | Patch early | 4.6 medium | 1.2% | 2005-05-24 |
| CVE-2008-0324 EXP | Cisco Systems VPN Client IPSec Driver (CVPNDRVA.sys) 5.0.02.0090 allows local users to cause a denial of service (crash) by calling the 0x80002038 IOC… | Patch early | 4.9 medium | 1.2% | 2008-01-17 |
| CVE-2009-0036 EXP | Buffer overflow in the proxyReadClientSocket function in proxy/libvirt_proxy.c in libvirt_proxy 0.5.1 might allow local users to gain privileges by se… | Patch early | 4.4 medium | 1.2% | 2009-02-11 |
| CVE-2007-2752 EXP | SQL injection vulnerability in devami.asp in RunawaySoft Haber portal 1.0 allows remote attackers to execute arbitrary SQL commands via the id paramet… | Patch early | 6.4 medium | 1.2% | 2007-05-17 |
| CVE-2009-1778 EXP | SQL injection vulnerability in the new user registration feature in BigACE CMS 2.5, when magic_quotes_gpc is disabled, allows remote attackers to exec… | Patch early | 6.8 medium | 1.2% | 2009-05-22 |
| CVE-2009-4349 EXP | Cross-site request forgery (CSRF) vulnerability in administration/administrators.php in Link Up Gold 5.0 allows remote attackers to hijack the authent… | Patch early | 6.8 medium | 1.2% | 2009-12-17 |
| CVE-2007-4645 EXP | SQL injection vulnerability in index.php in NMDeluxe 2.0.0 allows remote attackers to execute arbitrary SQL commands via the id parameter in a newspos… | Patch early | 6.4 medium | 1.2% | 2007-08-31 |
| CVE-2006-6343 EXP | SQL injection vulnerability in polls.php in Neocrome Seditio 1.10 and earlier allows remote attackers to execute arbitrary SQL commands via the id par… | Patch early | 6.8 medium | 1.2% | 2006-12-07 |
| CVE-2012-4054 EXP | Buffer overflow in the readfile function in CPE17 Autorun Killer 1.7.1 and earlier allows physically proximate attackers to execute arbitrary code via… | Patch early | 6.9 medium | 1.2% | 2012-07-25 |
| CVE-2013-5730 EXP | Multiple cross-site request forgery (CSRF) vulnerabilities in D-Link DSL-2740B Gateway with firmware EU_1.00 allow remote attackers to hijack the auth… | Patch early | 6.8 medium | 1.2% | 2013-11-20 |
| CVE-2008-0538 EXP | Multiple SQL injection vulnerabilities in phpIP Management 4.3.2 allow remote attackers to execute arbitrary SQL commands via the (1) password paramet… | Patch early | 6.8 medium | 1.2% | 2008-02-01 |
| CVE-2006-1864 EXP | Directory traversal vulnerability in smbfs in Linux 2.6.16 and earlier allows local users to escape chroot restrictions for an SMB-mounted filesystem… | Patch early | 4.6 medium | 1.2% | 2006-04-26 |
| CVE-2024-50562 EXP | An Insufficient Session Expiration vulnerability [CWE-613] in FortiOS SSL-VPN version 7.6.0, version 7.4.6 and below, version 7.2.10 and below, 7.0 al… | Patch early | 4.8 medium | 1.2% | 2025-06-10 |
| CVE-2011-4834 EXP | The GetInstalledPackages function in the configuration tool in HP Application Lifestyle Management (ALM) 11 on AIX, HP-UX, and Solaris allows local us… | Patch early | 4.6 medium | 1.2% | 2011-12-15 |
| CVE-2013-3095 EXP | Multiple cross-site request forgery (CSRF) vulnerabilities in D-Link DIR865L router (Rev. A1) with firmware before 1.05b07 allow remote attackers to h… | Patch early | 6.8 medium | 1.2% | 2013-11-20 |
| CVE-2009-2172 EXP | Cross-site scripting (XSS) vulnerability in forum/radioandtv.php in the Radio and TV Player addon for vBulletin allows remote registered users to inje… | Patch early | 4.3 medium | 1.2% | 2009-06-23 |
| CVE-2014-2317 EXP | SQL injection vulnerability in ajax_udf.php in OpenDocMan before 1.2.7.2 allows remote attackers to execute arbitrary SQL commands via the table param… | Patch early | 6.8 medium | 1.2% | 2014-03-09 |
| CVE-2017-14489 EXP | The iscsi_if_rx function in drivers/scsi/scsi_transport_iscsi.c in the Linux kernel through 4.13.2 allows local users to cause a denial of service (pa… | Patch early | 5.5 medium | 1.2% | 2017-09-15 |
| CVE-2004-1415 EXP | SQL injection vulnerability in (1) disp_album.php and possibly (2) disp_img.php in 2Bgal 2.4 and 2.5.1 allows remote attackers to execute arbitrary SQ… | Patch early | 5.0 medium | 1.2% | 2004-12-31 |
| CVE-2005-2232 EXP | Buffer overflow in invscout in IBM AIX 5.1.0 through 5.3.0 might allow local users to execute arbitrary code via a long command line argument. | Patch early | 4.6 medium | 1.2% | 2005-07-12 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt