CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
404,406 CVEs
1,739 on KEV
17,299 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-12
171,297 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2008-3925 EXP | Cross-site request forgery (CSRF) vulnerability in admin.php in Content Management Made Easy (CMME) 1.12 allows remote attackers to trigger the logout… | Patch early | 4.3 medium | 1.1% | 2008-09-04 |
| CVE-2008-0371 EXP | Multiple SQL injection vulnerabilities in aliTalk 1.9.1.1, when magic_quotes_gpc is disabled, allow remote authenticated users to execute arbitrary SQ… | Patch early | 6.8 medium | 1.1% | 2008-01-22 |
| CVE-2003-1520 EXP | SQL injection vulnerability in FuzzyMonkey My Classifieds 2.11 allows remote attackers to execute arbitrary SQL commands via the email parameter. | Patch early | 6.8 medium | 1.1% | 2003-12-31 |
| CVE-2011-5195 EXP | Cross-site request forgery (CSRF) vulnerability in index/manager/fileUpload in Public Knowledge Project Open Conference Systems 2.3.4 and earlier allo… | Patch early | 6.8 medium | 1.1% | 2012-09-23 |
| CVE-2007-1484 EXP | The array_user_key_compare function in PHP 4.4.6 and earlier, and 5.x up to 5.2.1, makes erroneous calls to zval_dtor, which triggers memory corruptio… | Patch early | 4.6 medium | 1.1% | 2007-03-16 |
| CVE-2009-2715 EXP | Sun VirtualBox 2.2 through 3.0.2 r49928 allows guest OS users to cause a denial of service (Linux host OS reboot) via a sysenter instruction. | Patch early | 4.9 medium | 1.1% | 2009-08-07 |
| CVE-2015-7347 EXP | Cross-site scripting (XSS) vulnerability in ZCMS JavaServer Pages Content Management System 1.1. | Patch early | 4.8 medium | 1.1% | 2017-09-20 |
| CVE-2007-2520 EXP | SQL injection vulnerability in admin.php in MyNews 0.10, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands… | Patch early | 6.8 medium | 1.1% | 2007-06-26 |
| CVE-2007-4116 EXP | SQL injection vulnerability in philboard_forum.asp in Metyus Forum Portal 1.0 allows remote attackers to execute arbitrary SQL commands via the forumi… | Patch early | 6.8 medium | 1.1% | 2007-07-31 |
| CVE-2007-4359 EXP | Multiple SQL injection vulnerabilities in SkilMatch Staffing Systems JobLister3 allow remote attackers to execute arbitrary SQL commands via (1) the s… | Patch early | 6.8 medium | 1.1% | 2007-08-15 |
| CVE-2009-0400 EXP | SQL injection vulnerability in blog.php in SocialEngine 3.06 trial allows remote attackers to execute arbitrary SQL commands via the category_id param… | Patch early | 6.8 medium | 1.1% | 2009-02-03 |
| CVE-2009-0409 EXP | SQL injection vulnerability in offline_auth.php in Max.Blog 1.0.6 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute a… | Patch early | 6.8 medium | 1.1% | 2009-02-03 |
| CVE-2012-2956 EXP | SQL injection vulnerability in SpiceWorks 5.3.75941 allows remote authenticated users to execute arbitrary SQL commands via the id parameter to api_v2… | Patch early | 6.5 medium | 1.1% | 2014-09-17 |
| CVE-2020-29477 EXP | Invision Community 4.5.4 is affected by cross-site scripting (XSS) in the Field Name field. This vulnerability can allow an attacker to inject the XSS… | Patch early | 4.8 medium | 1.1% | 2020-12-30 |
| CVE-2020-8504 EXP | School Management Software PHP/mySQL through 2019-03-14 allows office_admin/?action=addadmin CSRF to add an administrative user. | Patch early | 6.5 medium | 1.1% | 2020-01-31 |
| CVE-2020-8505 EXP | School Management Software PHP/mySQL through 2019-03-14 allows office_admin/?action=deleteadmin CSRF to delete a user. | Patch early | 6.5 medium | 1.1% | 2020-01-31 |
| CVE-2006-1422 EXP | SQL injection vulnerability in details_view.php in PHP Booking Calendar 1.0c and earlier allows remote attackers to execute arbitrary SQL commands via… | Patch early | 5.0 medium | 1.1% | 2006-03-28 |
| CVE-2014-1990 EXP | Cross-site request forgery (CSRF) vulnerability in TopAccess (aka the web-based management utility) on TOSHIBA TEC e-Studio 232, 233, 282, and 283 dev… | Patch early | 6.8 medium | 1.1% | 2014-04-19 |
| CVE-2016-7608 EXP | An issue was discovered in certain Apple products. macOS before 10.12.2 is affected. The issue involves the "IOFireWireFamily" component, which allows… | Patch early | 5.5 medium | 1.1% | 2017-02-20 |
| CVE-2004-0244 EXP | Cisco 6000, 6500, and 7600 series systems with Multilayer Switch Feature Card 2 (MSFC2) and a FlexWAN or OSM module allow local users to cause a denia… | Patch early | 4.7 medium | 1.1% | 2004-11-23 |
| CVE-2006-2336 EXP | SQL injection vulnerability in showthread.php in MyBB (aka MyBulletinBoard) 1.1.1 allows remote attackers to execute arbitrary SQL commands via the co… | Patch early | 6.4 medium | 1.1% | 2006-05-12 |
| CVE-2006-1153 EXP | SQL injection vulnerability in D2-Shoutbox 4.2 allows remote attackers to execute arbitrary SQL commands via the load parameter, when performing a Sho… | Patch early | 5.0 medium | 1.1% | 2006-03-10 |
| CVE-2002-1165 EXP | Sendmail Consortium's Restricted Shell (SMRSH) in Sendmail 8.12.6, 8.11.6-15, and possibly other versions after 8.11 from 5/19/1998, allows attackers… | Patch early | 4.6 medium | 1.1% | 2002-10-11 |
| CVE-2005-4781 EXP | Multiple SQL injection vulnerabilities in SergiDs Top Music module 3.0 PR3 and earlier for PHP-Nuke allow remote attackers to execute arbitrary SQL co… | Patch early | 5.0 medium | 1.1% | 2005-12-31 |
| CVE-2006-1420 EXP | SQL injection vulnerability in print.php in SaphpLesson 2.0 allows remote attackers to execute arbitrary SQL commands via the lessid parameter. | Patch early | 5.0 medium | 1.1% | 2006-03-28 |
| CVE-2004-1413 EXP | Multiple SQL injection vulnerabilities in Kayako eSupport 2.x allow remote attackers to execute arbitrary SQL commands via the (1) subcat, (2) rate, (… | Patch early | 5.0 medium | 1.1% | 2004-12-31 |
| CVE-2005-4664 EXP | SQL injection vulnerability in OcoMon 1.21, and possibly other versions, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitra… | Patch early | 5.0 medium | 1.1% | 2005-12-31 |
| CVE-2006-1926 EXP | SQL injection vulnerability in showtopic.php in ThWboard 2.84 beta 3 and earlier allows remote attackers to execute arbitrary SQL commands via the pag… | Patch early | 5.0 medium | 1.1% | 2006-04-20 |
| CVE-2020-29475 EXP | nopCommerce Store 4.30 is affected by cross-site scripting (XSS) in the Schedule tasks name field. This vulnerability can allow an attacker to inject… | Patch early | 4.8 medium | 1.1% | 2020-12-29 |
| CVE-2008-4423 EXP | SQL injection vulnerability in index.php in Ovidentia 6.6.5 allows remote attackers to execute arbitrary SQL commands via the item parameter in a cont… | Patch early | 6.5 medium | 1.1% | 2008-10-03 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt