CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
404,449 CVEs
1,739 on KEV
17,299 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-12
171,303 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2008-5079 EXP | net/atm/svc.c in the ATM subsystem in the Linux kernel 2.6.27.8 and earlier allows local users to cause a denial of service (kernel infinite loop) by… | Patch early | 4.9 medium | 1.1% | 2008-12-09 |
| CVE-2012-4425 EXP | libgio, when used in setuid or other privileged programs in spice-gtk and possibly other products, allows local users to gain privileges and execute a… | Patch early | 6.9 medium | 1.1% | 2012-09-18 |
| CVE-2015-4677 EXP | Cross-site request forgery (CSRF) vulnerability in FiverrScript (aka Fiverr Script) 7.2 allows remote attackers to hijack the authentication of admini… | Patch early | 6.8 medium | 1.1% | 2015-06-19 |
| CVE-2007-1172 EXP | SQL injection vulnerability in nukesentinel.php in NukeSentinel 2.5.05, and possibly earlier, allows remote attackers to execute arbitrary SQL command… | Patch early | 6.4 medium | 1.1% | 2007-03-02 |
| CVE-2012-4746 EXP | Cross-site request forgery (CSRF) vulnerability in accessaccount.cgi in ZTE ZXDSL 831IIV7.5.0a_Z29_OV allows remote attackers to hijack the authentica… | Patch early | 6.8 medium | 1.1% | 2012-08-31 |
| CVE-2009-0730 EXP | Multiple SQL injection vulnerabilities in the GigCalendar (com_gigcal) component 1.0 for Mambo and Joomla!, when magic_quotes_gpc is disabled, allow r… | Patch early | 6.8 medium | 1.1% | 2009-02-24 |
| CVE-2008-3191 EXP | Multiple SQL injection vulnerabilities in usercp.php in mForum 0.1a, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQ… | Patch early | 6.8 medium | 1.1% | 2008-07-16 |
| CVE-2006-6130 EXP | Apple Mac OS X AppleTalk allows local users to cause a denial of service (kernel panic) by calling the AIOCREGLOCALZN ioctl command with a crafted dat… | Patch early | 4.9 medium | 1.1% | 2006-11-28 |
| CVE-2012-4280 EXP | Multiple cross-site request forgery (CSRF) vulnerabilities in admin/agenteditor.php in Free Realty 3.1-0.6 allow remote attackers to hijack the authen… | Patch early | 6.8 medium | 1.1% | 2012-08-13 |
| CVE-2012-6508 EXP | Multiple cross-site request forgery (CSRF) vulnerabilities in NetArt Media Car Portal 3.0 allow remote attackers to hijack the authentication of admin… | Patch early | 6.8 medium | 1.1% | 2013-01-24 |
| CVE-2012-3294 EXP | Multiple cross-site request forgery (CSRF) vulnerabilities in the Web Gateway component in IBM WebSphere MQ File Transfer Edition 7.0.4 and earlier, a… | Patch early | 6.8 medium | 1.1% | 2012-08-17 |
| CVE-2012-5320 EXP | Cross-site request forgery (CSRF) vulnerability in password.cgi in Sagem F@ST 2604 253180972B allows remote attackers to hijack the authentication of… | Patch early | 6.8 medium | 1.1% | 2012-10-08 |
| CVE-2014-1322 EXP | The kernel in Apple OS X through 10.9.2 places a kernel pointer into an XNU object data structure accessible from user space, which makes it easier fo… | Patch early | 4.9 medium | 1.1% | 2014-04-23 |
| CVE-2009-3313 EXP | Multiple SQL injection vulnerabilities in FMyClone 2.3 allow remote attackers to execute arbitrary SQL commands via the comp parameter to (1) index.ph… | Patch early | 6.5 medium | 1.1% | 2009-09-23 |
| CVE-2008-1790 EXP | Unrestricted file upload vulnerability in iScripts SocialWare allows remote authenticated administrators to upload arbitrary files via a crafted logo… | Patch early | 6.5 medium | 1.1% | 2008-04-15 |
| CVE-2008-3670 EXP | SQL injection vulnerability in authordetail.php in Article Friendly Pro allows remote attackers to execute arbitrary SQL commands via the autid parame… | Patch early | 6.8 medium | 1.1% | 2008-08-13 |
| CVE-2011-1556 EXP | SQL injection vulnerability in plugins/pdfClasses/pdfgen.php in Andy's PHP Knowledgebase (Aphpkb) 0.95.4 allows remote attackers to execute arbitrary… | Patch early | 6.8 medium | 1.1% | 2011-04-04 |
| CVE-2010-0948 EXP | SQL injection vulnerability in profil.php in Bigforum 4.5, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL command… | Patch early | 6.8 medium | 1.1% | 2010-03-10 |
| CVE-2010-1346 EXP | SQL injection vulnerability in admin/login.php in Mini CMS RibaFS 1.0, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary… | Patch early | 6.8 medium | 1.1% | 2010-04-09 |
| CVE-2010-3207 EXP | SQL injection vulnerability in index.php in GaleriaSHQIP 1.0, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL comm… | Patch early | 6.8 medium | 1.1% | 2010-09-03 |
| CVE-2010-4799 EXP | Multiple SQL injection vulnerabilities in Chipmunk Pwngame 1.0, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL com… | Patch early | 6.8 medium | 1.1% | 2011-04-27 |
| CVE-2008-6250 EXP | SQL injection vulnerability in Comdev Web Blogger 4.1.3 and earlier allows remote attackers to execute arbitrary SQL commands via the arcmonth paramet… | Patch early | 6.8 medium | 1.1% | 2009-02-23 |
| CVE-2009-4238 EXP | Multiple SQL injection vulnerabilities in TestLink before 1.8.5 allow remote authenticated users to execute arbitrary SQL commands via (1) the Test Ca… | Patch early | 6.5 medium | 1.1% | 2009-12-10 |
| CVE-2026-54645 EXP | CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/products.index.inc.php reads the description, description_short, and spec_co… | Patch early | 4.8 medium | 1.1% | 2026-09-17 |
| CVE-2009-4351 EXP | SQL injection vulnerability in ADMIN/loginaction.php in WSCreator 1.1, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary… | Patch early | 6.8 medium | 1.1% | 2009-12-17 |
| CVE-2007-6634 EXP | Multiple SQL injection vulnerabilities in FAQMasterFlexPlus, possibly 1.5 or 1.52, allow remote attackers to execute arbitrary SQL commands via the ca… | Patch early | 6.8 medium | 1.1% | 2008-01-04 |
| CVE-2018-11581 EXP | Cross-site scripting (XSS) vulnerability on Brother HL series printers allows remote attackers to inject arbitrary web script or HTML via the url para… | Patch early | 4.8 medium | 1.1% | 2018-06-01 |
| CVE-2009-4907 EXP | Multiple cross-site request forgery (CSRF) vulnerabilities in oBlog allow remote attackers to hijack the authentication of administrators for requests… | Patch early | 6.8 medium | 1.1% | 2010-06-25 |
| CVE-2014-2946 EXP | Cross-site request forgery (CSRF) vulnerability in api/sms/send-sms in the Web UI 11.010.06.01.858 on Huawei E303 modems with software 22.157.18.00.85… | Patch early | 6.8 medium | 1.1% | 2014-06-02 |
| CVE-2014-7951 EXP | Directory traversal vulnerability in the Android debug bridge (aka adb) in Android 4.0.4 allows physically proximate attackers with a direct connectio… | Patch early | 4.6 medium | 1.1% | 2020-02-20 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt