CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
404,492 CVEs
1,739 on KEV
17,299 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-12
171,334 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2005-4158 EXP | Sudo before 1.6.8 p12, when the Perl taint flag is off, does not clear the (1) PERLLIB, (2) PERL5LIB, and (3) PERL5OPT environment variables, which al… | Patch early | 4.6 medium | 1.1% | 2005-12-11 |
| CVE-2008-2096 EXP | SQL injection vulnerability in BackLinkSpider allows remote attackers to execute arbitrary SQL commands via the cat_id parameter to a site-specific co… | Patch early | 6.8 medium | 1.1% | 2008-05-07 |
| CVE-2008-2191 EXP | SQL injection vulnerability in the pnEncyclopedia module 0.2.0 and earlier for PostNuke allows remote attackers to execute arbitrary SQL commands via… | Patch early | 6.8 medium | 1.1% | 2008-05-14 |
| CVE-2008-3788 EXP | Multiple SQL injection vulnerabilities in PICTURESPRO Photo Cart 3.9, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary S… | Patch early | 6.8 medium | 1.1% | 2008-08-26 |
| CVE-2012-5898 EXP | Cross-site request forgery (CSRF) vulnerability in SAMEDIA LandShop 0.9.2 allows remote attackers to hijack the authentication of administrators for r… | Patch early | 6.8 medium | 1.1% | 2012-11-17 |
| CVE-1999-0888 EXP | dbsnmp in Oracle Intelligent Agent allows local users to gain privileges by setting the ORACLE_HOME environmental variable, which dbsnmp uses to find… | Patch early | 4.6 medium | 1.1% | 1999-08-16 |
| CVE-2012-5319 EXP | Cross-site request forgery (CSRF) vulnerability in setup/security.cgi in D-Link DCS-900, DCS-2000, and DCS-5300 allows remote attackers to hijack the… | Patch early | 6.8 medium | 1.1% | 2012-10-08 |
| CVE-2012-4325 EXP | Cross-site request forgery (CSRF) vulnerability in upload/users.php in Utopia News Pro (UNP) 1.4.0 and earlier allows remote attackers to hijack the a… | Patch early | 6.8 medium | 1.1% | 2012-08-14 |
| CVE-2012-5005 EXP | Cross-site request forgery (CSRF) vulnerability in admin/admin_options.php in VR GPub 4.0 allows remote attackers to hijack the authentication of admi… | Patch early | 6.8 medium | 1.1% | 2012-09-19 |
| CVE-2015-7895 EXP | Samsung Gallery on the Samsung Galaxy S6 allows local users to cause a denial of service (process crash). | Patch early | 5.5 medium | 1.1% | 2017-06-27 |
| CVE-2012-5891 EXP | Multiple cross-site request forgery (CSRF) vulnerabilities in photo/pass.php in DAlbum 1.44 build 174 and earlier allow remote attackers to hijack the… | Patch early | 6.8 medium | 1.1% | 2012-11-17 |
| CVE-2007-4106 EXP | SQL injection vulnerability in login.asp in CodeWidgets Pay Roll - Time Sheet and Punch Card Application With Web Interface allows remote attackers to… | Patch early | 6.8 medium | 1.1% | 2007-07-31 |
| CVE-2007-4111 EXP | SQL injection vulnerability in the login script in Real Estate listing website application template, when logging in as user or manager, allows remote… | Patch early | 6.8 medium | 1.1% | 2007-07-31 |
| CVE-2025-55911 EXP | An issue Clip Bucket v.5.5.2 Build#90 allows a remote attacker to execute arbitrary codes via the file_downloader.php and the file parameter | Patch early | 6.5 medium | 1.1% | 2025-09-18 |
| CVE-2015-2572 EXP | Unspecified vulnerability in the Oracle Hyperion Smart View for Office component in Oracle Hyperion 11.1.2.5.216 and earlier, when running on Windows,… | Patch early | 4.6 medium | 1.1% | 2015-04-16 |
| CVE-2009-4906 EXP | Cross-site request forgery (CSRF) vulnerability in index.php in Acc PHP eMail 1.1 allows remote attackers to hijack the authentication of administrato… | Patch early | 6.8 medium | 1.1% | 2010-06-25 |
| CVE-2000-0206 EXP | The installation of Oracle 8.1.5.x on Linux follows symlinks and creates the orainstRoot.sh file with world-writeable permissions, which allows local… | Patch early | 6.2 medium | 1.1% | 2000-03-05 |
| CVE-2009-0851 EXP | Multiple SQL injection vulnerabilities in CelerBB 0.0.2, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands v… | Patch early | 6.8 medium | 1.1% | 2009-03-09 |
| CVE-2001-1077 EXP | Buffer overflow in tt_printf function of rxvt 2.6.2 allows local users to gain privileges via a long (1) -T or (2) -name argument. | Patch early | 4.6 medium | 1.1% | 2001-06-15 |
| CVE-2012-1297 EXP | Multiple cross-site request forgery (CSRF) vulnerabilities in main.php in Contao (formerly TYPOlight) 2.11.0 and earlier allow remote attackers to hij… | Patch early | 6.8 medium | 1.1% | 2012-03-19 |
| CVE-2005-2713 EXP | passwd in Directory Services in Mac OS X 10.3.x before 10.3.9 and 10.4.x before 10.4.5 allows local users to create arbitrary world-writable files as… | Patch early | 6.8 medium | 1.1% | 2005-12-31 |
| CVE-2011-5318 EXP | Multiple cross-site request forgery (CSRF) vulnerabilities in diafan.CMS before 5.1 allow remote attackers to hijack the authentication of administrat… | Patch early | 6.8 medium | 1.1% | 2015-01-01 |
| CVE-2012-1203 EXP | Cross-site request forgery (CSRF) vulnerability in starnet/index.php in SyndeoCMS 3.0 and earlier allows remote attackers to hijack the authentication… | Patch early | 6.8 medium | 1.1% | 2014-12-28 |
| CVE-2012-1415 EXP | Cross-site request forgery (CSRF) vulnerability in lib/logout.php in DFLabs PTK 1.0.5 and earlier allows remote attackers to hijack the authentication… | Patch early | 6.8 medium | 1.1% | 2014-12-28 |
| CVE-2010-5315 EXP | Multiple cross-site request forgery (CSRF) vulnerabilities in BEdita before 3.1 allow remote attackers to hijack the authentication of administrators… | Patch early | 6.8 medium | 1.1% | 2015-01-03 |
| CVE-2014-3866 EXP | Multiple cross-site request forgery (CSRF) vulnerabilities in user_settings.php in Usercake 2.0.2 and earlier allow remote attackers to hijack the aut… | Patch early | 6.8 medium | 1.1% | 2014-05-26 |
| CVE-2008-4175 EXP | Multiple SQL injection vulnerabilities in Link Bid Script 1.5 allow remote attackers to execute arbitrary SQL commands via the (1) ucat parameter to u… | Patch early | 6.5 medium | 1.1% | 2008-09-23 |
| CVE-2006-4709 EXP | SQL injection vulnerability in topic.php in Vikingboard 0.1b allows remote attackers to execute arbitrary SQL commands via the s parameter. | Patch early | 5.0 medium | 1.1% | 2006-09-12 |
| CVE-2005-0823 EXP | ThePoolClub (1) iPool and (2) iSnooker 1.6.81 and earlier stores usernames and passwords in cleartext in the MyDetails.txt file, which allows local us… | Patch early | 4.6 medium | 1.1% | 2005-05-02 |
| CVE-2007-3673 EXP | Symantec symtdi.sys before 7.0.0, as distributed in Symantec AntiVirus Corporate Edition 9 through 10.1 and Client Security 2.0 through 3.1, Norton An… | Patch early | 6.9 medium | 1.1% | 2007-07-15 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt