CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
405,244 CVEs
1,739 on KEV
17,301 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-13
171,718 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2008-7009 EXP | Buffer overflow in multiscan.exe in Check Point ZoneAlarm Security Suite 7.0.483.000 and 8.0.020.000 allows local users to execute arbitrary code via… | Patch early | 6.9 medium | 1.1% | 2009-08-19 |
| CVE-2008-0565 EXP | SQL injection vulnerability in vote.php in DeltaScripts PHP Links 1.3 and earlier allows remote attackers to execute arbitrary SQL commands via the id… | Patch early | 6.8 medium | 1.1% | 2008-02-05 |
| CVE-2005-3257 EXP | The VT implementation (vt_ioctl.c) in Linux kernel 2.6.12, and possibly other versions including 2.6.14.4, allows local users to use the KDSKBSENT ioc… | Patch early | 4.6 medium | 1.1% | 2005-10-18 |
| CVE-2010-5239 EXP | Untrusted search path vulnerability in DAEMON Tools Lite 4.35.6.0091 and Pro Standard 4.36.0309.0160 allows local users to gain privileges via a Troja… | Patch early | 6.9 medium | 1.1% | 2012-09-07 |
| CVE-2026-44595 EXP | Yamcs is a mission control framework. Prior to 5.12.7, the IAM API endpoints listUsers, getUser, listGroups, and getGroup in yamcs-core did not enforc… | Patch early | 4.3 medium | 1.1% | 2026-07-16 |
| CVE-2005-2071 EXP | traceroute in Sun Solaris 10 on x86 systems allows local users to execute arbitrary code with PRIV_NET_RAWACCESS privileges via (1) a large number of… | Patch early | 4.6 medium | 1.1% | 2005-06-29 |
| CVE-2014-9457 EXP | SQL injection vulnerability in classes/mono_display.class.php in PMB 4.1.3 and earlier allows remote authenticated users to execute arbitrary SQL comm… | Patch early | 6.5 medium | 1.1% | 2015-01-02 |
| CVE-2003-0325 EXP | Buffer overflow in Maelstrom 3.0.6, 3.0.5, and earlier allows local users to execute arbitrary code via a long -server command line argument. | Patch early | 4.6 medium | 1.1% | 2003-06-09 |
| CVE-2012-5348 EXP | SQL injection vulnerability in MangosWeb Enhanced 3.0.3 allows remote attackers to execute arbitrary SQL commands via the login parameter in a login a… | Patch early | 6.8 medium | 1.1% | 2012-10-09 |
| CVE-2007-2537 EXP | Multiple SQL injection vulnerabilities in mainfile.php in NPDS 5.10 and earlier allow remote authenticated users to execute arbitrary SQL commands via… | Patch early | 6.5 medium | 1.1% | 2007-05-09 |
| CVE-2006-3931 EXP | Buffer overflow in the daemon function in midirecord.cc in Tuomas Airaksinen Midirecord 2.0 allows local users to execute arbitrary code via a long co… | Patch early | 4.6 medium | 1.1% | 2006-07-31 |
| CVE-2008-6498 EXP | Cross-site request forgery (CSRF) vulnerability in security/xamppsecurity.php in XAMPP 1.6.8 allows remote attackers to hijack the authentication of u… | Patch early | 6.8 medium | 1% | 2009-03-20 |
| CVE-2006-5732 EXP | SQL injection vulnerability in logout.php in T.G.S. CMS 0.1.7 and earlier allows remote attackers to execute arbitrary SQL commands via the myauthorid… | Patch early | 5.0 medium | 1% | 2006-11-06 |
| CVE-2024-13946 EXP | DLL's are not digitally signed when loaded in ASPECT's configuration toolset exposing the application to binary planting during device commissioning.T… | Patch early | 6.8 medium | 1% | 2025-05-22 |
| CVE-2011-4089 EXP | The bzexe command in bzip2 1.0.5 and earlier generates compressed executables that do not properly handle temporary files during extraction, which all… | Patch early | 4.6 medium | 1% | 2014-04-16 |
| CVE-2008-2013 EXP | SQL injection vulnerability in index.php in the pnFlashGames 1.5 through 2.5 module for PostNuke, when magic_quotes_gpc is disabled, allows remote att… | Patch early | 6.8 medium | 1% | 2008-04-30 |
| CVE-2020-7030 EXP | A sensitive information disclosure vulnerability was discovered in the web interface component of IP Office that may potentially allow a local user to… | Patch early | 5.5 medium | 1% | 2020-06-04 |
| CVE-2015-1100 EXP | The kernel in Apple iOS before 8.3, Apple OS X before 10.10.3, and Apple TV before 7.2 allows attackers to cause a denial of service (out-of-bounds me… | Patch early | 5.4 medium | 1% | 2015-04-10 |
| CVE-2013-1773 EXP | Buffer overflow in the VFAT filesystem implementation in the Linux kernel before 3.3 allows local users to gain privileges or cause a denial of servic… | Patch early | 6.2 medium | 1% | 2013-02-28 |
| CVE-2012-5323 EXP | Cross-site request forgery (CSRF) vulnerability in webconfig/admin_passwd/passwd.html/admin_passwd in Xavi X7968 allows remote attackers to hijack the… | Patch early | 6.8 medium | 1% | 2012-10-08 |
| CVE-2007-3687 EXP | SQL injection vulnerability in inferno.php in the Inferno Technologies RPG Inferno 2.4 and earlier, a vBulletin module, allows remote authenticated at… | Patch early | 6.5 medium | 1% | 2007-07-11 |
| CVE-2009-4196 EXP | Multiple cross-site scripting (XSS) vulnerabilities in multiple scripts in Forms/ in Huawei MT882 V100R002B020 ARG-T running firmware 3.7.9.98 allow r… | Patch early | 4.3 medium | 1% | 2009-12-04 |
| CVE-2016-5847 EXP | SAP SAPCAR allows local users to change the permissions of arbitrary files and consequently gain privileges via a hard link attack on files extracted… | Patch early | 5.8 medium | 1% | 2016-08-13 |
| CVE-2008-3531 EXP | Stack-based buffer overflow in sys/kern/vfs_mount.c in the kernel in FreeBSD 7.0 and 7.1, when vfs.usermount is enabled, allows local users to gain pr… | Patch early | 6.9 medium | 1% | 2008-09-05 |
| CVE-2005-4702 EXP | SQL injection vulnerability in the favorites module in index.php in IPBProArcade 2.5.2 allows remote attackers to inject arbitrary SQL commands via th… | Patch early | 6.4 medium | 1% | 2005-12-31 |
| CVE-2009-3002 EXP | The Linux kernel before 2.6.31-rc7 does not initialize certain data structures within getname functions, which allows local users to read the contents… | Patch early | 4.9 medium | 1% | 2009-08-28 |
| CVE-2006-6577 EXP | SQL injection vulnerability in polls.php in Neocrome Land Down Under (LDU) 8.x and earlier allows remote attackers to execute arbitrary SQL commands v… | Patch early | 6.8 medium | 1% | 2006-12-15 |
| CVE-2007-5817 EXP | dialog.php in CONTENTCustomizer 3.1mp and earlier allows remote attackers to perform certain privileged actions via a (1) del, (2) delbackup, (3) res,… | Patch early | 6.1 medium | 1% | 2007-11-05 |
| CVE-2006-3822 EXP | SQL injection vulnerability in index.php in GeodesicSolutions GeoAuctions Enterprise 1.0.6 allows remote attackers to execute arbitrary SQL commands v… | Patch early | 5.1 medium | 1% | 2006-07-25 |
| CVE-2009-4173 EXP | Cross-site request forgery (CSRF) vulnerability in CutePHP CuteNews 1.4.6 and UTF-8 CuteNews before 8b allows remote attackers to hijack the authentic… | Patch early | 6.8 medium | 1% | 2009-12-02 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt