CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
405,135 CVEs
1,739 on KEV
17,301 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-13
208,754 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2011-4717 EXP | Directory traversal vulnerability in zFTPServer Suite 6.0.0.52 allows remote authenticated users to delete arbitrary directories via a crafted RMD (ak… | Patch early | 5.5 medium | 1.9% | 2011-12-20 |
| CVE-2006-4973 EXP | Cross-site scripting (XSS) vulnerability in Default.aspx in Perpetual Motion Interactive Systems DotNetNuke before 3.3.5, and 4.x before 4.3.5, allows… | Patch early | 4.3 medium | 1.9% | 2006-09-25 |
| CVE-2007-0225 EXP | Cross-site scripting (XSS) vulnerability in shopcustadmin.asp in VP-ASP Shopping Cart 6.09 and earlier allows remote attackers to inject arbitrary web… | Patch early | 6.8 medium | 1.9% | 2007-01-13 |
| CVE-2004-1944 EXP | Eudora 6.1 and 6.0.3 for Windows allows remote attackers to cause a denial of service (crash) via a deeply nested multipart MIME message. | Patch early | 5.0 medium | 1.9% | 2004-04-14 |
| CVE-2009-3424 EXP | Multiple PHP remote file inclusion vulnerabilities in MaxCMS 3.11.20b, when register_globals is enabled, allow remote attackers to execute arbitrary P… | Patch early | 6.8 medium | 1.9% | 2009-09-25 |
| CVE-2008-0159 EXP | SQL injection vulnerability in index.php in eggBlog 3.1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the eggblogpasswor… | Patch early | 6.8 medium | 1.9% | 2008-01-09 |
| CVE-2008-6636 EXP | PHP remote file inclusion vulnerability in skins/default.php in Geody Labs Dagger - The Cutting Edge r12feb2008, when register_globals is enabled, all… | Patch early | 6.8 medium | 1.9% | 2009-04-07 |
| CVE-2023-0214 EXP | A cross-site scripting vulnerability in Skyhigh SWG in main releases 11.x prior to 11.2.6, 10.x prior to 10.2.17, and controlled release 12.x prior to… | Patch early | 6.1 medium | 1.9% | 2023-01-18 |
| CVE-2008-0552 EXP | Cross-site scripting (XSS) vulnerability in index.php in eTicket 1.5.6-RC4 allows remote attackers to inject arbitrary web script or HTML via the PATH… | Patch early | 4.3 medium | 1.9% | 2008-02-01 |
| CVE-2007-1125 EXP | Cross-site scripting (XSS) vulnerability in gallery.php in XeroXer Simple one-file gallery allows remote attackers to inject arbitrary web script or H… | Patch early | 4.3 medium | 1.9% | 2007-02-27 |
| CVE-2013-1649 EXP | Open-Xchange Server before 6.20.7 rev14, 6.22.0 before rev13, and 6.22.1 before rev14 uses the crypt and SHA-1 algorithms for password hashing, which… | Patch early | 4.3 medium | 1.9% | 2013-09-05 |
| CVE-2012-2517 EXP | Cross-site scripting (XSS) vulnerability in PrestaShop before 1.4.9 allows remote attackers to inject arbitrary web script or HTML via the index of th… | Patch early | 6.1 medium | 1.9% | 2020-02-11 |
| CVE-2001-1442 EXP | Buffer overflow in innfeed for ISC InterNetNews (INN) before 2.3.0 allows local users in the "news" group to gain privileges via a long -c command lin… | Patch early | 4.6 medium | 1.9% | 2001-04-21 |
| CVE-2009-2377 EXP | Buffer overflow in the Avax Vector ActiveX control in avPreview.ocx in AVAX-software Avax Vector ActiveX 1.3 allows remote attackers to cause a denial… | Patch early | 4.3 medium | 1.9% | 2009-07-08 |
| CVE-2006-6088 EXP | Multiple cross-site scripting (XSS) vulnerabilities in BlueCollar i-Gallery 3.4 allow remote attackers to inject arbitrary web script or HTML via the… | Patch early | 4.3 medium | 1.9% | 2006-11-24 |
| CVE-2005-3908 EXP | Cross-site scripting (XSS) vulnerability in search.php in GhostScripter Amazon Shop 5.0.0, and other versions before 5.0.2, allows remote attackers to… | Patch early | 4.3 medium | 1.9% | 2005-11-30 |
| CVE-2006-0442 EXP | Multiple cross-site scripting (XSS) vulnerabilities in usercp.php in MyBulletinBoard (MyBB) 1.02 allow remote attackers to inject arbitrary web script… | Patch early | 4.3 medium | 1.9% | 2006-01-26 |
| CVE-2007-4545 EXP | Multiple directory traversal vulnerabilities in Unreal Commander 0.92 build 565 and 573 allow user-assisted remote attackers to create or overwrite ar… | Patch early | 6.8 medium | 1.9% | 2007-08-27 |
| CVE-2007-6079 EXP | Directory traversal vulnerability in include/common.php in bcoos 1.0.10 allows remote attackers to include and execute arbitrary local files via a ..… | Patch early | 6.8 medium | 1.9% | 2007-11-21 |
| CVE-2009-0340 EXP | Multiple directory traversal vulnerabilities in Simple PHP Newsletter 1.5 allow remote attackers to read arbitrary files via a .. (dot dot) in the ola… | Patch early | 6.8 medium | 1.9% | 2009-01-29 |
| CVE-2009-0371 EXP | Directory traversal vulnerability in post.php in SiteXS CMS 0.1.1 and earlier allows remote attackers to include and execute arbitrary local files via… | Patch early | 6.8 medium | 1.9% | 2009-01-30 |
| CVE-2009-1407 EXP | Directory traversal vulnerability in config.php in NotFTP 1.3.1 allows remote attackers to read arbitrary files via a .. (dot dot) in a certain langua… | Patch early | 6.8 medium | 1.9% | 2009-04-24 |
| CVE-2009-1498 EXP | Directory traversal vulnerability in inc/profilemain.php in Game Maker 2k Internet Discussion Boards (iDB) 0.2.5 Pre-Alpha SVN 243 allows remote attac… | Patch early | 6.8 medium | 1.9% | 2009-05-01 |
| CVE-2008-2185 EXP | Directory traversal vulnerability in index.php in SMartBlog (aka SMBlog) 1.3 allows remote attackers to include arbitrary local files via directory tr… | Patch early | 4.3 medium | 1.9% | 2008-05-13 |
| CVE-2023-0961 EXP | A vulnerability was found in SourceCodester Music Gallery Site 1.0. It has been classified as critical. This affects an unknown part of the file view_… | Patch early | 6.3 medium | 1.9% | 2023-02-22 |
| CVE-2006-6786 EXP | Open Newsletter 2.5 and earlier allows remote authenticated administrators to execute arbitrary PHP code by inserting the code into the email paramete… | Patch early | 6.5 medium | 1.9% | 2006-12-28 |
| CVE-2018-15707 EXP | Advantech WebAccess 8.3.1 and 8.3.2 are vulnerable to cross-site scripting in the Bwmainleft.asp page. An attacker could leverage this vulnerability t… | Patch early | 5.4 medium | 1.9% | 2018-10-31 |
| CVE-2006-6518 EXP | Multiple cross-site scripting (XSS) vulnerabilities in ProNews 1.5 allow remote attackers to inject arbitrary web script or HTML via the (1) pseudo, (… | Patch early | 6.8 medium | 1.9% | 2006-12-14 |
| CVE-2006-2124 EXP | Multiple cross-site scripting (XSS) vulnerabilities in SunShop 3.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the (… | Patch early | 5.8 medium | 1.9% | 2006-05-01 |
| CVE-2006-2680 EXP | Cross-site scripting (XSS) vulnerability in index.php in AZ Photo Album Script Pro allows remote attackers to inject arbitrary web script or HTML via… | Patch early | 5.8 medium | 1.9% | 2006-05-31 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt