CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
405,135 CVEs
1,739 on KEV
17,301 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-13
405,135 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2002-0451 EXP | filemanager_forms.php in PHProjekt 3.1 and 3.1a allows remote attackers to execute arbitrary PHP code by specifying the URL to the code in the lib_pat… | Patch early | 7.5 high | 7.2% | 2002-08-12 |
| CVE-2002-0959 EXP | Cross-site scripting vulnerability in Splatt Forum 3.0 allows remote attackers to execute arbitrary script as other users via an [img] tag with a clos… | Patch early | 7.5 high | 7.2% | 2002-10-04 |
| CVE-2002-1036 EXP | Cross-site scripting vulnerability in search.pl for Fluid Dynamics Search Engine (FDSE) before 2.0.0.0055 allows remote attackers to execute web scrip… | Patch early | 7.5 high | 7.2% | 2002-10-04 |
| CVE-2000-0696 EXP | The administration interface for the dwhttpd web server in Solaris AnswerBook2 does not properly authenticate requests to its supporting CGI scripts,… | Patch early | 7.5 high | 7.2% | 2000-10-20 |
| CVE-2001-0987 EXP | Cross-site scripting vulnerability in CGIWrap before 3.7 allows remote attackers to execute arbitrary Javascript on other web clients by causing the J… | Patch early | 7.5 high | 7.2% | 2001-07-22 |
| CVE-2018-10258 EXP | A CSV Injection vulnerability was discovered in Shopy Point of Sale v1.0 that allows a user with low level privileges to inject a command that will be… | Patch early | 8.8 high | 7.2% | 2018-05-01 |
| CVE-2004-1742 EXP | Directory traversal vulnerability in WebAPP 0.9.9 allows remote attackers to view arbitrary files via a .. (dot dot) in the viewcat parameter. | Patch early | 5.0 medium | 7.2% | 2004-08-24 |
| CVE-2004-1678 EXP | Directory traversal vulnerability in pdesk.cgi in PerlDesk allows remote attackers to read portions of arbitrary files and possibly execute arbitrary… | Patch early | 5.0 medium | 7.2% | 2004-09-13 |
| CVE-2003-1239 EXP | Directory traversal vulnerability in sendphoto.php in WihPhoto 0.86 allows remote attackers to read arbitrary files via .. specifiers in the album par… | Patch early | 5.0 medium | 7.2% | 2003-12-31 |
| CVE-2005-2577 EXP | Wyse Winterm 1125SE running firmware 4.2.09f or 4.4.061f allows remote attackers to cause a denial of service (device crash) via a packet with a zero… | Patch early | 5.0 medium | 7.2% | 2005-08-16 |
| CVE-2006-1103 EXP | engine/server.cpp in Sauerbraten 2006_02_28, as derived from the Cube engine, allows remote attackers to cause a denial of service (segmentation fault… | Patch early | 5.0 medium | 7.2% | 2006-03-09 |
| CVE-2003-1176 EXP | post_message_form.asp in Web Wiz Forums 6.34 through 7.5, when quote mode is used, allows remote attackers to read or write to private forums by modif… | Patch early | 6.4 medium | 7.2% | 2003-12-31 |
| CVE-2010-4055 EXP | Stack consumption vulnerability in solid.exe in IBM solidDB 6.5.0.3 and earlier allows remote attackers to cause a denial of service (memory consumpti… | Patch early | 5.0 medium | 7.2% | 2010-10-23 |
| CVE-2010-4057 EXP | solid.exe in IBM solidDB 6.5.0.3 and earlier does not properly perform a recursive call to a certain function upon receiving packet data containing ma… | Patch early | 5.0 medium | 7.2% | 2010-10-23 |
| CVE-2007-2856 EXP | Buffer overflow in the Dart Communications PowerTCP ZIP Compression ActiveX control in DartZip.dll 1.8.5.3, when Internet Explorer 6 is used, allows u… | Patch early | 9.3 high | 7.2% | 2007-05-24 |
| CVE-2014-9350 EXP | TP-Link TL-WR740N 4 with firmware 3.17.0 Build 140520, 3.16.6 Build 130529, and 3.16.4 Build 130205 allows remote attackers to cause a denial of servi… | Patch early | 5.0 medium | 7.2% | 2014-12-08 |
| CVE-2014-3418 EXP | config/userAdmin/login.tdf in Infoblox NetMRI before 6.8.5 allows remote attackers to execute arbitrary commands via shell metacharacters in the skipj… | Patch early | 10.0 high | 7.2% | 2014-07-15 |
| CVE-2012-4939 EXP | Cross-site scripting (XSS) vulnerability in IPAMSummaryView.aspx in the IPAM web interface before 3.0-HotFix1 in SolarWinds Orion Network Performance… | Patch early | 4.3 medium | 7.2% | 2012-10-31 |
| CVE-2005-3893 EXP | Multiple SQL injection vulnerabilities in index.pl in Open Ticket Request System (OTRS) 1.0.0 through 1.3.2 and 2.0.0 through 2.0.3 allow remote attac… | Patch early | 7.5 high | 7.2% | 2005-11-29 |
| CVE-1999-1109 EXP | Sendmail before 8.10.0 allows remote attackers to cause a denial of service by sending a series of ETRN commands then disconnecting from the server, w… | Patch early | 5.0 medium | 7.2% | 1999-12-22 |
| CVE-2002-0876 EXP | Web server for Shambala 4.5 allows remote attackers to cause a denial of service (crash) via a malformed HTTP request. | Patch early | 5.0 medium | 7.2% | 2002-10-04 |
| CVE-2002-1322 EXP | Rational ClearCase 4.1, 2002.05, and possibly other versions allows remote attackers to cause a denial of service (crash) via certain packets to port… | Patch early | 5.0 medium | 7.2% | 2002-12-11 |
| CVE-2007-1897 EXP | SQL injection vulnerability in xmlrpc (xmlrpc.php) in WordPress 2.1.2, and probably earlier, allows remote authenticated users to execute arbitrary SQ… | Patch early | 6.5 medium | 7.2% | 2007-04-09 |
| CVE-2015-5533 EXP | SQL injection vulnerability in counter-options.php in the Count Per Day plugin before 3.4.1 for WordPress allows remote authenticated administrators t… | Patch early | 7.2 high | 7.2% | 2017-10-23 |
| CVE-2021-21276 EXP | Polr is an open source URL shortener. in Polr before version 2.3.0, a vulnerability in the setup process allows attackers to gain admin access to site… | Patch early | 9.3 critical | 7.2% | 2021-02-01 |
| CVE-2008-1769 EXP | VLC before 0.8.6f allow remote attackers to cause a denial of service (crash) via a crafted Cinepak file that triggers an out-of-bounds array access a… | Patch early | 6.8 medium | 7.2% | 2008-04-25 |
| CVE-2019-5392 EXP | A disclosure of information vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09. | Patch early | 5.3 medium | 7.2% | 2019-06-05 |
| CVE-2002-1436 EXP | The web handler for Perl 5.003 on Novell NetWare 5.1 and NetWare 6 allows remote attackers to execute arbitrary Perl code via an HTTP POST request. | Patch early | 7.5 high | 7.2% | 2003-04-11 |
| CVE-2022-24707 EXP | Anuko Time Tracker is an open source, web-based time tracking application written in PHP. UNION SQL injection and time-based blind injection vulnerabi… | Patch early | 7.4 high | 7.2% | 2022-02-24 |
| CVE-2002-0902 EXP | Cross-site scripting vulnerability in phpBB 2.0.0 (phpBB2) allows remote attackers to execute Javascript as other phpBB users by including a http:// a… | Patch early | 7.5 high | 7.2% | 2002-10-04 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt