CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
408,216 CVEs
1,745 on KEV
17,306 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-15
152,667 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2014-6046 EXP | Multiple cross-site request forgery (CSRF) vulnerabilities in phpMyFAQ before 2.8.13 allow remote attackers to hijack the authentication of unspecifie… | Patch early | 8.8 high | 1.9% | 2018-08-28 |
| CVE-2007-2092 EXP | Direct static code injection vulnerability in index.php in Limesoft Guestbook (LS Simple Guestbook) allows remote attackers to inject arbitrary PHP co… | Patch early | 7.5 high | 1.9% | 2007-04-18 |
| CVE-2018-14894 EXP | CyberArk Endpoint Privilege Manager 10.2.1.603 and earlier allows an attacker (who is able to edit permissions of a file) to bypass intended access re… | Patch early | 7.8 high | 1.9% | 2019-04-09 |
| CVE-2018-6888 EXP | An issue was discovered in Typesetter 5.1. The User Permissions page (aka Admin/Users) suffers from critical flaw of Cross Site Request forgery: using… | Patch early | 8.0 high | 1.9% | 2018-02-12 |
| CVE-2012-2105 EXP | Multiple SQL injection vulnerabilities in login.php in Timesheet Next Gen 1.5.2 allow remote attackers to execute arbitrary SQL commands via the (1) u… | Patch early | 7.5 high | 1.9% | 2012-09-19 |
| CVE-2009-0964 EXP | UserView_list.php in PHPRunner 4.2, and possibly earlier, stores passwords in cleartext in the database, which allows attackers to gain privileges. N… | Patch early | 7.5 high | 1.9% | 2009-03-19 |
| CVE-2010-2554 EXP | The Tracing Feature for Services in Microsoft Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 has incorrect ACLs on it… | Patch early | 7.8 high | 1.9% | 2010-08-11 |
| CVE-2026-25099 EXP | Bludit’s API plugin allows an authenticated attacker with a valid API token to upload files of any type and extension without restriction, which can t… | Patch early | 8.8 high | 1.9% | 2026-03-27 |
| CVE-2003-0144 EXP | Buffer overflow in the lprm command in the lprold lpr package on SuSE 7.1 through 7.3, OpenBSD 3.2 and earlier, and possibly other operating systems,… | Patch early | 7.2 high | 1.9% | 2003-03-31 |
| CVE-2026-42471 EXP | Unsafe deserialization vulnerability in MixPHP Framework 2.x thru 2.2.17. The sync-invoke client (Connection.php:76) calls unserialize() on data recei… | Patch early | 8.1 high | 1.9% | 2026-05-01 |
| CVE-2010-1300 EXP | SQL injection vulnerability in index.php in Yamamah (aka Dove Photo Album) 1.00 allows remote attackers to execute arbitrary SQL commands via the calb… | Patch early | 7.5 high | 1.9% | 2010-04-07 |
| CVE-2008-2565 EXP | Multiple SQL injection vulnerabilities in PHP Address Book 3.1.5 and earlier allow remote attackers to execute arbitrary SQL commands via the id param… | Patch early | 7.5 high | 1.9% | 2008-06-06 |
| CVE-2026-55584 EXP | phpSysInfo is a customizable PHP script that displays system information. Prior to 3.4.6, the PSI_ALLOWED access-control check in read_config.php trus… | Patch early | 7.5 high | 1.9% | 2026-08-28 |
| CVE-2025-7766 EXP | Lantronix Provisioning Manager is vulnerable to XML external entity attacks in configuration files supplied by network devices, leading to unauthentic… | Patch early | 8.0 high | 1.9% | 2025-07-22 |
| CVE-2008-6618 EXP | Multiple SQL injection vulnerabilities in ClassSystem 2.3 allow remote attackers to execute arbitrary SQL commands via the teacher_id parameter in (1)… | Patch early | 7.5 high | 1.9% | 2009-04-06 |
| CVE-1999-1491 EXP | abuse.console in Red Hat 2.1 uses relative pathnames to find and execute the undrv program, which allows local users to execute arbitrary commands via… | Patch early | 7.2 high | 1.9% | 1996-02-02 |
| CVE-2007-2598 EXP | SQL injection vulnerability in print.php in SimpleNews 1.0.0 FINAL allows remote attackers to execute arbitrary SQL commands via the news_id parameter… | Patch early | 10.0 high | 1.9% | 2007-05-11 |
| CVE-2017-6008 EXP | A kernel pool overflow in the driver hitmanpro37.sys in Sophos SurfRight HitmanPro before 3.7.20 Build 286 (included in the HitmanPro.Alert solution a… | Patch early | 7.8 high | 1.9% | 2017-09-13 |
| CVE-2016-4625 EXP | Use-after-free vulnerability in IOSurface in Apple OS X before 10.11.6 allows local users to gain privileges via unspecified vectors. | Patch early | 7.8 high | 1.9% | 2016-07-22 |
| CVE-2018-1124 EXP | procps-ng before version 3.3.15 is vulnerable to multiple integer overflows leading to a heap corruption in file2strvec function. This allows a privil… | Patch early | 7.8 high | 1.9% | 2018-05-23 |
| CVE-2017-14757 EXP | OpenText Document Sciences xPression (formerly EMC Document Sciences xPression) v4.5SP1 Patch 13 (older versions might be affected as well) is prone t… | Patch early | 8.8 high | 1.9% | 2017-10-03 |
| CVE-2007-5430 EXP | Multiple SQL injection vulnerabilities in Stride 1.0 allow remote attackers to execute arbitrary SQL commands via (1) the p parameter to main.php in t… | Patch early | 7.5 high | 1.9% | 2007-10-12 |
| CVE-2004-1555 EXP | Multiple SQL injection vulnerabilities in BroadBoard Instant ASP Message Board allow remote attackers to run arbitrary SQL commands via the (1) keywor… | Patch early | 7.5 high | 1.9% | 2004-12-31 |
| CVE-2005-3290 EXP | SQL injection vulnerability in Accelerated Mortgage Manager allows remote attackers to execute arbitrary SQL commands via the password field. | Patch early | 7.5 high | 1.9% | 2005-10-23 |
| CVE-2017-8836 EXP | CSRF exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2_380hw6_580hw2_710hw3_1350hw2_2500-7.0.1-buil… | Patch early | 8.8 high | 1.9% | 2017-06-05 |
| CVE-2007-3884 EXP | SQL injection vulnerability in philboard_forum.asp in husrevforum 1.0.1 allows remote attackers to execute arbitrary SQL commands via the forumid para… | Patch early | 7.5 high | 1.9% | 2007-07-18 |
| CVE-2007-2339 EXP | Multiple SQL injection vulnerabilities in Phorum before 5.1.22 allow remote attackers to execute arbitrary SQL commands via (1) a modified recipients… | Patch early | 7.5 high | 1.9% | 2007-04-27 |
| CVE-2026-34473 EXP | Unauthenticated DoS in ZTE H8102E, H168N, H167A, H199A, H288A, H198A, H267A, H267N, H268A, H388X, H196A, H369A, H268N, H208N, H367N, H181A, and H196Q.… | Patch early | 7.5 high | 1.9% | 2026-05-06 |
| CVE-2006-0311 EXP | SQL injection vulnerability in login.php in aoblogger 2.3 allows remote attackers to execute arbitrary SQL commands via the username parameter. | Patch early | 7.5 high | 1.9% | 2006-01-19 |
| CVE-2006-0774 EXP | SQL injection vulnerability in deleteSession() in DB_eSession library 1.0.2 and earlier, as used in multiple products, allows remote attackers to exec… | Patch early | 7.5 high | 1.9% | 2006-02-19 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt