CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
405,505 CVEs
1,739 on KEV
17,301 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-13
171,830 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2007-6087 EXP | Cross-site request forgery (CSRF) vulnerability in index.php in VigileCMS 1.4 allows remote attackers to change the admin password via certain paramet… | Patch early | 6.8 medium | 1% | 2007-11-22 |
| CVE-2009-3621 EXP | net/unix/af_unix.c in the Linux kernel 2.6.31.4 and earlier allows local users to cause a denial of service (system hang) by creating an abstract-name… | Patch early | 5.5 medium | 1% | 2009-10-22 |
| CVE-2003-0848 EXP | Heap-based buffer overflow in main.c of slocate 2.6, and possibly other versions, may allow local users to gain privileges via a modified slocate data… | Patch early | 4.6 medium | 1% | 2003-11-17 |
| CVE-2006-3824 EXP | systeminfo.c for Sun Solaris allows local users to read kernel memory via a 0 variable count argument to the sysinfo system call, which causes a -1 ar… | Patch early | 4.9 medium | 1% | 2006-07-25 |
| CVE-2005-1707 EXP | The fn_show_postinst function in Gentoo webapp-config before 1.10-r14 allows local users to overwrite arbitrary files via a symlink attack on the post… | Patch early | 4.6 medium | 1% | 2005-05-24 |
| CVE-2009-1290 EXP | Multiple cross-site request forgery (CSRF) vulnerabilities in the web administration interface in the Advanced Management Module (AMM) on the IBM Blad… | Patch early | 6.8 medium | 1% | 2009-04-13 |
| CVE-2008-5568 EXP | Cross-site request forgery (CSRF) vulnerability in admin/settings.php in IPN Pro 3 1.44 and earlier allows remote attackers to change the admin passwo… | Patch early | 6.8 medium | 1% | 2008-12-15 |
| CVE-2009-2735 EXP | SQL injection vulnerability in admin.php in sun-jester OpenNews 1.0, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary S… | Patch early | 6.8 medium | 1% | 2009-08-11 |
| CVE-2009-1913 EXP | SQL injection vulnerability in manager.php in LuxBum 0.5.5, when magic_quotes_gpc is disabled and dotclear authentication is used, allows remote attac… | Patch early | 5.1 medium | 1% | 2009-06-04 |
| CVE-2006-4866 EXP | Buffer overflow in kextload in Apple OS X, as used by TDIXSupport in Roxio Toast Titanium and possibly other products, allows local users to execute a… | Patch early | 4.6 medium | 1% | 2006-09-19 |
| CVE-2010-5227 EXP | Untrusted search path vulnerability in Opera before 10.62 allows local users to gain privileges via a Trojan horse dwmapi.dll file in the current work… | Patch early | 6.9 medium | 1% | 2012-09-07 |
| CVE-2008-5123 EXP | SQL injection vulnerability in admin.php in CCleague Pro 1.2 allows remote attackers to execute arbitrary SQL commands via the u parameter. | Patch early | 6.8 medium | 1% | 2008-11-18 |
| CVE-2008-6274 EXP | Multiple SQL injection vulnerabilities in index.php in FamilyProject 2.0 allow remote attackers to execute arbitrary SQL commands via (1) the logmbr p… | Patch early | 6.8 medium | 1% | 2009-02-25 |
| CVE-2008-0397 EXP | Multiple SQL injection vulnerabilities in aflog 1.01, and possibly earlier versions, allow remote attackers to execute arbitrary SQL commands via (1)… | Patch early | 6.8 medium | 1% | 2008-01-23 |
| CVE-2008-2180 EXP | Multiple SQL injection vulnerabilities in cpLinks 1.03, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands vi… | Patch early | 6.8 medium | 1% | 2008-05-13 |
| CVE-2008-4084 EXP | SQL injection vulnerability in staticpages/easyclassifields/index.php in MyioSoft EasyClassifields 3.0 allows remote attackers to execute arbitrary SQ… | Patch early | 6.8 medium | 1% | 2008-09-15 |
| CVE-2008-4674 EXP | SQL injection vulnerability in realestate-index.php in Conkurent Real Estate Manager 1.01 allows remote attackers to execute arbitrary SQL commands vi… | Patch early | 6.8 medium | 1% | 2008-10-22 |
| CVE-2008-4700 EXP | SQL injection vulnerability in admin.php in Libera CMS 1.12 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitra… | Patch early | 6.8 medium | 1% | 2008-10-22 |
| CVE-2008-4877 EXP | SQL injection vulnerability in admin.php in WebCards 1.3, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands… | Patch early | 6.8 medium | 1% | 2008-11-01 |
| CVE-2008-5998 EXP | Multiple SQL injection vulnerabilities in the ajax_checklist_save function in the Ajax Checklist module 5.x before 5.x-1.1 for Drupal allow remote aut… | Patch early | 6.0 medium | 1% | 2009-01-28 |
| CVE-2006-5721 EXP | The \Device\SandBox driver in Outpost Firewall PRO 4.0 (964.582.059) allows local users to cause a denial of service (system crash) via an invalid arg… | Patch early | 4.9 medium | 1% | 2006-11-04 |
| CVE-2006-6446 EXP | SQL injection vulnerability in index.php in iWare Professional 5.0.4, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary… | Patch early | 6.8 medium | 1% | 2006-12-10 |
| CVE-2000-1119 EXP | Buffer overflow in setsenv command in IBM AIX 4.3.x and earlier allows local users to execute arbitrary commands via a long "x=" argument. | Patch early | 4.6 medium | 1% | 2001-01-09 |
| CVE-2007-5408 EXP | SQL injection vulnerability in category.php in cpDynaLinks 1.02 allows remote attackers to execute arbitrary SQL commands via the category parameter. | Patch early | 6.8 medium | 1% | 2007-10-12 |
| CVE-2011-0643 EXP | Cross-site request forgery (CSRF) vulnerability in admin/conf_users_edit.php in PHP Link Directory (phpLD) 4.1.0 allows remote attackers to hijack the… | Patch early | 6.8 medium | 1% | 2011-01-25 |
| CVE-2025-51396 EXP | A stored cross-site scripting (XSS) vulnerability in Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a… | Patch early | 5.4 medium | 1% | 2025-07-21 |
| CVE-2006-4789 EXP | Buffer overflow in Open Movie Editor 0.0.20060901 allows local users to cause a denial of service (system crash) or execute arbitrary code via a long… | Patch early | 4.6 medium | 1% | 2006-09-14 |
| CVE-2013-3540 EXP | Cross-site request forgery (CSRF) vulnerability in cgi-bin/admin/usrgrp.cgi in AirLive POE2600HD, POE250HD, POE200HD, OD-325HD, OD-2025HD, OD-2060HD,… | Patch early | 6.8 medium | 1% | 2013-10-04 |
| CVE-2013-0161 EXP | Havalite CMS 1.1.7 has a stored XSS vulnerability | Patch early | 5.4 medium | 1% | 2020-01-29 |
| CVE-2025-69210 EXP | FacturaScripts is open-source enterprise resource planning and accounting software. Prior to version 2025.7, a stored cross-site scripting (XSS) vulne… | Patch early | 5.4 medium | 1% | 2025-12-30 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt