CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
408,806 CVEs
1,746 on KEV
17,309 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-16
210,326 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2008-5204 EXP | Multiple directory traversal vulnerabilities in PowerAward 1.1.0 RC1, when register_globals is enabled, allow remote attackers to include and execute… | Patch early | 6.8 medium | 1.8% | 2008-11-21 |
| CVE-2008-5990 EXP | Directory traversal vulnerability in connect/init.inc in emergecolab 1.0 allows remote attackers to include and execute arbitrary local files via a ..… | Patch early | 6.8 medium | 1.8% | 2009-01-28 |
| CVE-2008-6361 EXP | Directory traversal vulnerability in index.php in InSun Feed CMS 1.7.3 19Beta allows remote attackers to include and execute arbitrary local files via… | Patch early | 6.8 medium | 1.8% | 2009-03-02 |
| CVE-2009-4458 EXP | Multiple cross-site scripting (XSS) vulnerabilities in FreePBX 2.5.2 and 2.6.0rc2, and possibly other versions, allow remote attackers to inject arbit… | Patch early | 4.3 medium | 1.8% | 2009-12-30 |
| CVE-2009-4547 EXP | Multiple cross-site scripting (XSS) vulnerabilities in ViArt CMS 3.x allow remote attackers to inject arbitrary web script or HTML via the (1) categor… | Patch early | 4.3 medium | 1.8% | 2010-01-04 |
| CVE-2006-1925 EXP | Directory traversal vulnerability in the editnews module (inc/editnews.mdu) in index.php in CuteNews 1.4.1 allows remote attackers to read or modify f… | Patch early | 4.3 medium | 1.8% | 2006-04-20 |
| CVE-2018-10321 EXP | Frog CMS 0.9.5 has a stored Cross Site Scripting Vulnerability via "Admin Site title" in Settings. | Patch early | 4.8 medium | 1.8% | 2018-04-24 |
| CVE-2005-1803 EXP | Multiple cross-site scripting (XSS) vulnerabilities in Net Portal Dynamic System (NPDS) 5.0 allow remote attackers to inject arbitrary web script or H… | Patch early | 4.3 medium | 1.8% | 2005-05-29 |
| CVE-2006-3052 EXP | Cross-site scripting (XSS) vulnerability in Event Registration allows remote attackers to inject arbitrary web script or HTML via the (1) event_id par… | Patch early | 6.8 medium | 1.8% | 2006-06-16 |
| CVE-2008-1068 EXP | Multiple PHP remote file inclusion vulnerabilities in Portail Web Php 2.5.1.1 and earlier allow remote attackers to execute arbitrary PHP code via a U… | Patch early | 6.8 medium | 1.8% | 2008-02-28 |
| CVE-2008-1123 EXP | Multiple PHP remote file inclusion vulnerabilities in SiteBuilder Elite 1.2 allow remote attackers to execute arbitrary PHP code via a URL in the Carp… | Patch early | 6.8 medium | 1.8% | 2008-03-03 |
| CVE-2006-6087 EXP | Cross-site scripting (XSS) vulnerability in weblog.php in my little weblog allows remote attackers to inject arbitrary web script or HTML via the acti… | Patch early | 4.3 medium | 1.8% | 2006-11-24 |
| CVE-2006-6746 EXP | Multiple cross-site scripting (XSS) vulnerabilities in Xt-News 0.1 allow remote attackers to inject arbitrary web script or HTML via the id_news param… | Patch early | 4.3 medium | 1.8% | 2006-12-27 |
| CVE-2006-1825 EXP | Cross-site scripting (XSS) vulnerability in index.php in phpLinks 2.1.3.1 and earlier allows remote attackers to inject arbitrary web script or HTML v… | Patch early | 6.8 medium | 1.8% | 2006-04-18 |
| CVE-2004-0032 EXP | Cross-site scripting (XSS) vulnerability in search.php in PHPGEDVIEW 2.61 allows remote attackers to inject arbitrary HTML and web script via the firs… | Patch early | 6.8 medium | 1.8% | 2004-01-20 |
| CVE-2007-0836 EXP | admin.php in Coppermine Photo Gallery 1.4.10, and possibly earlier, allows remote authenticated users to include arbitrary local and possibly remote f… | Patch early | 4.0 medium | 1.8% | 2007-02-08 |
| CVE-2003-1481 EXP | CommuniGate Pro 3.1 through 4.0.6 sends the session ID in the referer field for an HTTP request for an image, which allows remote attackers to hijack… | Patch early | 5.8 medium | 1.8% | 2003-12-31 |
| CVE-2012-1023 EXP | Open redirect vulnerability in admin/index.php in 4images 1.7.10 allows remote attackers to redirect users to arbitrary web sites and conduct phishing… | Patch early | 5.8 medium | 1.8% | 2012-02-08 |
| CVE-2007-2901 EXP | Multiple cross-site scripting (XSS) vulnerabilities in Dokeos 1.8.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the… | Patch early | 4.3 medium | 1.8% | 2007-05-30 |
| CVE-2007-3324 EXP | Multiple cross-site scripting (XSS) vulnerabilities in Comersus Cart 7.07 allow remote attackers to inject arbitrary web script or HTML via the redire… | Patch early | 4.3 medium | 1.8% | 2007-06-21 |
| CVE-2009-3860 EXP | Multiple insecure method vulnerabilities in Idefense Labs COMRaider allow remote attackers to create or overwrite arbitrary files via the (1) CreateFo… | Patch early | 5.8 medium | 1.8% | 2009-11-04 |
| CVE-2008-2787 EXP | Cross-site scripting (XSS) vulnerability in out.php in OpenDocMan 1.2.5 allows remote attackers to inject arbitrary web script or HTML via the last_me… | Patch early | 4.3 medium | 1.8% | 2008-06-20 |
| CVE-2005-4161 EXP | Multiple cross-site scripting (XSS) vulnerabilities in MilliScripts 1.4 redirect script allow remote attackers to inject arbitrary web script or HTML… | Patch early | 4.3 medium | 1.8% | 2005-12-11 |
| CVE-2015-7562 EXP | Multiple cross-site scripting (XSS) vulnerabilities in TeamPass 2.1.24 and earlier allow remote attackers to inject arbitrary web script or HTML via t… | Patch early | 6.1 medium | 1.8% | 2017-04-12 |
| CVE-2010-0756 EXP | Session fixation vulnerability in WikyBlog 1.7.3 rc2 allows remote attackers to hijack web sessions by setting the jsessionid parameter to (1) index.p… | Patch early | 5.8 medium | 1.8% | 2010-02-27 |
| CVE-2006-2051 EXP | Multiple cross-site scripting (XSS) vulnerabilities in myadmin/index.php in NextAge Shopping Cart allow remote attackers to inject arbitrary web scrip… | Patch early | 5.8 medium | 1.8% | 2006-04-26 |
| CVE-2014-5193 EXP | Cross-site scripting (XSS) vulnerability in admin/admin.php in Sphider 1.3.6 allows remote attackers to inject arbitrary web script or HTML via the ca… | Patch early | 4.3 medium | 1.8% | 2014-08-07 |
| CVE-2009-1907 EXP | Cross-site scripting (XSS) vulnerability in claroline/linker/notfound.php in Claroline 1.8.11 allows remote attackers to inject arbitrary web script o… | Patch early | 4.3 medium | 1.8% | 2009-06-04 |
| CVE-2022-48177 EXP | X2CRM Open Source Sales CRM 6.6 and 6.9 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the adin/importModels Impor… | Patch early | 5.4 medium | 1.8% | 2023-04-15 |
| CVE-2022-48178 EXP | X2CRM Open Source Sales CRM 6.6 and 6.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Create Action function, ak… | Patch early | 5.4 medium | 1.8% | 2023-04-15 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt