CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
405,610 CVEs
1,740 on KEV
17,302 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-13
171,884 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2007-5225 EXP | Integer signedness error in FIFO filesystems (named pipes) on Sun Solaris 8 through 10 allows local users to read the contents of unspecified memory l… | Patch early | 4.9 medium | 1% | 2007-10-05 |
| CVE-2000-0976 EXP | Buffer overflow in xlib in XFree 3.3.x possibly allows local users to execute arbitrary commands via a long DISPLAY environment variable or a -display… | Patch early | 4.6 medium | 1% | 2000-12-19 |
| CVE-2000-0901 EXP | Format string vulnerability in screen 3.9.5 and earlier allows local users to gain root privileges via format characters in the vbell_msg initializati… | Patch early | 4.6 medium | 1% | 2000-12-19 |
| CVE-2006-6741 EXP | Cross-site request forgery (CSRF) vulnerability in urlobox in MKPortal allows remote attackers to delete arbitrary messages as an administrator via a… | Patch early | 5.8 medium | 1% | 2006-12-26 |
| CVE-2020-6857 EXP | CarbonFTP v1.4 uses insecure proprietary password encryption with a hard-coded weak encryption key. The key for local FTP server passwords is hard-cod… | Patch early | 5.5 medium | 1% | 2020-01-21 |
| CVE-2009-4385 EXP | Multiple cross-site request forgery (CSRF) vulnerabilities in Scriptsez.net Ez Poll Hoster (EPH) allow remote attackers to (1) hijack the authenticati… | Patch early | 6.8 medium | 1% | 2009-12-22 |
| CVE-2009-0468 EXP | Multiple cross-site request forgery (CSRF) vulnerabilities in ajax.html in Profense Web Application Firewall 2.6.2 and 2.6.3 allow remote attackers to… | Patch early | 6.8 medium | 1% | 2009-02-10 |
| CVE-2018-15437 EXP | A vulnerability in the system scanning component of Cisco Immunet and Cisco Advanced Malware Protection (AMP) for Endpoints running on Microsoft Windo… | Patch early | 5.5 medium | 1% | 2018-11-08 |
| CVE-2008-6758 EXP | Cross-site request forgery (CSRF) vulnerability in cart_save.php in ViArt Shop (aka Shopping Cart) 3.5 allows remote attackers to hijack the authentic… | Patch early | 6.8 medium | 1% | 2009-04-28 |
| CVE-2009-0705 EXP | SQL injection vulnerability in news.php in PowerScripts PowerNews 2.5.4, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitra… | Patch early | 6.8 medium | 1% | 2009-02-23 |
| CVE-2009-4059 EXP | SQL injection vulnerability in the JoomClip (com_joomclip) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the cat… | Patch early | 6.8 medium | 1% | 2009-11-24 |
| CVE-2002-0658 EXP | OSSP mm library (libmm) before 1.2.0 allows the local Apache user to gain privileges via temporary files, possibly via a symbolic link attack. | Patch early | 6.2 medium | 1% | 2002-08-12 |
| CVE-2009-1347 EXP | Multiple SQL injection vulnerabilities in stats/index.php in chCounter 3.1.3 allow remote attackers to execute arbitrary SQL commands via (1) the logi… | Patch early | 6.8 medium | 1% | 2009-04-20 |
| CVE-2009-1613 EXP | Multiple SQL injection vulnerabilities in leap.php in Leap CMS 0.1.4, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary S… | Patch early | 6.8 medium | 1% | 2009-05-11 |
| CVE-2010-5044 EXP | SQL injection vulnerability in models/log.php in the Search Log (com_searchlog) component 3.1.0 for Joomla! allows remote authenticated users, with Pu… | Patch early | 6.0 medium | 1% | 2011-11-02 |
| CVE-2014-5455 EXP | Unquoted Windows search path vulnerability in the ptservice service prior to PrivateTunnel version 3.0 (Windows) and OpenVPN Connect version 3.1 (Wind… | Patch early | 5.3 medium | 1% | 2014-08-25 |
| CVE-2012-0957 EXP | The override_release function in kernel/sys.c in the Linux kernel before 3.4.16 allows local users to obtain sensitive information from kernel stack m… | Patch early | 4.9 medium | 1% | 2012-12-21 |
| CVE-2008-3497 EXP | SQL injection vulnerability in pages.php in MyPHP CMS 0.3.1 allows remote attackers to execute arbitrary SQL commands via the pid parameter. | Patch early | 6.8 medium | 1% | 2008-08-06 |
| CVE-2007-6667 EXP | SQL injection vulnerability in faq.php in MyPHP Forum 3.0 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.… | Patch early | 6.8 medium | 1% | 2008-01-04 |
| CVE-2012-1921 EXP | Cross-site request forgery (CSRF) vulnerability in goform/admin/formWlEncrypt in Sitecom WLM-2501 allows remote attackers to hijack the authentication… | Patch early | 6.8 medium | 1% | 2012-08-26 |
| CVE-2023-25187 EXP | An issue was discovered on NOKIA Airscale ASIKA Single RAN devices before 21B. Nokia Single RAN commissioning procedures do not change (factory-time i… | Patch early | 6.3 medium | 1% | 2023-06-16 |
| CVE-2009-2388 EXP | SQL injection vulnerability in admin/index.php in Opial 1.0 allows remote attackers to execute arbitrary SQL commands via the txtPassword parameter.… | Patch early | 6.8 medium | 1% | 2009-07-09 |
| CVE-2010-0711 EXP | Cross-site request forgery (CSRF) vulnerability in default.asp in ASPCode CMS 1.5.8, 2.0.0 Build 103, and possibly other versions, allows remote attac… | Patch early | 6.8 medium | 1% | 2010-02-25 |
| CVE-2010-0707 EXP | Cross-site request forgery (CSRF) vulnerability in add_user.php in Employee Timeclock Software 0.99 allows remote attackers to hijack the authenticati… | Patch early | 6.8 medium | 1% | 2010-02-25 |
| CVE-2015-1374 EXP | Multiple cross-site request forgery (CSRF) vulnerabilities in admin.php in ferretCMS 1.0.4-alpha allow remote attackers to hijack the authentication o… | Patch early | 6.8 medium | 1% | 2015-01-27 |
| CVE-2017-7953 EXP | INFOR EAM V11.0 Build 201410 has XSS via comment fields. | Patch early | 5.4 medium | 1% | 2017-05-16 |
| CVE-2009-2164 EXP | Multiple SQL injection vulnerabilities in Kjtechforce mailman beta1, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQ… | Patch early | 6.8 medium | 1% | 2009-06-22 |
| CVE-2012-1414 EXP | Cross-site request forgery (CSRF) vulnerability in manager/news.php in Plume CMS 1.2.4 and earlier allows remote attackers to hijack the authenticatio… | Patch early | 6.8 medium | 1% | 2012-10-07 |
| CVE-2012-5326 EXP | Cross-site request forgery (CSRF) vulnerability in admin/function.php in IDevSpot iSupport 1.x allows remote attackers to hijack the authentication of… | Patch early | 6.8 medium | 1% | 2012-10-08 |
| CVE-2007-0267 EXP | The ufs_lookup function in the Mac OS X 10.4.8 and FreeBSD 6.1 kernels allows local users to cause a denial of service (kernel panic) and possibly cor… | Patch early | 6.6 medium | 1% | 2007-01-17 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt