CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
408,363 CVEs
1,745 on KEV
17,306 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-15
152,697 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2014-2560 EXP | The PhonerLite phone before 2.15 provides hashed credentials in a response to an invalid authentication challenge, which makes it easier for remote at… | Patch early | 7.5 high | 1.7% | 2020-02-12 |
| CVE-2008-2862 EXP | Multiple SQL injection vulnerabilities in eLineStudio Site Composer (ESC) 2.6 and earlier allow remote attackers to execute arbitrary SQL commands via… | Patch early | 7.5 high | 1.7% | 2008-06-25 |
| CVE-2008-2917 EXP | SQL injection vulnerability in productsofcat.asp in E-SMART CART allows remote attackers to execute arbitrary SQL commands via the category_id paramet… | Patch early | 7.5 high | 1.7% | 2008-06-30 |
| CVE-2008-6180 EXP | SQL injection vulnerability in system/nlb_user.class.php in NewLife Blogger 3.0 and earlier, and possibly 3.3.1, allows remote attackers to execute ar… | Patch early | 7.5 high | 1.7% | 2009-02-19 |
| CVE-2008-0301 EXP | Multiple SQL injection vulnerabilities in Mapbender 2.4.4 allow remote attackers to execute arbitrary SQL commands via the gaz parameter to mod_gazett… | Patch early | 7.5 high | 1.7% | 2008-03-11 |
| CVE-2008-0428 EXP | Multiple SQL injection vulnerabilities in the login function in system/class_permissions.php in bloofoxCMS 0.3 allow remote attackers to execute arbit… | Patch early | 7.5 high | 1.7% | 2008-01-23 |
| CVE-2017-6970 EXP | AlienVault USM and OSSIM before 5.3.7 and NfSen before 1.3.8 allow local users to execute arbitrary commands in a privileged context via an NfSen sock… | Patch early | 8.4 high | 1.7% | 2017-03-22 |
| CVE-2003-0735 EXP | SQL injection vulnerability in the Calendar module of phpWebSite 0.9.x and earlier allows remote attackers to execute arbitrary SQL queries, as demons… | Patch early | 7.5 high | 1.7% | 2003-10-20 |
| CVE-2018-12897 EXP | SolarWinds DameWare Mini Remote Control before 12.1 has a Buffer Overflow. | Patch early | 7.8 high | 1.7% | 2018-09-07 |
| CVE-1999-0306 EXP | buffer overflow in HP xlock program. | Patch early | 7.2 high | 1.7% | 1997-11-04 |
| CVE-2015-2142 EXP | Multiple cross-site request forgery (CSRF) vulnerabilities in Issuetracker phpBugTracker before 1.7.0 allow remote authenticated users to (1) hijack t… | Patch early | 8.0 high | 1.7% | 2017-10-06 |
| CVE-2000-0993 EXP | Format string vulnerability in pw_error function in BSD libutil library allows local users to gain root privileges via a malformed password in command… | Patch early | 7.2 high | 1.7% | 2000-12-19 |
| CVE-2004-1846 EXP | Multiple SQL injection vulnerabilities in News Manager Lite 2.5 allow remote attackers to execute arbitrary SQL code via the (1) ID parameter to more.… | Patch early | 7.5 high | 1.7% | 2004-03-20 |
| CVE-2006-0823 EXP | Multiple SQL injection vulnerabilities in Geeklog 1.4.0 before 1.4.0sr1 and 1.3.11 before 1.3.11sr4 allow remote attackers to inject arbitrary SQL com… | Patch early | 7.5 high | 1.7% | 2006-02-21 |
| CVE-2012-2332 EXP | SQL injection vulnerability in serendipity/serendipity_admin.php in Serendipity before 1.6.1 allows remote attackers to execute arbitrary SQL commands… | Patch early | 7.5 high | 1.7% | 2012-08-13 |
| CVE-2019-14737 EXP | Ubisoft Uplay 92.0.0.6280 has Insecure Permissions. | Patch early | 7.8 high | 1.7% | 2019-10-14 |
| CVE-2024-47773 EXP | Discourse is an open source platform for community discussion. An attacker can make several XHR requests until the cache is poisoned with a response w… | Patch early | 8.2 high | 1.7% | 2024-10-08 |
| CVE-2011-4710 EXP | Multiple SQL injection vulnerabilities in Pixie CMS 1.01 through 1.04 allow remote attackers to execute arbitrary SQL commands via the (1) pixie_user… | Patch early | 7.5 high | 1.7% | 2011-12-08 |
| CVE-2007-1021 EXP | SQL injection vulnerability in inc_listnews.asp in CodeAvalanche News 1.x allows remote attackers to execute arbitrary SQL commands via the CAT_ID par… | Patch early | 10.0 high | 1.7% | 2007-02-21 |
| CVE-2018-2698 EXP | Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are Prior to 5… | Patch early | 8.8 high | 1.7% | 2018-01-18 |
| CVE-2002-1364 EXP | Buffer overflow in the get_origin function in traceroute-nanog allows attackers to execute arbitrary code via long WHOIS responses. | Patch early | 7.2 high | 1.7% | 2002-12-23 |
| CVE-2016-8807 EXP | For the NVIDIA Quadro, NVS, and GeForce products, NVIDIA Windows GPU Display Driver R340 before 342.00 and R375 before 375.63 contains a vulnerability… | Patch early | 7.8 high | 1.7% | 2016-11-08 |
| CVE-2005-4318 EXP | SQL injection vulnerability in index.php in Limbo CMS 1.0.4.2 and earlier, with register_globals off, allows remote attackers to execute arbitrary SQL… | Patch early | 7.5 high | 1.7% | 2005-12-17 |
| CVE-2007-5222 EXP | SQL injection vulnerability in index.php in MAXdev MDPro (MD-Pro) 1.0.76 allows remote attackers to execute arbitrary SQL commands via a "Firefox ID="… | Patch early | 7.5 high | 1.7% | 2007-10-05 |
| CVE-2005-1378 EXP | SQL injection vulnerability in posting_notes.php in the notes module for phpBB allows remote attackers to execute arbitrary SQL commands via the p par… | Patch early | 7.5 high | 1.7% | 2005-05-03 |
| CVE-2018-9233 EXP | Sophos Endpoint Protection 10.7 uses an unsalted SHA-1 hash for password storage in %PROGRAMDATA%\Sophos\Sophos Anti-Virus\Config\machine.xml, which m… | Patch early | 7.8 high | 1.7% | 2018-04-05 |
| CVE-2017-1000432 EXP | Vanilla Forums below 2.1.5 are affected by CSRF leading to Deleting topics and comments from forums Admin access | Patch early | 8.0 high | 1.6% | 2018-01-02 |
| CVE-2008-3784 EXP | SQL injection vulnerability in scrape.php in BtiTracker 1.4.7 and earlier and xBtiTracker 2.0.542 and earlier allows remote attackers to execute arbit… | Patch early | 7.5 high | 1.6% | 2008-08-26 |
| CVE-2007-3427 EXP | SQL injection vulnerability in index.php in phpTrafficA 1.4.2 and earlier allows remote attackers to execute arbitrary SQL commands via the pageid par… | Patch early | 7.5 high | 1.6% | 2007-06-27 |
| CVE-2017-10129 EXP | Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). The supported version that is affected is Prior to… | Patch early | 8.8 high | 1.6% | 2017-08-08 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt