CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
407,162 CVEs
1,740 on KEV
17,302 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-13
172,293 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2001-0906 EXP | teTeX filter before 1.0.7 allows local users to gain privileges via a symlink attack on temporary files that are produced when printing .dvi files usi… | Patch early | 6.2 medium | 0.9% | 2001-06-22 |
| CVE-2014-2534 EXP | /sbin/pppoectl in BlackBerry QNX Neutrino RTOS 6.4.x and 6.5.x allows local users to obtain sensitive information by reading "bad parameter" lines in… | Patch early | 4.9 medium | 0.9% | 2014-03-18 |
| CVE-2009-0831 EXP | SQL injection vulnerability in members.php in the Members CV (job) module 1.0 for PHP-Fusion, when magic_quotes_gpc is disabled, allows remote authent… | Patch early | 6.0 medium | 0.9% | 2009-03-05 |
| CVE-2009-4826 EXP | Cross-site request forgery (CSRF) vulnerability in hosting/admin_ac.php in ScriptsEz Mini Hosting Panel allows remote attackers to hijack the authenti… | Patch early | 6.8 medium | 0.9% | 2010-04-27 |
| CVE-2009-4827 EXP | Cross-site request forgery (CSRF) vulnerability in admin.php in Mail Manager Pro allows remote attackers to hijack the authentication of administrator… | Patch early | 6.8 medium | 0.9% | 2010-04-27 |
| CVE-2009-4828 EXP | Cross-site request forgery (CSRF) vulnerability in administration/admins.php in Ad Manager Pro (aka AdManagerPro) 3.0 allows remote attackers to hijac… | Patch early | 6.8 medium | 0.9% | 2010-04-27 |
| CVE-2009-4849 EXP | Multiple cross-site request forgery (CSRF) vulnerabilities in ToutVirtual VirtualIQ Pro 3.2 build 7882 and 3.5 build 8691 allow remote attackers to hi… | Patch early | 6.8 medium | 0.9% | 2010-05-07 |
| CVE-2009-4905 EXP | Multiple cross-site request forgery (CSRF) vulnerabilities in index.php in Acc Statistics 1.1 allow remote attackers to hijack the authentication of a… | Patch early | 6.8 medium | 0.9% | 2010-06-25 |
| CVE-2025-10042 EXP | The Quiz Maker plugin for WordPress is vulnerable to SQL Injection via spoofed IP headers in all versions up to, and including, 6.7.0.56 due to insuff… | Patch early | 5.9 medium | 0.9% | 2025-09-17 |
| CVE-2010-0952 EXP | SQL injection vulnerability in index.php in OneCMS 2.5, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands v… | Patch early | 6.8 medium | 0.9% | 2010-03-10 |
| CVE-2008-6226 EXP | SQL injection vulnerability in moreinfo.php in Pre Projects PHP Auto Listings Script, when magic_quotes_gpc is disabled, allows remote attackers to ex… | Patch early | 6.8 medium | 0.9% | 2009-02-20 |
| CVE-2008-2484 EXP | SQL injection vulnerability in index.php in Xomol CMS 1.20071213, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL… | Patch early | 6.8 medium | 0.9% | 2008-05-28 |
| CVE-2008-3345 EXP | SQL injection vulnerability in staticpages/easyecards/index.php in MyioSoft EasyE-Cards 3.5 trial edition (tr) and 3.10a, when magic_quotes_gpc is dis… | Patch early | 6.8 medium | 0.9% | 2008-07-28 |
| CVE-2008-3783 EXP | Multiple SQL injection vulnerabilities in index.php in Matterdaddy Market 1.1, when magic_quotes_gpc is disabled, allow remote attackers to execute ar… | Patch early | 6.8 medium | 0.9% | 2008-08-26 |
| CVE-2010-1109 EXP | Multiple SQL injection vulnerabilities in index.php in phpMySport 1.4, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary… | Patch early | 6.8 medium | 0.9% | 2010-03-25 |
| CVE-2009-3321 EXP | SQL injection vulnerability in SaphpLesson 4.3, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the C… | Patch early | 6.8 medium | 0.9% | 2009-09-23 |
| CVE-2008-7058 EXP | Cross-site request forgery (CSRF) vulnerability in BandSite CMS 1.1.4 allows remote attackers to hijack the authentication of administrators and force… | Patch early | 6.8 medium | 0.9% | 2009-08-24 |
| CVE-2007-0687 EXP | SQL injection vulnerability in i-search.php in Michelle's L2J Dropcalc 4 and earlier allows remote authenticated users to execute arbitrary SQL comman… | Patch early | 6.5 medium | 0.9% | 2007-02-03 |
| CVE-2006-6911 EXP | SQL injection vulnerability in search.asp in Digitizing Quote And Ordering System 1.0 allows remote authenticated users to execute arbitrary SQL comma… | Patch early | 6.0 medium | 0.9% | 2006-12-31 |
| CVE-2008-0129 EXP | SQL injection vulnerability in starnet/addons/slideshow_full.php in Site@School 2.3.10 and earlier allows remote attackers to execute arbitrary SQL co… | Patch early | 6.8 medium | 0.9% | 2008-01-08 |
| CVE-2009-3494 EXP | Multiple SQL injection vulnerabilities in index.php in T-HTB Manager 0.5, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitra… | Patch early | 6.8 medium | 0.9% | 2009-09-30 |
| CVE-2008-0678 EXP | SQL injection vulnerability in index.php in BlogPHP 2.0 allows remote attackers to execute arbitrary SQL commands via the id parameter in a page actio… | Patch early | 6.8 medium | 0.9% | 2008-02-12 |
| CVE-2008-1295 EXP | SQL injection vulnerability in archives.php in Gregory Kokanosky (aka Greg's Place) phpMyNewsletter 0.8 beta 5 and earlier allows remote attackers to… | Patch early | 6.8 medium | 0.9% | 2008-03-12 |
| CVE-2008-4145 EXP | SQL injection vulnerability in user_read_links.php in Addalink 1.0 beta 4 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to e… | Patch early | 6.8 medium | 0.9% | 2008-09-24 |
| CVE-2014-3854 EXP | Cross-site request forgery (CSRF) vulnerability in admin/addScript.py in Pyplate 0.08 allows remote attackers to hijack the authentication of administ… | Patch early | 6.8 medium | 0.9% | 2014-08-07 |
| CVE-2009-2847 EXP | The do_sigaltstack function in kernel/signal.c in Linux kernel 2.4 through 2.4.37 and 2.6 before 2.6.31-rc5, when running on 64-bit systems, does not… | Patch early | 4.9 medium | 0.9% | 2009-08-18 |
| CVE-2008-4156 EXP | SQL injection vulnerability in print.php in CustomCms (CCMS) Gaming Portal 4.0, when magic_quotes_gpc is disabled, allows remote attackers to execute… | Patch early | 6.8 medium | 0.9% | 2008-09-19 |
| CVE-2008-4760 EXP | SQL injection vulnerability in lecture.php in Graphiks MyForum 1.3, when register_globals is enabled, allows remote attackers to execute arbitrary SQL… | Patch early | 6.8 medium | 0.9% | 2008-10-28 |
| CVE-2008-6605 EXP | Cross-site request forgery (CSRF) vulnerability in the xslt script in the web-based management interface on the 2wire 1701HG, 1800HW, 2071HG, and 2700… | Patch early | 6.8 medium | 0.9% | 2009-04-06 |
| CVE-2009-0295 EXP | SQL injection vulnerability in index.php in Information Technology Light Poll Information (ITLPoll) 2.7 Stable 2, when magic_quotes_gpc is disabled, a… | Patch early | 6.8 medium | 0.9% | 2009-01-27 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt