CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
407,162 CVEs
1,740 on KEV
17,302 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-13
172,293 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2009-1317 EXP | Multiple SQL injection vulnerabilities in Aqua CMS 1.1, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands vi… | Patch early | 6.8 medium | 0.9% | 2009-04-17 |
| CVE-2009-1404 EXP | SQL injection vulnerability in admin.php in PastelCMS 0.8.0, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL comma… | Patch early | 6.8 medium | 0.9% | 2009-04-24 |
| CVE-2009-1453 EXP | SQL injection vulnerability in class.eport.php in Tiny Blogr 1.0.0 rc4, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrar… | Patch early | 6.8 medium | 0.9% | 2009-04-28 |
| CVE-2008-2919 EXP | SQL injection vulnerability in listing.php in Gryphon gllcTS2 4.2.4 allows remote attackers to execute arbitrary SQL commands via the sort parameter. | Patch early | 6.8 medium | 0.9% | 2008-06-30 |
| CVE-2009-3661 EXP | Multiple SQL injection vulnerabilities in the DJ-Catalog (com_djcatalog) component for Joomla! allow remote attackers to execute arbitrary SQL command… | Patch early | 6.8 medium | 0.9% | 2009-10-11 |
| CVE-2007-4085 EXP | Multiple SQL injection vulnerabilities in AlstraSoft AskMe Pro allow remote attackers to execute arbitrary SQL commands via the (1) que_id parameter t… | Patch early | 6.8 medium | 0.9% | 2007-07-30 |
| CVE-2001-0526 EXP | Buffer overflow in the Xview library as used by mailtool in Solaris 8 and earlier allows a local attacker to gain privileges via the OPENWINHOME envir… | Patch early | 4.6 medium | 0.9% | 2001-08-14 |
| CVE-2006-3693 EXP | Rocks Clusters 4.1 and earlier allows local users to gain privileges via commands enclosed with escaped backticks (\`) in an argument to the (1) mount… | Patch early | 4.6 medium | 0.9% | 2006-07-21 |
| CVE-2024-57708 EXP | An issue in OneTrust SDK v.6.33.0 allows a local attacker to cause a denial of service via the Object.setPrototypeOf, __proto__, and Object.assign com… | Patch early | 5.7 medium | 0.9% | 2025-06-25 |
| CVE-2006-7051 EXP | The sys_timer_create function in posix-timers.c for Linux kernel 2.6.x allows local users to cause a denial of service (memory consumption) and possib… | Patch early | 4.9 medium | 0.9% | 2007-02-24 |
| CVE-2008-3582 EXP | SQL injection vulnerability in login.php in Keld PHP-MySQL News Script 0.7.1 allows remote attackers to execute arbitrary SQL commands via the usernam… | Patch early | 6.8 medium | 0.9% | 2008-08-10 |
| CVE-2009-0883 EXP | SQL injection vulnerability in Blue Eye CMS 1.0.0 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL com… | Patch early | 6.8 medium | 0.9% | 2009-03-12 |
| CVE-2009-1259 EXP | SQL injection vulnerability in inc/bb/topic.php in Insane Visions AdaptBB 1.0, when magic_quotes_gpc is disabled, allows remote attackers to execute a… | Patch early | 6.8 medium | 0.9% | 2009-04-07 |
| CVE-2009-1500 EXP | SQL injection vulnerability in index.php in ProjectCMS 1.0 Beta allows remote attackers to execute arbitrary SQL commands via the sn parameter. | Patch early | 6.8 medium | 0.9% | 2009-05-01 |
| CVE-2009-1799 EXP | Multiple SQL injection vulnerabilities in the getGalleryImage function in st_admin/gallery_output.php in ST-Gallery 0.1 alpha, when magic_quotes_gpc i… | Patch early | 6.8 medium | 0.9% | 2009-05-28 |
| CVE-2024-39143 EXP | A stored cross-site scripting (XSS) vulnerability exists in ResidenceCMS 2.10.1 that allows a low-privilege user to create malicious property content… | Patch early | 5.4 medium | 0.9% | 2024-07-02 |
| CVE-2025-51398 EXP | A stored cross-site scripting (XSS) vulnerability in the Facebook registration page of Live Helper Chat v4.60 allows attackers to execute arbitrary we… | Patch early | 5.4 medium | 0.9% | 2025-07-21 |
| CVE-2025-51400 EXP | A stored cross-site scripting (XSS) vulnerability in the Personal Canned Messages of Live Helper Chat v4.60 allows attackers to execute arbitrary web… | Patch early | 5.4 medium | 0.9% | 2025-07-21 |
| CVE-2025-51401 EXP | A stored cross-site scripting (XSS) vulnerability in the chat transfer function of Live Helper Chat v4.60 allows attackers to execute arbitrary web sc… | Patch early | 5.4 medium | 0.9% | 2025-07-21 |
| CVE-2015-7110 EXP | The Disk Images component in Apple OS X before 10.11.2 and tvOS before 9.1 allows local users to gain privileges or cause a denial of service (memory… | Patch early | 6.9 medium | 0.9% | 2015-12-11 |
| CVE-2008-6789 EXP | SQL injection vulnerability in MindDezign Photo Gallery 2.2 allows remote attackers to execute arbitrary SQL commands via the username parameter in a… | Patch early | 5.1 medium | 0.9% | 2009-05-04 |
| CVE-2013-3963 EXP | Cross-site request forgery (CSRF) vulnerability in goform/usermanage in Grandstream GXV3501, GXV3504, GXV3601, GXV3601HD/LL, GXV3611HD/LL, GXV3615W/P,… | Patch early | 6.8 medium | 0.9% | 2013-10-01 |
| CVE-2003-1473 EXP | Buffer overflow in LTris 1.0.1 of FreeBSD Ports Collection 2003-02-25 and earlier allows local users to execute arbitrary code with gid "games" permis… | Patch early | 4.6 medium | 0.9% | 2003-12-31 |
| CVE-2009-4365 EXP | Multiple cross-site request forgery (CSRF) vulnerabilities in admin.php in ScriptsEz Ez Blog 1.0 allow remote attackers to hijack the authentication o… | Patch early | 4.3 medium | 0.9% | 2009-12-21 |
| CVE-2008-1871 EXP | SQL injection vulnerability in links.php in Scriptsagent.com Links Directory 1.1 allows remote authenticated users to execute arbitrary SQL commands v… | Patch early | 6.5 medium | 0.9% | 2008-04-17 |
| CVE-2011-1020 EXP | The proc filesystem implementation in the Linux kernel 2.6.37 and earlier does not restrict access to the /proc directory tree of a process after this… | Patch early | 4.6 medium | 0.9% | 2011-02-28 |
| CVE-2005-1590 EXP | The Altiris Client Service for Windows (ACLIENT.EXE) 6.0.88 allows local users to disable password protection and access the administrative interface… | Patch early | 4.6 medium | 0.9% | 2005-05-16 |
| CVE-2014-5395 EXP | Multiple cross-site request forgery (CSRF) vulnerabilities in Huawei HiLink E3276 and E3236 TCPU before V200R002B470D13SP00C00 and WebUI before V100R0… | Patch early | 6.8 medium | 0.9% | 2014-11-21 |
| CVE-2011-5135 EXP | Multiple SQL injection vulnerabilities in the save_connection function in lib/lib.iotask.php in the iotask module in DoceboLMS 4.0.4 and earlier allow… | Patch early | 6.0 medium | 0.9% | 2012-08-30 |
| CVE-2011-2918 EXP | The Performance Events subsystem in the Linux kernel before 3.1 does not properly handle event overflows associated with PERF_COUNT_SW_CPU_CLOCK event… | Patch early | 5.5 medium | 0.9% | 2012-05-24 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt