CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
408,465 CVEs
1,745 on KEV
17,306 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-15
152,735 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2007-6172 EXP | Multiple SQL injection vulnerabilities in wpQuiz 2.7 allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) viewimage.ph… | Patch early | 10.0 high | 1.6% | 2007-11-30 |
| CVE-2010-4865 EXP | SQL injection vulnerability in the JE Guestbook (com_jeguestbook) component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands… | Patch early | 7.5 high | 1.6% | 2011-10-05 |
| CVE-2010-2909 EXP | SQL injection vulnerability in ttvideo.php in the TTVideo (com_ttvideo) component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL com… | Patch early | 7.5 high | 1.6% | 2010-07-28 |
| CVE-2025-57642 EXP | A Shell Upload vulnerability in Tourism Management System 2.0 allows an attacker to upload and execute arbitrary PHP shell scripts on the server, lead… | Patch early | 7.2 high | 1.6% | 2025-09-10 |
| CVE-2007-1034 EXP | SQL injection vulnerability in the category file in modules.php in the Emporium 2.3.0 and earlier module for PHP-Nuke allows remote attackers to execu… | Patch early | 7.5 high | 1.6% | 2007-02-21 |
| CVE-2003-0127 EXP | The kernel module loader in Linux kernel 2.2.x before 2.2.25, and 2.4.x before 2.4.21, allows local users to gain root privileges by using ptrace to a… | Patch early | 7.2 high | 1.6% | 2003-03-31 |
| CVE-2018-13108 EXP | All ADB broadband gateways / routers based on the Epicentro platform are affected by a local root jailbreak vulnerability where attackers are able to… | Patch early | 7.8 high | 1.6% | 2018-07-06 |
| CVE-2023-6538 EXP | SMU versions prior to 14.8.7825.01 are susceptible to unintended information disclosure, through URL manipulation. Authenticated users in Storage, Ser… | Patch early | 7.6 high | 1.6% | 2023-12-11 |
| CVE-2001-0956 EXP | speechd 0.54 and earlier, with the Festival or rsynth speech synthesis package, allows attackers to execute arbitrary commands via shell metacharacter… | Patch early | 7.2 high | 1.6% | 2001-09-11 |
| CVE-2006-4392 EXP | The Mach kernel, as used in operating systems including (1) Mac OS X 10.4 through 10.4.7 and (2) OpenStep before 4.2, allows local users to gain privi… | Patch early | 7.2 high | 1.6% | 2006-10-03 |
| CVE-2017-0313 EXP | All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) implementation of the SubmitCommandV… | Patch early | 7.8 high | 1.6% | 2017-02-15 |
| CVE-2008-3768 EXP | Multiple SQL injection vulnerabilities in class.ajax.php in Turnkey Web Tools SunShop Shopping Cart before 4.1.5 allow remote attackers to execute arb… | Patch early | 7.5 high | 1.6% | 2008-08-22 |
| CVE-2018-18858 EXP | Multiple local privilege escalation vulnerabilities have been identified in the LiquidVPN client through 1.37 for macOS. An attacker can communicate w… | Patch early | 7.8 high | 1.6% | 2018-11-20 |
| CVE-2018-18859 EXP | Multiple local privilege escalation vulnerabilities have been identified in the LiquidVPN client through 1.37 for macOS. An attacker can communicate w… | Patch early | 7.8 high | 1.6% | 2018-11-20 |
| CVE-2017-7228 EXP | An issue (known as XSA-212) was discovered in Xen, with fixes available for 4.8.x, 4.7.x, 4.6.x, 4.5.x, and 4.4.x. The earlier XSA-29 fix introduced a… | Patch early | 8.2 high | 1.6% | 2017-04-04 |
| CVE-2014-5288 EXP | A CSRF Vulnerability exists in Kemp Load Master before 7.0-18a via unspecified vectors in administrative pages. | Patch early | 8.8 high | 1.6% | 2020-02-07 |
| CVE-2016-9793 EXP | The sock_setsockopt function in net/core/sock.c in the Linux kernel before 4.8.14 mishandles negative values of sk_sndbuf and sk_rcvbuf, which allows… | Patch early | 7.8 high | 1.6% | 2016-12-28 |
| CVE-2018-15657 EXP | An SSRF issue was discovered in 42Gears SureMDM before 2018-11-27 via the /api/DownloadUrlResponse.ashx "url" parameter. | Patch early | 7.3 high | 1.6% | 2019-02-05 |
| CVE-2018-0492 EXP | Johnathan Nightingale beep through 1.3.4, if setuid, has a race condition that allows local privilege escalation. | Patch early | 7.0 high | 1.6% | 2018-04-03 |
| CVE-2015-2866 EXP | SQL injection vulnerability on the Grandstream GXV3611_HD camera with firmware before 1.0.3.9 beta allows remote attackers to execute arbitrary SQL co… | Patch early | 7.5 high | 1.6% | 2015-07-08 |
| CVE-2017-15595 EXP | An issue was discovered in Xen through 4.9.x allowing x86 PV guest OS users to cause a denial of service (unbounded recursion, stack consumption, and… | Patch early | 8.8 high | 1.6% | 2017-10-18 |
| CVE-2016-7391 EXP | For the NVIDIA Quadro, NVS, and GeForce products, NVIDIA Windows GPU Display Driver R340 before 342.00 and R375 before 375.63 contains a vulnerability… | Patch early | 7.8 high | 1.6% | 2016-11-08 |
| CVE-2001-0979 EXP | Buffer overflow in swverify in HP-UX 11.0, and possibly other programs, allows local users to gain privileges via a long command line argument. | Patch early | 7.2 high | 1.6% | 2001-09-03 |
| CVE-2002-0572 EXP | FreeBSD 4.5 and earlier, and possibly other BSD-based operating systems, allows local users to write to or read from restricted files by closing the f… | Patch early | 7.2 high | 1.6% | 2002-07-03 |
| CVE-2025-32370 EXP | Kentico Xperience before 13.0.178 has a specific set of allowed ContentUploader file extensions for unauthenticated uploads; however, because .zip is… | Patch early | 7.2 high | 1.6% | 2025-04-06 |
| CVE-2014-8507 EXP | Multiple SQL injection vulnerabilities in the queryLastApp method in packages/WAPPushManager/src/com/android/smspush/WapPushManager.java in the WAPPus… | Patch early | 7.5 high | 1.6% | 2014-12-15 |
| CVE-2018-5282 EXP | Kentico 9.0 through 11.0 has a stack-based buffer overflow via the SqlName, SqlPswd, Database, UserName, or Password field in a SilentInstall XML docu… | Patch early | 7.8 high | 1.5% | 2018-01-08 |
| CVE-2008-0735 EXP | SQL injection vulnerability in mod/gallery/ajax/gallery_data.php in AuraCMS 2.2 allows remote attackers to execute arbitrary SQL commands via the albu… | Patch early | 10.0 high | 1.5% | 2008-02-13 |
| CVE-2020-8424 EXP | Cups Easy (Purchase & Inventory) 1.0 is vulnerable to CSRF that leads to admin account takeover via passwordmychange.php. | Patch early | 8.8 high | 1.5% | 2020-01-28 |
| CVE-2018-10711 EXP | The AsrDrv101.sys and AsrDrv102.sys low-level drivers in ASRock RGBLED before v1.0.35.1, A-Tuning before v3.0.210, F-Stream before v3.0.210, and Resta… | Patch early | 7.8 high | 1.5% | 2018-10-30 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt