CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
407,432 CVEs
1,741 on KEV
17,302 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-14
324,716 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2010-2313 EXP | Directory traversal vulnerability in index.php in Anodyne Productions SIMM Management System (SMS) 2.6.10, when magic_quotes_gpc is disabled, allows r… | Patch early | 6.8 medium | 5.1% | 2010-06-17 |
| CVE-2001-0649 EXP | Personal Web Sharing 1.5.5 allows a remote attacker to cause a denial of service via a long HTTP request. | Patch early | 5.0 medium | 5.1% | 2001-09-20 |
| CVE-2009-2386 EXP | Insecure method vulnerability in Awingsoft Awakening Winds3D Viewer plugin 3.5.0.0, 3.0.0.5, and possibly other versions allows remote attackers to fo… | Patch early | 9.3 high | 5.1% | 2009-07-10 |
| CVE-2006-5763 EXP | Multiple PHP remote file inclusion vulnerabilities in Free File Hosting 1.1, and possibly earlier, when register_globals is enabled, allow remote atta… | Patch early | 5.1 medium | 5.1% | 2006-11-06 |
| CVE-2008-3178 EXP | Unrestricted file upload vulnerability in upload_pictures.php in WebXell Editor 0.1.3 allows remote attackers to execute arbitrary code by uploading a… | Patch early | 7.5 high | 5.1% | 2008-07-15 |
| CVE-2008-6920 EXP | Unrestricted file upload vulnerability in auth.php in phpEmployment 1.8 allows remote attackers to execute arbitrary code by uploading a file with an… | Patch early | 7.5 high | 5.1% | 2009-08-10 |
| CVE-2008-6921 EXP | Unrestricted file upload vulnerability in index.php in phpAdBoard 1.8 allows remote attackers to execute arbitrary code by uploading a file with an ex… | Patch early | 7.5 high | 5.1% | 2009-08-10 |
| CVE-2006-7194 EXP | PHP remote file inclusion vulnerability in modules/Mysqlfinder/MysqlfinderAdmin.php in Agora 1.4 RC1, when register_globals is enabled, allows remote… | Patch early | 6.8 medium | 5.1% | 2007-04-18 |
| CVE-2006-7208 EXP | PHP remote file inclusion vulnerability in download.php in the Adam van Dongen Forum (com_forum) component (aka phpBB component) 1.2.4RC3 and earlier… | Patch early | 6.8 medium | 5.1% | 2007-06-26 |
| CVE-2017-8477 EXP | Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607,… | Patch early | 5.0 medium | 5.1% | 2017-06-15 |
| CVE-2017-8483 EXP | The kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Go… | Patch early | 5.0 medium | 5.1% | 2017-06-15 |
| CVE-2007-1766 EXP | PHP remote file inclusion vulnerability in login/engine/db/profiledit.php in Advanced Login 0.76 and earlier allows remote attackers to execute arbitr… | Patch early | 10.0 high | 5.1% | 2007-03-30 |
| CVE-2017-13867 EXP | An issue was discovered in certain Apple products. iOS before 11.2 is affected. macOS before 10.13.2 is affected. tvOS before 11.2 is affected. watchO… | Patch early | 7.8 high | 5.1% | 2017-12-25 |
| CVE-2017-13876 EXP | An issue was discovered in certain Apple products. iOS before 11.2 is affected. macOS before 10.13.2 is affected. tvOS before 11.2 is affected. watchO… | Patch early | 7.8 high | 5.1% | 2017-12-25 |
| CVE-2017-2482 EXP | An issue was discovered in certain Apple products. iOS before 10.3 is affected. macOS before 10.12.4 is affected. tvOS before 10.2 is affected. watchO… | Patch early | 7.8 high | 5.1% | 2017-04-02 |
| CVE-2006-2587 EXP | Buffer overflow in the WebTool HTTP server component in (1) PunkBuster before 1.229, as used by multiple products including (2) America's Army 1.228 a… | Patch early | 5.0 medium | 5.1% | 2006-05-25 |
| CVE-2005-4196 EXP | Multiple cross-site scripting (XSS) vulnerabilities in Scout Portal Toolkit (SPT) 1.3.1 and earlier allow remote attackers to inject arbitrary web scr… | Patch early | 4.3 medium | 5.1% | 2005-12-13 |
| CVE-2006-1101 EXP | The (1) sgetstr and (2) getint functions in Sauerbraten 2006_02_28, as derived from the Cube engine, allow remote attackers to cause a denial of servi… | Patch early | 5.0 medium | 5.1% | 2006-03-09 |
| CVE-2016-0073 EXP | The kernel in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold, 1511, and 1607 allows local users to gain p… | Patch early | 5.0 medium | 5.1% | 2016-10-14 |
| CVE-2007-1474 EXP | Argument injection vulnerability in the cleanup cron script in Horde Project Horde and IMP before Horde Application Framework 3.1.4 allows local users… | Patch early | 6.8 medium | 5.1% | 2007-03-16 |
| CVE-2007-2431 EXP | Dynamic variable evaluation vulnerability in shared/config/tce_config.php in TCExam 4.0.011 and earlier allows remote attackers to conduct cross-site… | Patch early | 6.8 medium | 5.1% | 2007-05-02 |
| CVE-2006-6864 EXP | PHP remote file inclusion vulnerability in E2_header.inc.php in Enigma2 Coppermine Bridge 1.0 allows remote attackers to execute arbitrary PHP code vi… | Patch early | 10.0 high | 5.1% | 2006-12-31 |
| CVE-2006-4024 EXP | The FESTAHES_Load function in pce/hes.c in Festalon 0.5.0 through 0.5.5 allows user-assisted attackers to cause a denial of service (crash) and possib… | Patch early | 7.5 high | 5.1% | 2006-08-09 |
| CVE-2012-5105 EXP | Multiple cross-site scripting (XSS) vulnerabilities in SQLiteManager 1.2.4 allow remote attackers to inject arbitrary web script or HTML via the dbsel… | Patch early | 4.3 medium | 5.1% | 2012-09-23 |
| CVE-2015-8368 EXP | ntopng (aka ntop) before 2.2 allows remote authenticated users to change the login context and gain privileges via the user cookie and username parame… | Patch early | 6.0 medium | 5.1% | 2015-12-17 |
| CVE-2005-1604 EXP | PHP Advanced Transfer Manager (phpATM) 1.21 allows remote attackers to upload arbitrary files via filenames containing multiple file extensions, as de… | Patch early | 7.5 high | 5.1% | 2005-05-16 |
| CVE-2023-29983 EXP | Cross Site Scripting vulnerability found in Maximilian Vogt cmaps v.8.0 allows a remote attacker to execute arbitrary code via the auditlog tab in the… | Patch early | 5.4 medium | 5.1% | 2023-05-12 |
| CVE-2006-4455 EXP | Unspecified vulnerability in Xchat 2.6.7 and earlier allows remote attackers to cause a denial of service (crash) via unspecified vectors involving th… | Patch early | 5.0 medium | 5.1% | 2006-08-30 |
| CVE-2017-9127 EXP | The quicktime_user_atoms_read_atom function in useratoms.c in libquicktime 1.2.4 allows remote attackers to cause a denial of service (heap-based buff… | Patch early | 6.5 medium | 5.1% | 2017-06-12 |
| CVE-2005-2869 EXP | Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin before 2.6.4 allow remote attackers to inject arbitrary web script or HTML via (1) t… | Patch early | 4.3 medium | 5.1% | 2005-09-08 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt