CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
407,366 CVEs
1,741 on KEV
17,302 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-14
172,342 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2012-5378 EXP | Untrusted search path vulnerability in the installation functionality in ActiveTcl 8.5.12, when installed in the top-level C:\ directory, allows local… | Patch early | 6.0 medium | 0.9% | 2012-10-11 |
| CVE-2007-0602 EXP | Buffer overflow in libvsapi.so in the VSAPI library in Trend Micro VirusWall 3.81 for Linux, as used by IScan.BASE/vscan, allows local users to gain p… | Patch early | 6.9 medium | 0.9% | 2007-01-30 |
| CVE-2008-1141 EXP | Memory leak in DLMFENC.sys 1.0.0.26 in DESlock+ 3.2.6 and earlier allows local users to cause a denial of service (kernel memory consumption) via a se… | Patch early | 4.9 medium | 0.9% | 2008-03-04 |
| CVE-1999-0026 EXP | root privileges via buffer overflow in pset command on SGI IRIX systems. | Patch early | 4.6 medium | 0.9% | 1997-07-16 |
| CVE-2009-2883 EXP | SQL injection vulnerability in admin/login.php in SaphpLesson 4.0, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL… | Patch early | 6.8 medium | 0.9% | 2009-08-20 |
| CVE-2009-4540 EXP | SQL injection vulnerability in page.php in Mini CMS 1.0.1 allows remote attackers to execute arbitrary SQL commands via the id parameter. | Patch early | 6.8 medium | 0.9% | 2010-01-04 |
| CVE-2010-2015 EXP | Multiple SQL injection vulnerabilities in LiSK CMS 4.4 allow remote attackers to execute arbitrary SQL commands via (1) the id parameter in a view_inb… | Patch early | 6.8 medium | 0.9% | 2010-05-24 |
| CVE-2010-3482 EXP | Multiple SQL injection vulnerabilities in cms_write.php in Primitive CMS 1.0.9 allow remote authenticated administrators to execute arbitrary SQL comm… | Patch early | 6.5 medium | 0.9% | 2010-09-22 |
| CVE-2009-2010 EXP | Multiple SQL injection vulnerabilities in Haudenschilt Family Connections CMS (FCMS) 1.9 and earlier allow remote authenticated users to execute arbit… | Patch early | 6.5 medium | 0.9% | 2009-06-08 |
| CVE-2006-2132 EXP | SQL injection vulnerability in detail.asp in DUclassified allows remote attackers to execute arbitrary SQL commands via the iPro parameter. NOTE: the… | Patch early | 6.4 medium | 0.9% | 2006-05-01 |
| CVE-2007-3103 EXP | The init.d script for the X.Org X11 xfs font server on various Linux distributions might allow local users to change the permissions of arbitrary file… | Patch early | 6.2 medium | 0.9% | 2007-07-15 |
| CVE-2010-4752 EXP | SQL injection vulnerability in LightNEasy.php in LightNEasy 3.2.1, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL… | Patch early | 6.8 medium | 0.9% | 2011-03-01 |
| CVE-2020-8793 EXP | OpenSMTPD before 6.6.4 allows local users to read arbitrary files (e.g., on some Linux distributions) because of a combination of an untrusted search… | Patch early | 4.7 medium | 0.9% | 2020-02-25 |
| CVE-2006-4655 EXP | Buffer overflow in the Strcmp function in the XKEYBOARD extension in X Window System X11R6.4 and earlier, as used in SCO UnixWare 7.1.3 and Sun Solari… | Patch early | 4.6 medium | 0.9% | 2006-09-09 |
| CVE-2003-0388 EXP | pam_wheel in Linux-PAM 0.78, with the trust option enabled and the use_uid option disabled, allows local users to spoof log entries and gain privilege… | Patch early | 4.6 medium | 0.9% | 2003-07-24 |
| CVE-2010-4834 EXP | Multiple SQL injection vulnerabilities in index.php in OneOrZero AIMS 2.6.0 Members Edition and 2.7.0 Trial Edition allow remote authenticated users t… | Patch early | 6.5 medium | 0.9% | 2011-09-14 |
| CVE-2026-54644 EXP | CubeCart is an ecommerce software solution. Prior to 6.7.5, the _errorMessage method in classes/gui.class.php uses strip_tags to permit anchor element… | Patch early | 6.1 medium | 0.9% | 2026-09-17 |
| CVE-2025-28121 EXP | code-projects Online Exam Mastering System 1.0 is vulnerable to Cross Site Scripting (XSS) in feedback.php via the "q" parameter allowing remote attac… | Patch early | 6.1 medium | 0.9% | 2025-04-21 |
| CVE-2008-7017 EXP | Cross-site scripting (XSS) vulnerability in analyse.php in CAcert 20080921, and possibly other versions before 20080928, allows remote attackers to in… | Patch early | 4.3 medium | 0.9% | 2009-08-21 |
| CVE-2007-3235 EXP | Cross-site scripting (XSS) vulnerability in low.php in Fuzzylime Forum 1.0 allows remote attackers to inject arbitrary web script or HTML via the topi… | Patch early | 4.3 medium | 0.9% | 2007-06-15 |
| CVE-2007-6393 EXP | SQL injection vulnerability in albums.php in Ace Image Hosting Script allows remote authenticated users to execute arbitrary SQL commands via the id p… | Patch early | 6.5 medium | 0.9% | 2007-12-17 |
| CVE-2009-3223 EXP | SQL injection vulnerability in ppc-add-keywords.php in Inout Adserver allows remote authenticated users to execute arbitrary SQL commands via the id p… | Patch early | 6.5 medium | 0.9% | 2009-09-16 |
| CVE-2025-52392 EXP | Soosyze CMS 2.0 allows brute-force login attacks via the /user/login endpoint due to missing rate-limiting and lockout mechanisms. An attacker can rep… | Patch early | 5.4 medium | 0.9% | 2025-08-13 |
| CVE-2008-5731 EXP | The PGPwded device driver (aka PGPwded.sys) in PGP Corporation PGP Desktop 9.0.6 build 6060 and 9.9.0 build 397 allows local users to cause a denial o… | Patch early | 4.9 medium | 0.9% | 2008-12-26 |
| CVE-2014-8612 EXP | Multiple array index errors in the Stream Control Transmission Protocol (SCTP) module in FreeBSD 10.1 before p5, 10.0 before p17, 9.3 before p9, and 8… | Patch early | 4.6 medium | 0.9% | 2015-02-02 |
| CVE-2008-2521 EXP | SQL injection vulnerability in members.php in YABSoft Mega File Hosting Script (aka MFH or MFHS) 1.2 allows remote authenticated users to execute arbi… | Patch early | 6.5 medium | 0.9% | 2008-06-03 |
| CVE-2008-2562 EXP | SQL injection vulnerability in edCss.php in PowerPhlogger 2.2.5 and earlier allows remote authenticated users to execute arbitrary SQL commands via th… | Patch early | 6.5 medium | 0.9% | 2008-06-06 |
| CVE-2008-3035 EXP | SQL injection vulnerability in newThread.php in XchangeBoard 1.70 Final and earlier allows remote authenticated users to execute arbitrary SQL command… | Patch early | 6.5 medium | 0.9% | 2008-07-07 |
| CVE-2008-3718 EXP | Multiple SQL injection vulnerabilities in cyberBB 0.6 allow remote authenticated users to execute arbitrary SQL commands via the (1) id parameter to s… | Patch early | 6.5 medium | 0.9% | 2008-08-20 |
| CVE-2006-2409 EXP | Format string vulnerability in the raydium_log function in console.c in Raydium before SVN revision 310 allows local users to execute arbitrary code v… | Patch early | 4.6 medium | 0.9% | 2006-05-16 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt