CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
408,510 CVEs
1,746 on KEV
17,309 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-15
152,756 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2004-2202 EXP | Multiple SQL injection vulnerabilities in DUware DUclassified 4.0 through 4.2 allows remote attackers to bypass authentication and execute other comma… | Patch early | 7.5 high | 1.5% | 2004-12-31 |
| CVE-2017-1000408 EXP | A memory leak in glibc 2.1.1 (released on May 24, 1999) can be reached and amplified through the LD_HWCAP_MASK environment variable. Please note that… | Patch early | 7.8 high | 1.5% | 2018-02-01 |
| CVE-2008-4715 EXP | SQL injection vulnerability in the Jpad (com_jpad) 1.0 component for Joomla! allows remote attackers to execute arbitrary SQL commands via the cid par… | Patch early | 7.5 high | 1.5% | 2008-10-23 |
| CVE-2017-0312 EXP | All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscapeID 0x100008… | Patch early | 7.8 high | 1.4% | 2017-02-15 |
| CVE-2012-1603 EXP | Multiple SQL injection vulnerabilities in ajaxserver.php in NextBBS 0.6 allow remote attackers to execute arbitrary SQL commands via the (1) curstr pa… | Patch early | 7.5 high | 1.4% | 2012-10-01 |
| CVE-2026-54646 EXP | CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/maintenance.index.inc.php places administrator-controlled tablename values i… | Patch early | 7.2 high | 1.4% | 2026-09-17 |
| CVE-2026-54647 EXP | CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/settings.index.inc.php directly concatenates the administrator-controlled do… | Patch early | 7.2 high | 1.4% | 2026-09-17 |
| CVE-2017-5717 EXP | Type Confusion in Content Protection HECI Service in Intel Graphics Driver allows unprivileged user to elevate privileges via local access. | Patch early | 7.8 high | 1.4% | 2017-12-12 |
| CVE-2001-0764 EXP | Buffer overflow in ntping in scotty 2.1.0 allows local users to execute arbitrary code via a long hostname as a command line argument. | Patch early | 7.2 high | 1.4% | 2001-10-18 |
| CVE-2017-7952 EXP | INFOR EAM V11.0 Build 201410 has SQL injection via search fields, related to the filtervalue parameter. | Patch early | 8.8 high | 1.4% | 2017-05-16 |
| CVE-2017-3575 EXP | Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are Prior to 5… | Patch early | 7.9 high | 1.4% | 2017-04-24 |
| CVE-2007-5449 EXP | SQL injection vulnerability in searchresult.php in Softbiz Recipes Portal Script allows remote attackers to execute arbitrary SQL commands via the sbc… | Patch early | 7.5 high | 1.4% | 2007-10-14 |
| CVE-2006-6365 EXP | SQL injection vulnerability in detail.asp in DUware DUpaypal 3.1, and possibly earlier, allows remote attackers to execute arbitrary SQL commands via… | Patch early | 7.5 high | 1.4% | 2006-12-07 |
| CVE-2002-0767 EXP | simpleinit on Linux systems does not close a read/write FIFO file descriptor before creating a child process, which allows the child process to cause… | Patch early | 7.2 high | 1.4% | 2002-08-12 |
| CVE-2005-4563 EXP | SQL injection vulnerability in main.php in Enterprise Heart Enterprise Connector 1.0.2 allows remote attackers to execute arbitrary SQL commands and b… | Patch early | 7.5 high | 1.4% | 2005-12-29 |
| CVE-2006-6109 EXP | Multiple SQL injection vulnerabilities in CandyPress Store 3.5.2.14 allow remote attackers to execute arbitrary SQL commands via the (1) policy parame… | Patch early | 7.5 high | 1.4% | 2006-11-26 |
| CVE-2000-0460 EXP | Buffer overflow in KDE kdesud on Linux allows local uses to gain privileges via a long DISPLAY environmental variable. | Patch early | 7.2 high | 1.4% | 2000-05-27 |
| CVE-2006-6095 EXP | Multiple SQL injection vulnerabilities in ActiveNews Manager allow remote attackers to execute arbitrary SQL commands via the (1) articleID parameter… | Patch early | 7.5 high | 1.4% | 2006-11-24 |
| CVE-2018-10814 EXP | Synametrics SynaMan 4.0 build 1488 uses cleartext password storage for SMTP credentials. | Patch early | 7.8 high | 1.4% | 2018-09-14 |
| CVE-2024-10758 EXP | A vulnerability, which was classified as critical, was found in code-projects/anirbandutta9 Content Management System and News-Buzz 1.0. This affects… | Patch early | 7.3 high | 1.4% | 2024-11-04 |
| CVE-2017-3141 EXP | The BIND installer on Windows uses an unquoted service path which can enable a local user to achieve privilege escalation if the host file system perm… | Patch early | 7.2 high | 1.4% | 2019-01-16 |
| CVE-2004-2131 EXP | Stack-based buffer overflow in ontape for IBM Informix Dynamic Server (IDS) 9.40.xC3 and earlier allows local users, with DSA privileges, to execute a… | Patch early | 7.2 high | 1.4% | 2004-01-27 |
| CVE-2009-3040 EXP | Multiple SQL injection vulnerabilities in Open Computer and Software (OCS) Inventory NG 1.02 for Unix allow remote attackers to execute arbitrary SQL… | Patch early | 7.5 high | 1.4% | 2009-09-01 |
| CVE-2005-0997 EXP | Multiple SQL injection vulnerabilities in the Web_Links module for PHP-Nuke 7.6 allow remote attackers to execute arbitrary SQL commands via (1) the e… | Patch early | 7.5 high | 1.4% | 2005-05-02 |
| CVE-2020-26887 EXP | FRITZ!OS before 7.21 on FRITZ!Box devices allows a bypass of a DNS Rebinding protection mechanism. | Patch early | 7.8 high | 1.4% | 2020-10-23 |
| CVE-2007-1339 EXP | SQL injection vulnerability in index.php in Links Management Application 1.0 allows remote attackers to execute arbitrary SQL commands via the lcnt pa… | Patch early | 7.5 high | 1.4% | 2007-03-08 |
| CVE-2000-1134 EXP | Multiple shell programs on various Unix systems, including (1) tcsh, (2) csh, (3) sh, and (4) bash, follow symlinks when processing << redirects (aka… | Patch early | 7.2 high | 1.4% | 2001-01-09 |
| CVE-2004-2418 EXP | Buffer overflow in SlimFTPd 3.15 and earlier allows local users to execute arbitrary code via a long command, such as (1) CWD, (2) STOR, (3) MKD, and… | Patch early | 7.2 high | 1.4% | 2004-12-31 |
| CVE-2017-9644 EXP | An Unquoted Search Path or Element issue was discovered in Automated Logic Corporation (ALC) ALC WebCTRL, i-Vu, SiteScan Web 6.5 and prior; ALC WebCTR… | Patch early | 7.0 high | 1.4% | 2017-08-25 |
| CVE-2007-6106 EXP | SQL injection vulnerability in index.php in AlstraSoft E-Friends 4.98 and earlier allows remote attackers to execute arbitrary SQL commands via the se… | Patch early | 7.5 high | 1.4% | 2007-11-23 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt