CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
407,382 CVEs
1,741 on KEV
17,302 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-14
172,346 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2009-2598 EXP | Multiple SQL injection vulnerabilities in Online Grades & Attendance 3.2.6 and earlier allow (1) remote attackers to execute arbitrary SQL commands vi… | Patch early | 6.5 medium | 0.9% | 2009-07-27 |
| CVE-2010-5195 EXP | Untrusted search path vulnerability in Roxio MyDVD 9 allows local users to gain privileges via a Trojan horse HomeUtils9.dll file in the current worki… | Patch early | 6.9 medium | 0.9% | 2012-09-06 |
| CVE-2009-1436 EXP | The db interface in libc in FreeBSD 6.3, 6.4, 7.0, 7.1, and 7.2-PRERELEASE does not properly initialize memory for Berkeley DB 1.85 database structure… | Patch early | 4.9 medium | 0.9% | 2009-04-27 |
| CVE-2009-2129 EXP | Cross-site request forgery (CSRF) vulnerability in login.php in Elvin 1.2.0 allows remote attackers to hijack the authentication of arbitrary users vi… | Patch early | 6.8 medium | 0.9% | 2009-06-19 |
| CVE-2009-2150 EXP | Multiple cross-site request forgery (CSRF) vulnerabilities in Campus Virtual-LMS allow (1) remote attackers to hijack the authentication of arbitrary… | Patch early | 6.8 medium | 0.9% | 2009-06-22 |
| CVE-2024-9458 EXP | The Reservit Hotel WordPress plugin before 3.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin… | Patch early | 4.8 medium | 0.9% | 2025-03-07 |
| CVE-2003-0372 EXP | Signed integer vulnerability in libnasl in Nessus before 2.0.6 allows local users with plugin upload privileges to cause a denial of service (core dum… | Patch early | 4.6 medium | 0.9% | 2003-06-16 |
| CVE-2025-41228 EXP | VMware ESXi and vCenter Server contain a reflected cross-site scripting vulnerability due to improper input validation. A malicious actor with network… | Patch early | 4.3 medium | 0.9% | 2025-05-20 |
| CVE-2004-0158 EXP | Buffer overflow in lbreakout2 allows local users to gain 'games' group privileges via a large HOME environment variable to (1) editor.c, (2) theme.c,… | Patch early | 4.6 medium | 0.9% | 2004-03-29 |
| CVE-2009-4733 EXP | SQL injection vulnerability in checkuser.php in SimpleLoginSys 0.5, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQ… | Patch early | 6.8 medium | 0.9% | 2010-03-18 |
| CVE-2009-1952 EXP | Multiple SQL injection vulnerabilities in the administrative login feature in PropertyMax Pro FREE 0.3, when magic_quotes_gpc is disabled, allow remot… | Patch early | 6.8 medium | 0.9% | 2009-06-05 |
| CVE-2012-1058 EXP | Cross-site request forgery (CSRF) vulnerability in Flyspray 0.9.9.6 allows remote attackers to hijack the authentication of admins for requests that a… | Patch early | 6.0 medium | 0.9% | 2012-02-14 |
| CVE-2010-4249 EXP | The wait_for_unix_gc function in net/unix/garbage.c in the Linux kernel before 2.6.37-rc3-next-20101125 does not properly select times for garbage col… | Patch early | 4.9 medium | 0.9% | 2010-11-29 |
| CVE-2012-2236 EXP | SQL injection vulnerability in users.php in PHP Gift Registry 1.5.5 allows remote authenticated users to execute arbitrary SQL commands via the userid… | Patch early | 6.5 medium | 0.9% | 2012-04-20 |
| CVE-2009-3970 EXP | SQL injection vulnerability in index.php in PHP Dir Submit (aka WebsiteSubmitter or Submitter Script) allows remote authenticated users to execute arb… | Patch early | 6.5 medium | 0.9% | 2009-11-18 |
| CVE-2009-4198 EXP | SQL injection vulnerability in my_orders.php in MyMiniBill allows remote authenticated users to execute arbitrary SQL commands via the orderid paramet… | Patch early | 6.5 medium | 0.9% | 2009-12-04 |
| CVE-2009-4667 EXP | SQL injection vulnerability in form.php in WebMember 1.0 allows remote authenticated users to execute arbitrary SQL commands via the formID parameter. | Patch early | 6.5 medium | 0.9% | 2010-03-05 |
| CVE-2002-0211 EXP | Race condition in the installation script for Tarantella Enterprise 3 3.01 through 3.20 creates a world-writeable temporary "gunzip" program before ex… | Patch early | 6.2 medium | 0.9% | 2002-05-16 |
| CVE-2009-1810 EXP | Multiple SQL injection vulnerabilities in myColex 1.4.2 allow remote attackers to execute arbitrary SQL commands via (1) the formUser parameter (aka t… | Patch early | 6.0 medium | 0.9% | 2009-05-29 |
| CVE-2009-1812 EXP | Multiple SQL injection vulnerabilities in myGesuad 0.9.14 (aka 0.9) allow remote attackers to execute arbitrary SQL commands via (1) the formUser para… | Patch early | 6.0 medium | 0.9% | 2009-05-29 |
| CVE-2011-4122 EXP | Directory traversal vulnerability in openpam_configure.c in OpenPAM before r478 on FreeBSD 8.1 allows local users to load arbitrary DSOs and gain priv… | Patch early | 6.9 medium | 0.9% | 2011-11-17 |
| CVE-2006-6131 EXP | Untrusted search path vulnerability in (1) WSAdminServer and (2) WSWebServer in Kerio WebSTAR (4D WebSTAR Server Suite) 5.4.2 and earlier allows local… | Patch early | 6.2 medium | 0.9% | 2006-11-28 |
| CVE-2008-6777 EXP | Multiple SQL injection vulnerabilities in MyPHP Forum 3.0 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id paramete… | Patch early | 5.1 medium | 0.9% | 2009-05-01 |
| CVE-2008-6330 EXP | SQL injection vulnerability in index.php in MyTopix 1.3.0 and earlier allows remote authenticated users to execute arbitrary SQL commands via the send… | Patch early | 6.5 medium | 0.9% | 2009-02-27 |
| CVE-2006-2805 EXP | SQL injection vulnerability in VBulletin 3.0.10 allows remote attackers to execute arbitrary SQL commands via the featureid parameter. | Patch early | 5.0 medium | 0.9% | 2006-06-03 |
| CVE-2007-5060 EXP | Cross-site request forgery (CSRF) vulnerability in the cpass functionality in an admin action in index.php in XCMS allows remote attackers to change a… | Patch early | 4.3 medium | 0.9% | 2007-09-24 |
| CVE-2009-2579 EXP | SQL injection vulnerability in reward_points.post.php in the Reward points addon in CS-Cart before 2.0.6 allows remote authenticated users to execute… | Patch early | 6.5 medium | 0.9% | 2009-08-05 |
| CVE-2009-3052 EXP | SQL injection vulnerability in root/includes/prime_quick_style.php in the Prime Quick Style addon before 1.2.3 for phpBB 3 allows remote authenticated… | Patch early | 6.5 medium | 0.9% | 2009-09-03 |
| CVE-2000-0545 EXP | Buffer overflow in mailx mail command (aka Mail) on Linux systems allows local users to gain privileges via a long -c (carbon copy) parameter. | Patch early | 4.6 medium | 0.9% | 2000-08-08 |
| CVE-2006-7234 EXP | Untrusted search path vulnerability in Lynx before 2.8.6rel.4 allows local users to execute arbitrary code via malicious (1) .mailcap and (2) mime.typ… | Patch early | 4.6 medium | 0.9% | 2008-10-27 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt