CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
425,731 CVEs
1,781 on KEV
17,555 EPSS ≥ 10%
25,095 with exploits
synced 2026-11-14
179,241 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2007-0821 EXP | Multiple directory traversal vulnerabilities in Cedric CLAIRE PortailPhp 2 allow remote attackers to read arbitrary files via a .. (dot dot) in the ch… | Patch early | 5.0 medium | 7.7% | 2007-02-07 |
| CVE-2000-0329 EXP | A Microsoft ActiveX control allows a remote attacker to execute a malicious cabinet file via an attachment and an embedded script in an HTML mail, aka… | Patch early | 5.1 medium | 7.7% | 1999-11-11 |
| CVE-2015-2169 EXP | Cross-site scripting (XSS) vulnerability in Zoho ManageEngine AssetExplorer 6.1 service pack 6112 allows remote attackers to inject arbitrary web scri… | Patch early | 4.3 medium | 7.7% | 2015-06-24 |
| CVE-2021-44665 EXP | A Directory Traversal vulnerability exists in the Xerte Project Xerte through 3.10.3 when downloading a project file via download.php. | Patch early | 6.5 medium | 7.7% | 2022-02-24 |
| CVE-2017-3131 EXP | A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.4.0 through 5.4.4 and 5.6.0 allows attackers to execute unauthorized code or comma… | Patch early | 5.4 medium | 7.7% | 2017-09-12 |
| CVE-2016-6505 EXP | epan/dissectors/packet-packetbb.c in the PacketBB dissector in Wireshark 1.12.x before 1.12.13 and 2.x before 2.0.5 allows remote attackers to cause a… | Patch early | 5.9 medium | 7.7% | 2016-08-06 |
| CVE-2005-3294 EXP | Typsoft FTP Server 1.11, with "Sub Directory Include" enabled, allows remote attackers to cause a denial of service (crash) by sending multiple RETR c… | Patch early | 5.0 medium | 7.7% | 2005-10-23 |
| CVE-2006-5031 EXP | Directory traversal vulnerability in app/webroot/js/vendors.php in Cake Software Foundation CakePHP before 1.1.8.3544 allows remote attackers to read… | Patch early | 5.0 medium | 7.7% | 2006-09-27 |
| CVE-2013-5696 EXP | inc/central.class.php in GLPI before 0.84.2 does not attempt to make install/install.php unavailable after an installation is completed, which allows… | Patch early | 6.8 medium | 7.7% | 2013-09-23 |
| CVE-2000-0521 EXP | Savant web server allows remote attackers to read source code of CGI scripts via a GET request that does not include the HTTP version number. | Patch early | 5.0 medium | 7.7% | 2000-06-05 |
| CVE-2012-1670 EXP | admin/index.php in PHP Grade Book before 1.9.5 BETA allows remote attackers to read the database via a SaveSQL action. | Patch early | 5.0 medium | 7.7% | 2012-03-31 |
| CVE-2010-0642 EXP | Cisco Collaboration Server (CCS) 5 allows remote attackers to read the source code of JHTML files via URL encoded characters in the filename extension… | Patch early | 5.0 medium | 7.7% | 2010-02-17 |
| CVE-2008-2106 EXP | Call of Duty 4 (CoD4) 1.5 and earlier allows remote authenticated users to cause a denial of service (crash) via a type 7 stats packet, which triggers… | Patch early | 6.8 medium | 7.7% | 2008-05-07 |
| CVE-2012-6313 EXP | simple-gmail-login.php in the Simple Gmail Login plugin before 1.1.4 for WordPress allows remote attackers to obtain sensitive information via a reque… | Patch early | 5.0 medium | 7.7% | 2012-12-11 |
| CVE-2007-2519 EXP | Directory traversal vulnerability in the installer in PEAR 1.0 through 1.5.3 allows user-assisted remote attackers to overwrite arbitrary files via a… | Patch early | 6.8 medium | 7.7% | 2007-05-22 |
| CVE-2006-1610 EXP | PHP remote file inclusion vulnerability in lib/armygame.php in SQuery 4.5 and earlier, as used in products such as Autonomous LAN party (ALP), allows… | Patch early | 5.1 medium | 7.7% | 2006-04-04 |
| CVE-1999-0800 EXP | The GetFile.cfm file in Allaire Forums allows remote attackers to read files through a parameter to GetFile.cfm. | Patch early | 5.0 medium | 7.7% | 2001-03-12 |
| CVE-2000-0240 EXP | vqSoft vqServer program allows remote attackers to read arbitrary files via a /........../ in the URL, a variation of a .. (dot dot) attack. | Patch early | 5.0 medium | 7.7% | 2000-03-21 |
| CVE-2000-0782 EXP | netauth.cgi program in Netwin Netauth 4.2e and earlier allows remote attackers to read arbitrary files via a .. (dot dot) attack. | Patch early | 5.0 medium | 7.7% | 2000-10-20 |
| CVE-2000-0930 EXP | Pegasus Mail 3.12 allows remote attackers to read arbitrary files via an embedded URL that calls the mailto: protocol with a -F switch. | Patch early | 5.0 medium | 7.7% | 2000-12-19 |
| CVE-2011-4336 EXP | Tiki Wiki CMS Groupware 7.0 has XSS via the GET "ajax" parameter to snarf_ajax.php. | Patch early | 6.1 medium | 7.7% | 2020-01-15 |
| CVE-2005-0229 EXP | CitrusDB 0.3.5 and earlier stores the newfile.txt temporary data file under the web root, which allows remote attackers to steal credit card informati… | Patch early | 5.0 medium | 7.7% | 2005-04-27 |
| CVE-2012-5907 EXP | Directory traversal vulnerability in json.php in TomatoCart 1.2.0 Alpha 2 and possibly earlier allows remote attackers to read arbitrary files via a .… | Patch early | 5.0 medium | 7.7% | 2012-11-17 |
| CVE-2014-10010 EXP | Directory traversal vulnerability in PHPJabbers Appointment Scheduler 2.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the id… | Patch early | 5.0 medium | 7.7% | 2015-01-13 |
| CVE-2014-3806 EXP | Directory traversal vulnerability in cgi-bin/help/doIt.cgi in VMTurbo Operations Manager before 4.6 allows remote attackers to read arbitrary files vi… | Patch early | 5.0 medium | 7.7% | 2014-05-21 |
| CVE-2013-2619 EXP | Directory traversal vulnerability in Aspen before 0.22 allows remote attackers to read arbitrary files via a .. (dot dot) to the default URI. | Patch early | 5.0 medium | 7.7% | 2014-03-18 |
| CVE-2007-0540 EXP | WordPress allows remote attackers to cause a denial of service (bandwidth or thread consumption) via pingback service calls with a source URI that cor… | Patch early | 5.0 medium | 7.6% | 2007-01-29 |
| CVE-2015-0514 EXP | EMC M&R (aka Watch4Net) before 6.5u1 and ViPR SRM before 3.6.1 might allow remote attackers to obtain cleartext data-center discovery credentials by l… | Patch early | 5.0 medium | 7.6% | 2015-01-21 |
| CVE-2019-10273 EXP | Information leakage vulnerability in the /mc login page in ManageEngine ServiceDesk Plus 9.3 software allows authenticated users to enumerate active u… | Patch early | 4.3 medium | 7.6% | 2019-04-04 |
| CVE-2003-1181 EXP | Advanced Poll 2.0.2 allows remote attackers to obtain sensitive information via an HTTP request to info.php, which invokes the phpinfo() function. | Patch early | 5.0 medium | 7.6% | 2003-10-25 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt