CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
424,634 CVEs
1,779 on KEV
17,541 EPSS ≥ 10%
25,095 with exploits
synced 2026-11-12
1,491 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2018-12465 EXP | An OS command injection vulnerability in the web administration component of Micro Focus Secure Messaging Gateway (SMG) allows a remote attacker authe… | Patch early | 9.1 critical | 80% | 2018-06-29 |
| CVE-2013-5743 EXP | Multiple SQL injection vulnerabilities in Zabbix 1.8.x before 1.8.18rc1, 2.0.x before 2.0.9rc1, and 2.1.x before 2.1.7. | Patch early | 9.8 critical | 80% | 2019-12-11 |
| CVE-2019-4279 EXP | IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to execute arbitrary code on the system with a specially-crafted sequence o… | Patch early | 9.8 critical | 79.9% | 2019-05-17 |
| CVE-2017-12557 EXP | A Remote Code Execution vulnerability in HPE intelligent Management Center (iMC) PLAT version IMC Plat 7.3 E0504P2 and earlier was found. | Patch early | 9.8 critical | 79.8% | 2018-02-15 |
| CVE-2012-1495 EXP | install/index.php in WebCalendar before 1.2.5 allows remote attackers to execute arbitrary code via the form_single_user_login parameter. | Patch early | 9.8 critical | 79.8% | 2020-01-27 |
| CVE-2016-2555 EXP | SQL injection vulnerability in include/lib/mysql_connect.inc.php in ATutor 2.2.1 allows remote attackers to execute arbitrary SQL commands via the sea… | Patch early | 9.8 critical | 79.8% | 2017-04-13 |
| CVE-2016-6563 EXP | Processing malformed SOAP messages when performing the HNAP Login action causes a buffer overflow in the stack in some D-Link DIR routers. The vulnera… | Patch early | 9.8 critical | 79.7% | 2018-07-13 |
| CVE-2024-42327 EXP | A non-admin user account on the Zabbix frontend with the default User role, or with any other role that gives API access can exploit this vulnerabilit… | Patch early | 9.9 critical | 79.1% | 2024-11-27 |
| CVE-2018-10662 EXP | An issue was discovered in multiple models of Axis IP Cameras. There is an Exposed Insecure Interface. | Patch early | 9.8 critical | 78.9% | 2018-06-26 |
| CVE-2018-7890 EXP | A remote code execution issue was discovered in Zoho ManageEngine Applications Manager before 13.6 (build 13640). The publicly accessible testCredenti… | Patch early | 9.8 critical | 78.8% | 2018-03-08 |
| CVE-2021-24931 EXP | The Secure Copy Content Protection and Content Locking WordPress plugin before 2.8.2 does not escape the sccp_id parameter of the ays_sccp_results_exp… | Patch early | 9.8 critical | 78.8% | 2021-12-06 |
| CVE-2019-15954 EXP | An issue was discovered in Total.js CMS 12.0.0. An authenticated user with the widgets privilege can gain achieve Remote Command Execution (RCE) on th… | Patch early | 9.9 critical | 78.7% | 2019-09-05 |
| CVE-2020-35665 EXP | An unauthenticated command-execution vulnerability exists in TerraMaster TOS through 4.2.06 via shell metacharacters in the Event parameter in include… | Patch early | 9.8 critical | 78.5% | 2020-12-23 |
| CVE-2025-2294 EXP | The Kubio AI Page Builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.5.1 via thekubio_hybrid_t… | Patch early | 9.8 critical | 78.4% | 2025-03-28 |
| CVE-2017-12478 EXP | It was discovered that the api/storage web interface in Unitrends Backup (UB) before 10.0.0 has an issue in which one of its input parameters was not… | Patch early | 9.8 critical | 78.3% | 2017-08-07 |
| CVE-2015-0936 EXP | Ceragon FibeAir IP-10 have a default SSH public key in the authorized_keys file for the mateidu user, which allows remote attackers to obtain SSH acce… | Patch early | 9.8 critical | 78.2% | 2017-06-01 |
| CVE-2003-0466 EXP | Off-by-one error in the fb_realpath() function, as derived from the realpath function in BSD, may allow attackers to execute arbitrary code, as demons… | Patch early | 9.8 critical | 78.1% | 2003-08-27 |
| CVE-2019-9851 EXP | LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitrary python commands contained w… | Patch early | 9.8 critical | 77.8% | 2019-08-15 |
| CVE-2020-0609 EXP | A remote code execution vulnerability exists in Windows Remote Desktop Gateway (RD Gateway) when an unauthenticated attacker connects to the target sy… | Patch early | 9.8 critical | 77.7% | 2020-01-14 |
| CVE-2020-13166 EXP | The management tool in MyLittleAdmin 3.8 allows remote attackers to execute arbitrary code because machineKey is hardcoded (the same for all customers… | Patch early | 9.8 critical | 77.6% | 2020-05-19 |
| CVE-2016-10176 EXP | The NETGEAR WNR2000v5 router allows an administrator to perform sensitive actions by invoking the apply.cgi URL on the web server of the device. This… | Patch early | 9.8 critical | 77.4% | 2017-01-30 |
| CVE-2017-14143 EXP | The getUserzoneCookie function in Kaltura before 13.2.0 uses a hardcoded cookie secret to validate cookie signatures, which allows remote attackers to… | Patch early | 9.8 critical | 77.4% | 2017-09-19 |
| CVE-2020-8012 EXP | CA Unified Infrastructure Management (Nimsoft/UIM) 20.1, 20.3.x, and 9.20 and below contains a buffer overflow vulnerability in the robot (controller)… | Patch early | 9.8 critical | 77.4% | 2020-02-18 |
| CVE-2018-9059 EXP | Stack-based buffer overflow in Easy File Sharing (EFS) Web Server 7.2 allows remote attackers to execute arbitrary code via a malicious login request… | Patch early | 9.8 critical | 77.3% | 2018-04-20 |
| CVE-2014-8741 EXP | Directory traversal vulnerability in the GfdFileUploadServerlet servlet in Lexmark MarkVision Enterprise before 2.1 allows remote attackers to write t… | Patch early | 9.8 critical | 77.2% | 2020-01-27 |
| CVE-2016-0854 EXP | Unrestricted file upload vulnerability in the uploadImageCommon function in the UploadAjaxAction script in the WebAccess Dashboard Viewer in Advantech… | Patch early | 9.8 critical | 77% | 2016-01-15 |
| CVE-2017-9101 EXP | import.php (aka the Phonebook import feature) in PlaySMS 1.4 allows remote code execution via vectors involving the User-Agent HTTP header and PHP cod… | Patch early | 9.8 critical | 76.7% | 2017-05-21 |
| CVE-2018-14728 EXP | upload.php in Responsive FileManager 9.13.1 allows SSRF via the url parameter. | Patch early | 9.8 critical | 76.3% | 2018-08-03 |
| CVE-2022-2884 EXP | A vulnerability in GitLab CE/EE affecting all versions from 11.3.4 prior to 15.1.5, 15.2 to 15.2.3, 15.3 to 15.3 to 15.3.1 allows an an authenticated… | Patch early | 9.9 critical | 76.2% | 2022-10-17 |
| CVE-2018-9160 EXP | SickRage before v2018.03.09-1 includes cleartext credentials in HTTP responses. | Patch early | 9.8 critical | 76% | 2018-03-31 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt