CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
398,503 CVEs
1,726 on KEV
17,265 EPSS ≥ 10%
25,086 with exploits
synced 2026-09-27
1,485 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2022-32429 EXP | An authentication-bypass issue in the component http://MYDEVICEIP/cgi-bin-sdb/ExportSettings.sh of Mega System Technologies Inc MSNSwitch MNT.2408 all… | Patch early | 9.8 critical | 75.6% | 2022-08-10 |
| CVE-2019-12255 EXP | Wind River VxWorks has a Buffer Overflow in the TCP component (issue 1 of 4). This is a IPNET security vulnerability: TCP Urgent Pointer = 0 that lead… | Patch early | 9.8 critical | 75.3% | 2019-08-09 |
| CVE-2022-23178 EXP | An issue was discovered on Crestron HD-MD4X2-4K-E 1.0.0.2159 devices. When the administrative web interface of the HDMI switcher is accessed unauthent… | Patch early | 9.8 critical | 75.2% | 2022-01-15 |
| CVE-2015-2794 EXP | The installation wizard in DotNetNuke (DNN) before 7.4.1 allows remote attackers to reinstall the application and gain SuperUser access via a direct r… | Patch early | 9.8 critical | 75.1% | 2017-02-06 |
| CVE-2019-20215 EXP | D-Link DIR-859 1.05 and 1.06B01 Beta01 devices allow remote attackers to execute arbitrary OS commands via a urn: to the M-SEARCH method in ssdpcgi()… | Patch early | 9.8 critical | 75.1% | 2020-01-29 |
| CVE-2013-0803 EXP | A PHP File Upload Vulnerability exists in PolarBear CMS 2.5 via upload.php, which could let a malicious user execute arbitrary code. | Patch early | 9.8 critical | 75% | 2020-02-11 |
| CVE-2018-16167 EXP | LogonTracer 1.2.0 and earlier allows remote attackers to execute arbitrary OS commands via unspecified vectors. | Patch early | 9.8 critical | 74.9% | 2019-01-09 |
| CVE-2023-6019 EXP | A command injection existed in Ray's cpu_profile URL parameter allowing attackers to execute os commands on the system running the ray dashboard remot… | Patch early | 9.8 critical | 74.6% | 2023-11-16 |
| CVE-2020-35848 EXP | Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php newpassword function. | Patch early | 9.8 critical | 74.6% | 2020-12-30 |
| CVE-2017-8046 EXP | Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay SR1) and Spri… | Patch early | 9.8 critical | 74.5% | 2018-01-04 |
| CVE-2013-7390 EXP | Unrestricted file upload vulnerability in AgentLogUploadServlet in ManageEngine DesktopCentral 7.x and 8.0.0 before build 80293 allows remote attacker… | Patch early | 9.8 critical | 74.5% | 2020-01-27 |
| CVE-2016-1287 EXP | Buffer overflow in the IKEv1 and IKEv2 implementations in Cisco ASA Software before 8.4(7.30), 8.7 before 8.7(1.18), 9.0 before 9.0(4.38), 9.1 before… | Patch early | 9.8 critical | 74.2% | 2016-02-11 |
| CVE-2015-9266 EXP | The web management interface of Ubiquiti airMAX, airFiber, airGateway and EdgeSwitch XP (formerly TOUGHSwitch) allows an unauthenticated attacker to u… | Patch early | 9.8 critical | 74% | 2018-09-05 |
| CVE-2013-2010 EXP | WordPress W3 Total Cache Plugin 0.9.2.8 has a Remote PHP Code Execution Vulnerability | Patch early | 9.8 critical | 73.9% | 2020-02-12 |
| CVE-2020-17456 EXP | SEOWON INTECH SLC-130 And SLR-120S devices allow Remote Code Execution via the ipAddr parameter to the system_log.cgi page. | Patch early | 9.8 critical | 73.6% | 2020-08-20 |
| CVE-2015-8249 EXP | The FileUploadServlet class in ManageEngine Desktop Central 9 before build 91093 allows remote attackers to upload and execute arbitrary files via the… | Patch early | 9.8 critical | 73.6% | 2017-09-28 |
| CVE-2020-24881 EXP | SSRF exists in osTicket before 1.14.3, where an attacker can add malicious file to server or perform port scanning. | Patch early | 9.8 critical | 73.4% | 2020-11-02 |
| CVE-2017-17560 EXP | An issue was discovered on Western Digital MyCloud PR4100 2.30.172 devices. The web administration component, /web/jquery/uploader/multi_uploadify.php… | Patch early | 9.8 critical | 73.4% | 2017-12-12 |
| CVE-2020-11698 EXP | An issue was discovered in Titan SpamTitan 7.07. Improper input sanitization of the parameter community on the page snmp-x.php would allow a remote at… | Patch early | 9.8 critical | 73.2% | 2020-09-17 |
| CVE-2017-11467 EXP | OrientDB through 2.2.22 does not enforce privilege requirements during "where" or "fetchplan" or "order by" use, which allows remote attackers to exec… | Patch early | 9.8 critical | 73.1% | 2017-07-20 |
| CVE-2018-20526 EXP | Roxy Fileman 1.4.5 allows unrestricted file upload in upload.php. | Patch early | 9.8 critical | 73.1% | 2019-03-21 |
| CVE-2021-24946 EXP | The Modern Events Calendar Lite WordPress plugin before 6.1.5 does not sanitise and escape the time parameter before using it in a SQL statement in th… | Patch early | 9.8 critical | 72.8% | 2021-12-13 |
| CVE-2017-6326 EXP | The Symantec Messaging Gateway can encounter an issue of remote code execution, which describes a situation whereby an individual may obtain the abili… | Patch early | 10.0 critical | 72.8% | 2017-06-26 |
| CVE-2014-9618 EXP | The Client Filter Admin portal in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to bypass authenticatio… | Patch early | 9.8 critical | 72.7% | 2017-09-19 |
| CVE-2021-4045 EXP | TP-Link Tapo C200 IP camera, on its 1.1.15 firmware version and below, is affected by an unauthenticated RCE vulnerability, present in the uhttpd bina… | Patch early | 9.8 critical | 72.4% | 2022-03-10 |
| CVE-2023-3460 EXP | The Ultimate Member WordPress plugin before 2.6.7 does not prevent visitors from creating user accounts with arbitrary capabilities, effectively allow… | Patch early | 9.8 critical | 72.3% | 2023-07-04 |
| CVE-2016-1560 EXP | ExaGrid appliances with firmware before 4.8 P26 have a default password of (1) inflection for the root shell account and (2) support for the support a… | Patch early | 9.8 critical | 72.3% | 2017-04-21 |
| CVE-2019-16724 EXP | File Sharing Wizard 1.5.0 allows a remote attacker to obtain arbitrary code execution by exploiting a Structured Exception Handler (SEH) based buffer… | Patch early | 9.8 critical | 72.2% | 2019-09-24 |
| CVE-2021-40859 EXP | Backdoors were discovered in Auerswald COMpact 5500R 7.8A and 8.0B devices, that allow attackers with access to the web based management application f… | Patch early | 9.8 critical | 72% | 2021-12-07 |
| CVE-2018-7251 EXP | An issue was discovered in config/error.php in Anchor 0.12.3. The error log is exposed at an errors.log URI, and contains MySQL credentials if a MySQL… | Patch early | 9.8 critical | 71.8% | 2018-02-19 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt