CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
424,684 CVEs
1,779 on KEV
17,541 EPSS ≥ 10%
25,095 with exploits
synced 2026-11-12
1,491 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2017-10366 EXP | Vulnerability in the PeopleSoft Enterprise PT PeopleTools component of Oracle PeopleSoft Products (subcomponent: Performance Monitor). Supported versi… | Patch early | 9.8 critical | 43.5% | 2017-10-19 |
| CVE-2010-1205 EXP | Buffer overflow in pngpread.c in libpng before 1.2.44 and 1.4.x before 1.4.3, as used in progressive applications, might allow remote attackers to exe… | Patch early | 9.8 critical | 43.4% | 2010-06-30 |
| CVE-2017-11346 EXP | Zoho ManageEngine Desktop Central before build 100092 allows remote attackers to execute arbitrary code via vectors involving the upload of help desk… | Patch early | 9.8 critical | 43.3% | 2017-07-17 |
| CVE-2025-68664 EXP | LangChain is a framework for building agents and LLM-powered applications. Prior to versions 0.3.81 and 1.2.5, a serialization injection vulnerability… | Patch early | 9.3 critical | 42.9% | 2025-12-23 |
| CVE-2020-9374 EXP | On TP-Link TL-WR849N 0.9.1 4.16 devices, a remote command execution vulnerability in the diagnostics area can be exploited when an attacker sends spec… | Patch early | 9.8 critical | 42.7% | 2020-02-24 |
| CVE-2017-6553 EXP | Buffer Overflow in Quest One Identity Privilege Manager for Unix before 6.0.0.061 allows remote attackers to obtain full access to the policy server v… | Patch early | 9.8 critical | 42.3% | 2017-04-29 |
| CVE-2018-3811 EXP | SQL Injection vulnerability in the Oturia Smart Google Code Inserter plugin before 3.5 for WordPress allows unauthenticated attackers to execute SQL q… | Patch early | 9.8 critical | 42.3% | 2018-01-01 |
| CVE-2013-2573 EXP | A Command Injection vulnerability exists in the ap parameter to the /cgi-bin/mft/wireless_mft.cgi file in TP-Link IP Cameras TL-SC 3130, TL-SC 3130G,… | Patch early | 9.8 critical | 42.2% | 2020-01-29 |
| CVE-2018-1235 EXP | Dell EMC RecoverPoint versions prior to 5.1.2 and RecoverPoint for VMs versions prior to 5.1.1.3, contain a command injection vulnerability. An unauth… | Patch early | 9.8 critical | 42.2% | 2018-05-29 |
| CVE-2014-6436 EXP | Aztech ADSL DSL5018EN (1T1R), DSL705E, and DSL705EU devices improperly manage sessions, which allows remote attackers to bypass authentication in oppo… | Patch early | 9.8 critical | 42.1% | 2018-01-12 |
| CVE-2013-1595 EXP | A Buffer Overflow vulnerability exists in Vivotek PT7135 IP Camera 0300a and 0400a via a specially crafted packet in the Authorization header field se… | Patch early | 9.8 critical | 41.6% | 2020-01-24 |
| CVE-2026-4257 EXP | The Contact Form by Supsystic plugin for WordPress is vulnerable to Server-Side Template Injection (SSTI) leading to Remote Code Execution (RCE) in al… | Patch early | 9.8 critical | 41.5% | 2026-03-30 |
| CVE-2024-0132 EXP | NVIDIA Container Toolkit 1.16.1 or earlier contains a Time-of-check Time-of-Use (TOCTOU) vulnerability when used with default configuration where a sp… | Patch early | 9.0 critical | 40.8% | 2024-09-26 |
| CVE-2019-17240 EXP | bl-kernel/security.class.php in Bludit 3.9.2 allows attackers to bypass a brute-force protection mechanism by using many different forged X-Forwarded-… | Patch early | 9.8 critical | 40.7% | 2019-10-06 |
| CVE-2019-8050 EXP | Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015… | Patch early | 9.8 critical | 40.6% | 2019-08-20 |
| CVE-2015-4455 EXP | Unrestricted file upload vulnerability in includes/upload.php in the Aviary Image Editor Add-on For Gravity Forms plugin 3.0 beta for WordPress allows… | Patch early | 9.8 critical | 40.6% | 2017-05-23 |
| CVE-2021-45092 EXP | Thinfinity VirtualUI before 3.0 has functionality in /lab.html reachable by default that could allow IFRAME injection via the vpath parameter. | Patch early | 9.8 critical | 40.6% | 2021-12-16 |
| CVE-2013-1599 EXP | A Command Injection vulnerability exists in the /var/www/cgi-bin/rtpd.cgi script in D-Link IP Cameras DCS-3411/3430 firmware 1.02, DCS-5605/5635 1.01,… | Patch early | 9.8 critical | 40.4% | 2020-01-28 |
| CVE-2020-24217 EXP | An issue was discovered in the box application on HiSilicon based IPTV/H.264/H.265 video encoders. The file-upload endpoint does not enforce authentic… | Patch early | 9.8 critical | 40.3% | 2020-10-06 |
| CVE-2024-42640 EXP | angular-base64-upload prior to v0.1.21 is vulnerable to unauthenticated remote code execution via demo/server.php. Exploiting this vulnerability allow… | Patch early | 9.8 critical | 40.2% | 2024-10-11 |
| CVE-2019-10945 EXP | An issue was discovered in Joomla! before 3.9.5. The Media Manager component does not properly sanitize the folder parameter, allowing attackers to ac… | Patch early | 9.8 critical | 40% | 2019-04-10 |
| CVE-2019-7442 EXP | An XML external entity (XXE) vulnerability in the Password Vault Web Access (PVWA) of CyberArk Enterprise Password Vault <=10.7 allows remote attacker… | Patch early | 9.8 critical | 40% | 2019-05-08 |
| CVE-2019-7269 EXP | Linear eMerge 50P/5000P devices allow Authenticated Command Injection with root Code Execution. | Patch early | 9.8 critical | 40% | 2019-07-02 |
| CVE-2018-10088 EXP | Buffer overflow in XiongMai uc-httpd 1.0.0 has unspecified impact and attack vectors, a different vulnerability than CVE-2017-16725. | Patch early | 9.8 critical | 39.7% | 2018-06-08 |
| CVE-2023-2068 EXP | The File Manager Advanced Shortcode WordPress plugin through 2.3.2 does not adequately prevent uploading files with disallowed MIME types when using t… | Patch early | 9.8 critical | 39.6% | 2023-06-27 |
| CVE-2017-17968 EXP | A buffer overflow vulnerability in NetTransport.exe in NetTransport Download Manager 2.96L and earlier could allow remote HTTP servers to execute arbi… | Patch early | 9.8 critical | 39.4% | 2017-12-29 |
| CVE-2017-12943 EXP | D-Link DIR-600 Rev Bx devices with v2.x firmware allow remote attackers to read passwords via a model/__show_info.php?REQUIRE_FILE= absolute path trav… | Patch early | 9.8 critical | 39.2% | 2017-08-18 |
| CVE-2020-25494 EXP | Xinuos (formerly SCO) Openserver v5 and v6 allows attackers to execute arbitrary commands via shell metacharacters in outputform or toclevels paramete… | Patch early | 9.8 critical | 39.2% | 2020-12-18 |
| CVE-2018-5262 EXP | A stack-based buffer overflow in Flexense DiskBoss 8.8.16 and earlier allows unauthenticated remote attackers to execute arbitrary code in the context… | Patch early | 9.8 critical | 39.1% | 2018-01-12 |
| CVE-2018-17440 EXP | An issue was discovered on D-Link Central WiFi Manager before v 1.03r0100-Beta1. They expose an FTP server that serves by default on port 9000 and has… | Patch early | 9.8 critical | 38.5% | 2018-10-08 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt