CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
424,330 CVEs
1,779 on KEV
17,541 EPSS ≥ 10%
25,094 with exploits
synced 2026-11-11
25,094 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2010-0840 KEV EXP | Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, and 1.4.2_25 a… | Patch first | 9.8 critical | 96.3% | 2010-04-01 |
| CVE-2019-20085 KEV EXP | TVT NVMS-1000 devices allow GET /.. Directory Traversal | Patch first | 7.5 high | 96.1% | 2019-12-30 |
| CVE-2022-24112 KEV EXP | An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX (… | Patch first | 9.8 critical | 96.1% | 2022-02-11 |
| CVE-2018-20250 KEV EXP | In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field of the ACE format (in UNACEV2.d… | Patch first | 7.8 high | 96% | 2019-02-05 |
| CVE-2018-14847 KEV EXP | MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated attackers to write arbitrary f… | Patch first | 9.1 critical | 96% | 2018-08-02 |
| CVE-2019-1652 KEV EXP | A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an authenticate… | Patch first | 7.2 high | 95.9% | 2019-01-24 |
| CVE-2020-5847 KEV EXP | Unraid through 6.8.0 allows Remote Code Execution. | Patch first | 9.8 critical | 95.8% | 2020-03-16 |
| CVE-2020-1147 KEV EXP | A remote code execution vulnerability exists in .NET Framework, Microsoft SharePoint, and Visual Studio when the software fails to check the source ma… | Patch first | 7.8 high | 95.8% | 2020-07-14 |
| CVE-2026-87902 KEV EXP | An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active the… | Patch first | 8.1 high | 95.8% | 2026-09-22 |
| CVE-2016-0752 KEV EXP | Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x befo… | Patch first | 7.5 high | 95.5% | 2016-02-16 |
| CVE-2015-0313 KEV EXP | Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.4… | Patch first | 9.8 critical | 95.3% | 2015-02-02 |
| CVE-2025-57819 KEV EXP | FreePBX is an open-source web-based graphical user interface. FreePBX 15, 16, and 17 endpoints are vulnerable due to insufficiently sanitized user-sup… | Patch first | 9.8 critical | 95.2% | 2025-08-28 |
| CVE-2015-4852 KEV EXP | The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to execute arbitrary commands… | Patch first | 9.8 critical | 95% | 2015-11-18 |
| CVE-2019-12989 KEV EXP | Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 allow SQL Injection. | Patch first | 9.8 critical | 95% | 2019-07-16 |
| CVE-2021-4034 KEV EXP | A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivilege… | Patch first | 7.8 high | 94.9% | 2022-01-28 |
| CVE-2014-6332 KEV EXP | OleAut32.dll in OLE in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1… | Patch first | 8.8 high | 94.9% | 2014-11-11 |
| CVE-2017-9822 KEV EXP | DNN (aka DotNetNuke) before 9.1.1 has Remote Code Execution via a cookie, aka "2017-08 (Critical) Possible remote code execution on DNN sites." | Patch first | 8.8 high | 94.8% | 2017-07-20 |
| CVE-2018-14933 KEV EXP | upgrade_handle.php on NUUO NVRmini devices allows Remote Command Execution via shell metacharacters in the uploaddir parameter for a writeuploaddir co… | Patch first | 9.8 critical | 94.8% | 2018-08-04 |
| CVE-2024-51378 KEV EXP | getresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before 1c0c6cb allows remote attackers to bypass authentication and ex… | Patch first | 10.0 critical | 94.7% | 2024-10-29 |
| CVE-2023-7028 KEV EXP | An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.3 prior to 16.3.7, 16.4 prior… | Patch first | 10.0 critical | 94.5% | 2024-01-12 |
| CVE-2016-4117 KEV EXP | Adobe Flash Player 21.0.0.226 and earlier allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in May 2… | Patch first | 9.8 critical | 94.3% | 2016-05-11 |
| CVE-2017-1000486 KEV EXP | Primetek Primefaces 5.x is vulnerable to a weak encryption flaw resulting in remote code execution | Patch first | 9.8 critical | 94.1% | 2018-01-03 |
| CVE-2016-0189 KEV EXP | The Microsoft (1) JScript 5.8 and (2) VBScript 5.7 and 5.8 engines, as used in Internet Explorer 9 through 11 and other products, allow remote attacke… | Patch first | 7.5 high | 94.1% | 2016-05-11 |
| CVE-2025-47812 KEV EXP | In Wing FTP Server before 7.4.4. the user and admin web interfaces mishandle '\0' bytes, ultimately allowing injection of arbitrary Lua code into user… | Patch first | 10.0 critical | 93.9% | 2025-07-10 |
| CVE-2013-0625 KEV EXP | Adobe ColdFusion 9.0, 9.0.1, and 9.0.2, when a password is not configured, allows remote attackers to bypass authentication and possibly execute arbit… | Patch first | 9.8 critical | 93.8% | 2013-01-09 |
| CVE-2012-1723 KEV EXP | Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, 5 update… | Patch first | 9.8 critical | 93.6% | 2012-06-16 |
| CVE-2017-0143 KEV EXP | The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Wind… | Patch first | 8.8 high | 93.3% | 2017-03-17 |
| CVE-2020-5849 KEV EXP | Unraid 6.8.0 allows authentication bypass. | Patch first | 7.5 high | 93.2% | 2020-03-16 |
| CVE-2013-0632 KEV EXP | administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and possibly execute arbitrary code b… | Patch first | 9.8 critical | 93.1% | 2013-01-17 |
| CVE-2016-4437 KEV EXP | Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code… | Patch first | 9.8 critical | 93% | 2016-06-07 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt