CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
424,657 CVEs
1,779 on KEV
17,541 EPSS ≥ 10%
25,095 with exploits
synced 2026-11-12
925 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2024-43572 KEV | Microsoft Management Console Remote Code Execution Vulnerability | Patch first | 7.8 high | 66.7% | 2024-10-08 |
| CVE-2013-0631 KEV | Adobe ColdFusion 9.0, 9.0.1, and 9.0.2 allows attackers to obtain sensitive information via unspecified vectors, as exploited in the wild in January 2… | Patch first | 7.5 high | 66.4% | 2013-01-09 |
| CVE-2021-36942 KEV | Windows LSA Spoofing Vulnerability | Patch first | 7.5 high | 66% | 2021-08-12 |
| CVE-2014-1812 KEV | The Group Policy implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, and Windows… | Patch first | 8.8 high | 65.1% | 2014-05-14 |
| CVE-2020-1020 KEV | A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles a specially-crafted m… | Patch first | 8.8 high | 65% | 2020-04-15 |
| CVE-2021-27877 KEV | An issue was discovered in Veritas Backup Exec before 21.2. It supports multiple authentication schemes: SHA authentication is one of these. This auth… | Patch first | 8.2 high | 64.9% | 2021-03-01 |
| CVE-2021-30551 KEV | Type confusion in V8 in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | Patch first | 8.8 high | 64.7% | 2021-06-15 |
| CVE-2016-7256 KEV | atmfd.dll in the Windows font library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2… | Patch first | 8.8 high | 64.6% | 2016-11-10 |
| CVE-2024-57728 KEV | SimpleHelp remote support software v5.5.7 and before allows admin users to upload arbitrary files anywhere on the file system by uploading a crafted z… | Patch first | 7.2 high | 64.5% | 2025-01-15 |
| CVE-2023-29552 KEV | The Service Location Protocol (SLP, RFC 2608) allows an unauthenticated, remote attacker to register arbitrary services. This could allow the attacker… | Patch first | 7.5 high | 64% | 2023-04-25 |
| CVE-2023-35081 KEV | A path traversal vulnerability in Ivanti EPMM versions (11.10.x < 11.10.0.3, 11.9.x < 11.9.1.2 and 11.8.x < 11.8.1.2) allows an authenticated adminis… | Patch first | 7.2 high | 63.6% | 2023-08-03 |
| CVE-2021-30632 KEV | Out of bounds write in V8 in Google Chrome prior to 93.0.4577.82 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML p… | Patch first | 8.8 high | 63.2% | 2021-10-08 |
| CVE-2018-8373 KEV | A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scripting Engin… | Patch first | 7.5 high | 61.8% | 2018-08-15 |
| CVE-2026-21510 KEV | Protection mechanism failure in Windows Shell allows an unauthorized attacker to bypass a security feature over a network. | Patch first | 8.8 high | 61.2% | 2026-02-10 |
| CVE-2025-58360 KEV | GeoServer is an open source server that allows users to share and edit geospatial data. From version 2.26.0 to before 2.26.2 and before 2.25.6, an XML… | Patch first | 8.2 high | 61.2% | 2025-11-25 |
| CVE-2026-33634 KEV | Trivy is a security scanner. On March 19, 2026, a threat actor used compromised credentials to publish a malicious Trivy v0.69.4 release, force-push 7… | Patch first | 8.8 high | 60.4% | 2026-03-23 |
| CVE-2025-62593 KEV | Ray is an AI compute engine. Prior to version 2.52.0, developers working with Ray as a development tool can be exploited via a critical RCE vulnerabil… | Patch first | 8.8 high | 60.2% | 2025-11-26 |
| CVE-2014-4148 KEV | win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Wind… | Patch first | 8.8 high | 59.9% | 2014-10-15 |
| CVE-2009-0563 KEV | Stack-based buffer overflow in Microsoft Office Word 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; Microsoft Office for Mac 2004 and 2008; Open XML File F… | Patch first | 7.8 high | 59.6% | 2009-06-10 |
| CVE-2017-11774 KEV | Microsoft Outlook 2010 SP2, Outlook 2013 SP1 and RT SP1, and Outlook 2016 allow an attacker to execute arbitrary commands, due to how Microsoft Office… | Patch first | 7.8 high | 59.6% | 2017-10-13 |
| CVE-2023-21608 KEV | Adobe Acrobat Reader versions 22.003.20282 (and earlier), 22.003.20281 (and earlier) and 20.005.30418 (and earlier) are affected by a Use After Free v… | Patch first | 7.8 high | 59.4% | 2023-01-18 |
| CVE-2021-33742 KEV | Windows MSHTML Platform Remote Code Execution Vulnerability | Patch first | 7.5 high | 59.4% | 2021-06-08 |
| CVE-2023-21529 KEV | Microsoft Exchange Server Remote Code Execution Vulnerability | Patch first | 8.8 high | 59.3% | 2023-02-14 |
| CVE-2022-21882 KEV | Win32k Elevation of Privilege Vulnerability | Patch first | 7.0 high | 59.2% | 2022-01-11 |
| CVE-2016-7262 KEV | Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Office Compatibility Pack SP3, and Excel Viewer allow user-as… | Patch first | 7.8 high | 58.8% | 2016-12-20 |
| CVE-2010-2572 KEV | Buffer overflow in Microsoft PowerPoint 2002 SP3 and 2003 SP3 allows remote attackers to execute arbitrary code via a crafted PowerPoint 95 document,… | Patch first | 7.8 high | 58.6% | 2010-11-10 |
| CVE-2024-9380 KEV | An OS command injection vulnerability in the admin web console of Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin pr… | Patch first | 7.2 high | 58.3% | 2024-10-08 |
| CVE-2023-32434 KEV | An integer overflow was addressed with improved input validation. This issue is fixed in watchOS 9.5.2, macOS Big Sur 11.7.8, iOS 15.7.7 and iPadOS 15… | Patch first | 7.8 high | 58.2% | 2023-06-23 |
| CVE-2023-6549 KEV | Improper Restriction of Operations within the Bounds of a Memory Buffer in NetScaler ADC and NetScaler Gateway allows Unauthenticated Denial of Servic… | Patch first | 8.2 high | 57.6% | 2024-01-17 |
| CVE-2016-7193 KEV | Microsoft Word 2007 SP2, Office 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Word for Mac 2011, Word 2016 for Mac, Office Compatibility Pack… | Patch first | 7.8 high | 57.6% | 2016-10-14 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt