CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
424,671 CVEs
1,779 on KEV
17,541 EPSS ≥ 10%
25,095 with exploits
synced 2026-11-12
925 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2006-2492 KEV | Buffer overflow in Microsoft Word in Office 2000 SP3, Office XP SP3, Office 2003 Sp1 and SP2, and Microsoft Works Suites through 2006, allows user-ass… | Patch first | 8.8 high | 48.1% | 2006-05-20 |
| CVE-2026-28318 KEV | SolarWinds Serv-U is susceptible to specially crafted POST requests that crash the Serv-U service without authentication using Content-Encoding: defla… | Patch first | 7.5 high | 48% | 2026-06-04 |
| CVE-2021-40407 KEV | An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102. At [1] or [2], base… | Patch first | 7.2 high | 47.6% | 2022-01-28 |
| CVE-2025-0411 KEV | 7-Zip Mark-of-the-Web Bypass Vulnerability. This vulnerability allows remote attackers to bypass the Mark-of-the-Web protection mechanism on affected… | Patch first | 7.0 high | 47.6% | 2025-01-25 |
| CVE-2014-4123 KEV | Microsoft Internet Explorer 7 through 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation of Privil… | Patch first | 8.8 high | 47.1% | 2014-10-15 |
| CVE-2017-16651 KEV | Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary files on the host's filesystem, in… | Patch first | 7.8 high | 45.7% | 2017-11-09 |
| CVE-2024-29988 KEV | SmartScreen Prompt Security Feature Bypass Vulnerability | Patch first | 8.8 high | 45.2% | 2024-04-09 |
| CVE-2017-6737 KEV | A vulnerability in the SNMP implementation of could allow an authenticated, remote attacker to cause a reload of the affected system or to remotely ex… | Patch first | 8.8 high | 45% | 2017-07-17 |
| CVE-2014-9163 KEV | Stack-based buffer overflow in Adobe Flash Player before 13.0.0.259 and 14.x and 15.x before 15.0.0.246 on Windows and OS X and before 11.2.202.425 on… | Patch first | 7.8 high | 44.9% | 2014-12-10 |
| CVE-2015-2425 KEV | Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web si… | Patch first | 8.8 high | 44.7% | 2015-07-14 |
| CVE-2023-36874 KEV | Windows Error Reporting Service Elevation of Privilege Vulnerability | Patch first | 7.8 high | 44.4% | 2023-07-11 |
| CVE-2019-1579 KEV | Remote Code Execution in PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11-h1 and earlier, and PAN-OS 8.1.2 and earlier with GlobalProtect Portal or GlobalProt… | Patch first | 8.1 high | 44.2% | 2019-07-19 |
| CVE-2007-0671 KEV | Unspecified vulnerability in Microsoft Excel 2000, XP, 2003, and 2004 for Mac, and possibly other Office products, allows remote user-assisted attacke… | Patch first | 8.8 high | 44.1% | 2007-02-03 |
| CVE-2026-18556 KEV | Authentication bypass using an alternate path or channel vulnerability in N-able N-central allows Authentication Bypass. This issue affects N-central… | Patch first | 7.4 high | 43.9% | 2026-08-01 |
| CVE-2014-100005 KEV | Multiple cross-site request forgery (CSRF) vulnerabilities in D-Link DIR-600 router (rev. Bx) with firmware before 2.17b02 allow remote attackers to h… | Patch first | 8.0 high | 43.5% | 2015-01-13 |
| CVE-2021-42292 KEV | Microsoft Excel Security Feature Bypass Vulnerability | Patch first | 7.8 high | 43% | 2021-11-10 |
| CVE-2009-0238 KEV | Microsoft Office Excel 2000 SP3, 2002 SP3, 2003 SP3, and 2007 SP1; Excel Viewer 2003 Gold and SP3; Excel Viewer; Compatibility Pack for Word, Excel, a… | Patch first | 8.8 high | 42.9% | 2009-02-25 |
| CVE-2020-0787 KEV | An elevation of privilege vulnerability exists when the Windows Background Intelligent Transfer Service (BITS) improperly handles symbolic links, aka… | Patch first | 7.8 high | 42.5% | 2020-03-12 |
| CVE-2024-41710 KEV | A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, including the 6970 Conference Unit, through R6.4.0.HF1 (R6.4.0.136… | Patch first | 7.2 high | 41.6% | 2024-08-12 |
| CVE-2023-33538 KEV | TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 was discovered to contain a command injection vulnerability via the component /userRpm/… | Patch first | 8.8 high | 41.6% | 2023-06-07 |
| CVE-2024-38178 KEV | Scripting Engine Memory Corruption Vulnerability | Patch first | 7.5 high | 41.4% | 2024-08-13 |
| CVE-2023-4762 KEV | Type Confusion in V8 in Google Chrome prior to 116.0.5845.179 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium s… | Patch first | 8.8 high | 41.4% | 2023-09-05 |
| CVE-2011-1823 KEV | The vold volume manager daemon on Android 3.0 and 2.x before 2.3.4 trusts messages that are received from a PF_NETLINK socket, which allows local user… | Patch first | 7.8 high | 41.4% | 2011-06-09 |
| CVE-2025-9377 KEV | The authenticated remote command execution (RCE) vulnerability exists in the Parental Control page on TP-Link Archer C7(EU) V2 and TL-WR841N/ND(MS) V… | Patch first | 7.2 high | 41.3% | 2025-08-29 |
| CVE-2021-22894 KEV | A buffer overflow vulnerability exists in Pulse Connect Secure before 9.1R11.4 allows a remote authenticated attacker to execute arbitrary code as the… | Patch first | 8.8 high | 41.3% | 2021-05-27 |
| CVE-2022-21999 KEV | Windows Print Spooler Elevation of Privilege Vulnerability | Patch first | 7.8 high | 41% | 2022-02-09 |
| CVE-2023-2033 KEV | Type confusion in V8 in Google Chrome prior to 112.0.5615.121 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page… | Patch first | 8.8 high | 40.6% | 2023-04-14 |
| CVE-2017-5030 KEV | Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.2987.108 for Android allowed a… | Patch first | 8.8 high | 40.6% | 2017-04-24 |
| CVE-2025-20352 KEV | A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS Software and Cisco IOS XE Software could allow the following:… | Patch first | 7.7 high | 40.6% | 2025-09-24 |
| CVE-2015-0666 KEV | Directory traversal vulnerability in the fmserver servlet in Cisco Prime Data Center Network Manager (DCNM) before 7.1(1) allows remote attackers to r… | Patch first | 7.5 high | 40.4% | 2015-04-03 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt