CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
424,684 CVEs
1,779 on KEV
17,541 EPSS ≥ 10%
25,095 with exploits
synced 2026-11-12
1,779 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2026-34486 KEV | Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor.… | Patch first | 7.5 high | 98.5% | 2026-04-09 |
| CVE-2021-21311 KEV | Adminer is an open-source database management in a single PHP file. In adminer from version 4.0.0 and before 4.7.9 there is a server-side request forg… | Patch first | 7.2 high | 98.5% | 2021-02-11 |
| CVE-2025-0108 KEV | An authentication bypass in the Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web inter… | Patch first | 9.1 critical | 98.5% | 2025-02-12 |
| CVE-2023-48788 KEV | A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiClientEMS version 7.2.0 through 7.2.2, FortiCl… | Patch first | 9.8 critical | 98.4% | 2024-03-12 |
| CVE-2022-21587 KEV | Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: Upload). Supported versions that are af… | Patch first | 9.8 critical | 98.3% | 2022-10-18 |
| CVE-2018-1000861 KEV | A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in stapler/core/src/main… | Patch first | 9.8 critical | 98.3% | 2018-12-10 |
| CVE-2023-20887 KEV | Aria Operations for Networks contains a command injection vulnerability. A malicious actor with network access to VMware Aria Operations for Networks… | Patch first | 9.8 critical | 98.3% | 2023-06-07 |
| CVE-2026-34197 KEV | Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ. Apache… | Patch first | 8.8 high | 98.3% | 2026-04-07 |
| CVE-2022-26138 KEV | The Atlassian Questions For Confluence app for Confluence Server and Data Center creates a Confluence user account in the confluence-users group with… | Patch first | 9.8 critical | 98.2% | 2022-07-20 |
| CVE-2024-12987 KEV | A vulnerability, which was classified as critical, was found in DrayTek Vigor2960 and Vigor300B 1.5.1.4. Affected is an unknown function of the file /… | Patch first | 7.3 high | 98.2% | 2024-12-27 |
| CVE-2026-72898 KEV | Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator access t… | Patch first | 10.0 critical | 98.2% | 2026-08-10 |
| CVE-2021-33766 KEV | Microsoft Exchange Server Information Disclosure Vulnerability | Patch first | 7.3 high | 98.2% | 2021-07-14 |
| CVE-2020-6207 KEV | SAP Solution Manager (User Experience Monitoring), version- 7.2, due to Missing Authentication Check does not perform any authentication for a service… | Patch first | 9.8 critical | 98.1% | 2020-03-10 |
| CVE-2019-5544 KEV | OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. VMware has evaluated the severity of this issue to be in the Criti… | Patch first | 9.8 critical | 98.1% | 2019-12-06 |
| CVE-2021-39144 KEV | XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker has suffic… | Patch first | 8.5 high | 98.1% | 2021-08-23 |
| CVE-2026-31431 KEV | In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit… | Patch first | 7.8 high | 98.1% | 2026-04-22 |
| CVE-2024-3272 KEV | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as very critical, has been found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-3… | Patch first | 9.8 critical | 98.1% | 2024-04-04 |
| CVE-2023-25717 KEV | Ruckus Wireless Admin through 10.4 allows Remote Code Execution via an unauthenticated HTTP GET Request, as demonstrated by a /forms/doLogin?login_use… | Patch first | 9.8 critical | 98.1% | 2023-02-13 |
| CVE-2021-35395 KEV | Realtek Jungle SDK version v2.x up to v3.4.14B provides an HTTP web server exposing a management interface that can be used to configure the access po… | Patch first | 9.8 critical | 98.1% | 2021-08-16 |
| CVE-2020-1956 KEV | Apache Kylin 2.3.0, and releases up to 2.6.5 and 3.0.1 has some restful apis which will concatenate os command with the user input string, a user is l… | Patch first | 8.8 high | 98% | 2020-05-22 |
| CVE-2018-19410 KEV | PRTG Network Monitor before 18.2.40.1683 allows remote unauthenticated attackers to create users with read-write privileges (including administrator).… | Patch first | 9.8 critical | 97.9% | 2018-11-21 |
| CVE-2023-25280 KEV | OS Command injection vulnerability in D-Link DIR820LA1_FW105B03 allows attackers to escalate privileges to root via a crafted payload with the ping_ad… | Patch first | 9.8 critical | 97.9% | 2023-03-16 |
| CVE-2021-40444 KEV | Microsoft is investigating reports of a remote code execution vulnerability in MSHTML that affects Microsoft Windows. Microsoft is aware of targeted a… | Patch first | 8.8 high | 97.8% | 2021-09-15 |
| CVE-2021-45382 KEV | A Remote Command Execution (RCE) vulnerability exists in all series H/W revisions D-link DIR-810L, DIR-820L/LW, DIR-826L, DIR-830L, and DIR-836L route… | Patch first | 9.8 critical | 97.8% | 2022-02-17 |
| CVE-2021-36380 KEV | Sunhillo SureLine before 8.7.0.1.1 allows Unauthenticated OS Command Injection via shell metacharacters in ipAddr or dnsAddr /cgi/networkDiag.cgi. | Patch first | 9.8 critical | 97.8% | 2021-08-13 |
| CVE-2026-21643 KEV | An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiClientEMS 7.4.4 may allow an un… | Patch first | 9.8 critical | 97.7% | 2026-02-06 |
| CVE-2020-14883 KEV | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.… | Patch first | 7.2 high | 97.7% | 2020-10-21 |
| CVE-2025-20281 KEV | A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the unde… | Patch first | 10.0 critical | 97.6% | 2025-06-25 |
| CVE-2025-34028 KEV | The Commvault Command Center Innovation Release allows an unauthenticated actor to upload ZIP files that represent install packages that, when expande… | Patch first | 10.0 critical | 97.6% | 2025-04-22 |
| CVE-2020-25078 KEV | An issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices. The unauthenticated /config/getuser endpoint all… | Patch first | 7.5 high | 97.5% | 2020-09-02 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt