CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
424,700 CVEs
1,779 on KEV
17,541 EPSS ≥ 10%
25,095 with exploits
synced 2026-11-12
634 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2026-104286 KEV | An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7… | Patch first | 9.8 critical | 4.6% | 2026-10-01 |
| CVE-2020-2021 KEV | When Security Assertion Markup Language (SAML) authentication is enabled and the 'Validate Identity Provider Certificate' option is disabled (unchecke… | Patch first | 10.0 critical | 4.4% | 2020-06-29 |
| CVE-2021-27101 KEV | Accellion FTA 9_12_370 and earlier is affected by SQL injection via a crafted Host header in a request to document_root.html. The fixed version is FTA… | Patch first | 9.8 critical | 4.3% | 2021-02-16 |
| CVE-2022-26501 KEV | Veeam Backup & Replication 10.x and 11.x has Incorrect Access Control (issue 1 of 2). | Patch first | 9.8 critical | 4.1% | 2022-03-17 |
| CVE-2025-24201 KEV | An out-of-bounds write issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in Safari 18.3.1, iOS 15.8.4 and… | Patch first | 10.0 critical | 3.8% | 2025-03-11 |
| CVE-2024-9537 KEV | ScienceLogic SL1 (formerly EM7) is affected by an unspecified vulnerability involving an unspecified third-party component packaged with SL1. The vuln… | Patch first | 9.8 critical | 3.8% | 2024-10-18 |
| CVE-2026-16232 KEV | An authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote attacker to obtain an applicatio… | Patch first | 9.8 critical | 3.5% | 2026-07-22 |
| CVE-2025-42599 KEV | Active! mail 6 BuildInfo: 6.60.05008561 and earlier contains a stack-based buffer overflow vulnerability. Receiving a specially crafted request create… | Patch first | 9.8 critical | 3.4% | 2025-04-18 |
| CVE-2025-39682 KEV | In the Linux kernel, the following vulnerability has been resolved: tls: fix handling of zero-length records on the rx_list Each recvmsg() call must… | Patch first | 9.8 critical | 3.3% | 2025-09-05 |
| CVE-2026-45321 KEV | On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The… | Patch first | 9.6 critical | 3.3% | 2026-05-12 |
| CVE-2026-50522 KEV | Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network. | Patch first | 9.8 critical | 3% | 2026-07-14 |
| CVE-2025-61932 KEV | Lanscope Endpoint Manager (On-Premises) (Client program (MR) and Detection agent (DA)) improperly verifies the origin of incoming requests, allowing a… | Patch first | 9.8 critical | 2.8% | 2025-10-20 |
| CVE-2020-16017 KEV | Use after free in site isolation in Google Chrome prior to 86.0.4240.198 allowed a remote attacker who had compromised the renderer process to potenti… | Patch first | 9.6 critical | 2.7% | 2021-01-08 |
| CVE-2022-42948 KEV | Cobalt Strike 4.7.1 fails to properly escape HTML tags when they are displayed on Swing components. By injecting crafted HTML code, it is possible to… | Patch first | 9.8 critical | 2.7% | 2023-03-24 |
| CVE-2023-29492 KEV | Novi Survey before 8.9.43676 allows remote attackers to execute arbitrary code on the server in the context of the service account. This does not prov… | Patch first | 9.8 critical | 2.7% | 2023-04-11 |
| CVE-2025-32975 KEV | Quest KACE Systems Management Appliance (SMA) 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341 (Patch 5),… | Patch first | 10.0 critical | 2.5% | 2025-06-24 |
| CVE-2026-116779 KEV | FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that… | Patch first | 9.8 critical | 2.5% | 2026-11-05 |
| CVE-2022-26486 KEV | An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape. We have had reports of attacks in the… | Patch first | 9.6 critical | 2.4% | 2022-12-22 |
| CVE-2025-53521 KEV | When a BIG-IP APM access policy is configured on a virtual server, specific malicious traffic can lead to Remote Code Execution (RCE). Note: Softwa… | Patch first | 9.8 critical | 2.3% | 2025-10-15 |
| CVE-2026-49869 KEV | Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, AuthenticationFilter in Kestra OSS uses request.getPath().e… | Patch first | 10.0 critical | 2.1% | 2026-06-26 |
| CVE-2023-6448 KEV | Unitronics VisiLogic before version 9.9.00, used in Vision and Samba PLCs and HMIs, uses a default administrative password. An unauthenticated attacke… | Patch first | 9.8 critical | 2.1% | 2023-12-05 |
| CVE-2026-48027 KEV | Nx Console is the user interface for Nx & Lerna. On 19 May 2026, a malicious version of Nx Console, 18.95.0, was published at 12:30 PM UTC and removed… | Patch first | 9.8 critical | 1.9% | 2026-05-27 |
| CVE-2026-16812 KEV | VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and… | Patch first | 10.0 critical | 1.8% | 2026-07-27 |
| CVE-2026-72530 KEV | A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, a… | Patch first | 9.0 critical | 1.7% | 2026-08-19 |
| CVE-2025-22224 KEV | VMware ESXi, and Workstation contain a TOCTOU (Time-of-Check Time-of-Use) vulnerability that leads to an out-of-bounds write. A malicious actor with l… | Patch first | 9.3 critical | 1.6% | 2025-03-04 |
| CVE-2026-72529 KEV | A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, a… | Patch first | 9.8 critical | 1.5% | 2026-08-19 |
| CVE-2026-8398 KEV | A supply chain attack compromised the official installation packages of DAEMON Tools Lite (Windows versions 12.5.0.2421 through 12.5.0.2434), distribu… | Patch first | 9.8 critical | 1.5% | 2026-05-15 |
| CVE-2026-93952 KEV | VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and… | Patch first | 10.0 critical | 1.4% | 2026-09-22 |
| CVE-2025-59374 KEV | "UNSUPPORTED WHEN ASSIGNED" Certain versions of the ASUS Live Update client were distributed with unauthorized modifications introduced through a supp… | Patch first | 9.8 critical | 1.2% | 2025-12-17 |
| CVE-2026-114625 KEV | VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and… | Patch first | 9.9 critical | 1% | 2026-10-22 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt