CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
424,799 CVEs
1,779 on KEV
17,541 EPSS ≥ 10%
25,095 with exploits
synced 2026-11-12
1,779 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2023-28432 KEV | Minio is a Multi-Cloud Object Storage framework. In a cluster deployment starting with RELEASE.2019-12-17T23-16-33Z and prior to RELEASE.2023-03-20T20… | Patch first | 7.5 high | 84% | 2023-03-22 |
| CVE-2015-3035 KEV | Directory traversal vulnerability in TP-LINK Archer C5 (1.2) with firmware before 150317, C7 (2.0) with firmware before 150304, and C8 (1.0) with firm… | Patch first | 7.5 high | 83.9% | 2015-04-22 |
| CVE-2019-9874 KEV | Deserialization of Untrusted Data in the Sitecore.Security.AntiCSRF (aka anti CSRF) module in Sitecore CMS 7.0 to 7.2 and Sitecore XP 7.5 to 8.2 allow… | Patch first | 9.8 critical | 83.7% | 2019-05-31 |
| CVE-2021-27561 KEV | Yealink Device Management (DM) 3.6.0.20 allows command injection as root via the /sm/api/v1/firewall/zone/services URI, without authentication. | Patch first | 9.8 critical | 83.6% | 2021-10-15 |
| CVE-2019-0193 KEV | In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in which the who… | Patch first | 7.2 high | 83.5% | 2019-08-01 |
| CVE-2022-26923 KEV | Active Directory Domain Services Elevation of Privilege Vulnerability | Patch first | 8.8 high | 83.5% | 2022-05-10 |
| CVE-2023-36847 KEV | A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on EX Series allows an unauthenticated, network-based attack… | Patch first | 5.3 medium | 83.5% | 2023-08-17 |
| CVE-2025-14847 KEV | Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthenticated client. This issue af… | Patch first | 7.5 high | 83.2% | 2025-12-19 |
| CVE-2022-24990 KEV | TerraMaster NAS 4.2.29 and earlier allows remote attackers to discover the administrative password by sending "User-Agent: TNAS" to module/api.php?mob… | Patch first | 7.5 high | 83.2% | 2023-02-07 |
| CVE-2020-3992 KEV | OpenSLP as used in VMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before ESXi670-202010401-SG, 6.5 before ESXi650-202010401-SG) has a use-after-… | Patch first | 9.8 critical | 83% | 2020-10-20 |
| CVE-2024-42009 KEV | A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim… | Patch first | 9.3 critical | 82.9% | 2024-08-05 |
| CVE-2024-0769 KEV | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DIR-859 1.06B01. It has been rated as critical. Affected by this issue is some unk… | Patch first | 5.3 medium | 82.7% | 2024-01-21 |
| CVE-2019-7194 KEV | This external control of file name or path vulnerability allows remote attackers to access or modify system files. To fix the vulnerability, QNAP reco… | Patch first | 9.8 critical | 82.7% | 2019-12-05 |
| CVE-2014-1776 KEV | Use-after-free vulnerability in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of servic… | Patch first | 9.8 critical | 82.7% | 2014-04-27 |
| CVE-2026-111497 KEV | A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote… | Patch first | 9.8 critical | 82.6% | 2026-10-22 |
| CVE-2021-23758 KEV | All versions of package ajaxpro.2 are vulnerable to Deserialization of Untrusted Data due to the possibility of deserialization of arbitrary .NET clas… | Patch first | 8.1 high | 82.6% | 2021-12-03 |
| CVE-2023-27992 KEV | The pre-authentication command injection vulnerability in the Zyxel NAS326 firmware versions prior to V5.21(AAZF.14)C0, NAS540 firmware versions prior… | Patch first | 9.8 critical | 82.3% | 2023-06-19 |
| CVE-2017-11826 KEV | Microsoft Office 2010, SharePoint Enterprise Server 2010, SharePoint Server 2010, Web Applications, Office Web Apps Server 2010 and 2013, Word Viewer,… | Patch first | 7.8 high | 82.2% | 2017-10-13 |
| CVE-2021-40449 KEV | Win32k Elevation of Privilege Vulnerability | Patch first | 7.8 high | 81.9% | 2021-10-13 |
| CVE-2026-88771 KEV | Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-… | Patch first | 9.8 critical | 81.9% | 2026-09-27 |
| CVE-2025-34026 KEV | The Versa Concerto SD-WAN orchestration platform is vulnerable to an authentication bypass in the Traefik reverse proxy configuration, allowing at att… | Patch first | 7.5 high | 81.8% | 2025-05-21 |
| CVE-2026-105134 KEV | A flaw has been found in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.d… | Patch first | 10.0 critical | 81.8% | 2026-10-04 |
| CVE-2021-26411 KEV | Internet Explorer Memory Corruption Vulnerability | Patch first | 8.8 high | 81.7% | 2021-03-11 |
| CVE-2021-31955 KEV | Windows Kernel Information Disclosure Vulnerability | Patch first | 5.5 medium | 81.1% | 2021-06-08 |
| CVE-2024-43468 KEV | Microsoft Configuration Manager Remote Code Execution Vulnerability | Patch first | 9.8 critical | 81% | 2024-10-08 |
| CVE-2017-0262 KEV | Microsoft Office 2010 SP2, Office 2013 SP1, and Office 2016 allow a remote code execution vulnerability when the software fails to properly handle obj… | Patch first | 7.8 high | 81% | 2017-05-12 |
| CVE-2025-54253 KEV | Adobe Experience Manager versions 6.5.23 and earlier are affected by a Misconfiguration vulnerability that could result in arbitrary code execution. A… | Patch first | 10.0 critical | 80.8% | 2025-08-05 |
| CVE-2023-27532 KEV | Vulnerability in Veeam Backup & Replication component allows encrypted credentials stored in the configuration database to be obtained. This may lead… | Patch first | 7.5 high | 80.6% | 2023-03-10 |
| CVE-2025-8110 KEV | Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code. | Patch first | 8.8 high | 80.3% | 2025-12-10 |
| CVE-2026-48558 KEV | SimpleHelp versions 5.5.15 and prior and 6.0 pre-release versions contain an authentication bypass vulnerability in the OIDC authentication flow. When… | Patch first | 10.0 critical | 80.3% | 2026-06-12 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt