CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
424,905 CVEs
1,779 on KEV
17,545 EPSS ≥ 10%
25,095 with exploits
synced 2026-11-12
1,779 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2021-27877 KEV | An issue was discovered in Veritas Backup Exec before 21.2. It supports multiple authentication schemes: SHA authentication is one of these. This auth… | Patch first | 8.2 high | 64.9% | 2021-03-01 |
| CVE-2021-30551 KEV | Type confusion in V8 in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | Patch first | 8.8 high | 64.7% | 2021-06-15 |
| CVE-2016-7256 KEV | atmfd.dll in the Windows font library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2… | Patch first | 8.8 high | 64.6% | 2016-11-10 |
| CVE-2024-57728 KEV | SimpleHelp remote support software v5.5.7 and before allows admin users to upload arbitrary files anywhere on the file system by uploading a crafted z… | Patch first | 7.2 high | 64.5% | 2025-01-15 |
| CVE-2023-29552 KEV | The Service Location Protocol (SLP, RFC 2608) allows an unauthenticated, remote attacker to register arbitrary services. This could allow the attacker… | Patch first | 7.5 high | 64% | 2023-04-25 |
| CVE-2020-15999 KEV | Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafte… | Patch first | 9.6 critical | 63.9% | 2020-11-03 |
| CVE-2023-43770 KEV | Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with crafted links because of program/li… | Patch first | 6.1 medium | 63.7% | 2023-09-22 |
| CVE-2015-4068 KEV | Directory traversal vulnerability in Arcserve UDP before 5.0 Update 4 allows remote attackers to obtain sensitive information or cause a denial of ser… | Patch first | 9.1 critical | 63.6% | 2015-05-29 |
| CVE-2021-22681 KEV | Rockwell Automation Studio 5000 Logix Designer Versions 21 and later, and RSLogix 5000 Versions 16 through 20 use a key to verify Logix controllers ar… | Patch first | 9.8 critical | 63.6% | 2021-03-03 |
| CVE-2023-35081 KEV | A path traversal vulnerability in Ivanti EPMM versions (11.10.x < 11.10.0.3, 11.9.x < 11.9.1.2 and 11.8.x < 11.8.1.2) allows an authenticated adminis… | Patch first | 7.2 high | 63.6% | 2023-08-03 |
| CVE-2021-30632 KEV | Out of bounds write in V8 in Google Chrome prior to 93.0.4577.82 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML p… | Patch first | 8.8 high | 63.2% | 2021-10-08 |
| CVE-2025-43300 KEV | An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.8.5 and iPadOS 15.8.5, iOS 16.7.12 and iPadOS… | Patch first | 10.0 critical | 63.2% | 2025-08-21 |
| CVE-2026-45498 KEV | Microsoft Defender Denial of Service Vulnerability | Patch first | 4.0 medium | 63.1% | 2026-05-20 |
| CVE-2026-82078 KEV | An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates… | Patch first | 9.1 critical | 63% | 2026-08-28 |
| CVE-2025-47813 KEV | loginok.html in Wing FTP Server before 7.4.4 discloses the full local installation path of the application when using a long value in the UID cookie. | Patch first | 4.3 medium | 62.5% | 2025-07-10 |
| CVE-2022-21445 KEV | Vulnerability in the Oracle Application Development Framework (ADF) product of Oracle Fusion Middleware (component: ADF Faces). Supported versions th… | Patch first | 9.8 critical | 62.5% | 2022-04-19 |
| CVE-2021-22991 KEV | On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3, undisclos… | Patch first | 9.8 critical | 62.4% | 2021-03-31 |
| CVE-2018-4939 KEV | Adobe ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions have an exploitable Deserialization of Untrusted Data vul… | Patch first | 9.8 critical | 61.8% | 2018-05-19 |
| CVE-2018-8373 KEV | A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scripting Engin… | Patch first | 7.5 high | 61.8% | 2018-08-15 |
| CVE-2024-23113 KEV | A use of externally-controlled format string in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, FortiProxy v… | Patch first | 9.8 critical | 61.7% | 2024-02-15 |
| CVE-2020-4428 KEV | IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, and 2.0.4 could allow a remote authenticated attacker to execute arbitrary commands on the system. IBM X-Fo… | Patch first | 9.1 critical | 61.7% | 2020-05-07 |
| CVE-2026-59310 KEV | VMware vCenter contains a directory traversal vulnerability in the Syslog server. A malicious actor with network access to vCenter may exploit this is… | Patch first | 9.8 critical | 61.7% | 2026-07-30 |
| CVE-2015-7755 KEV | Juniper ScreenOS 6.2.0r15 through 6.2.0r18, 6.3.0r12 before 6.3.0r12b, 6.3.0r13 before 6.3.0r13b, 6.3.0r14 before 6.3.0r14b, 6.3.0r15 before 6.3.0r15b… | Patch first | 9.8 critical | 61.4% | 2015-12-19 |
| CVE-2026-21510 KEV | Protection mechanism failure in Windows Shell allows an unauthorized attacker to bypass a security feature over a network. | Patch first | 8.8 high | 61.2% | 2026-02-10 |
| CVE-2025-58360 KEV | GeoServer is an open source server that allows users to share and edit geospatial data. From version 2.26.0 to before 2.26.2 and before 2.25.6, an XML… | Patch first | 8.2 high | 61.2% | 2025-11-25 |
| CVE-2024-54085 KEV | AMI’s SPx contains a vulnerability in the BMC where an Attacker may bypass authentication remotely through the Redfish Host Interface. A successful ex… | Patch first | 9.8 critical | 60.7% | 2025-03-11 |
| CVE-2025-53690 KEV | Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Code Injection.This issu… | Patch first | 9.0 critical | 60.7% | 2025-09-03 |
| CVE-2026-33634 KEV | Trivy is a security scanner. On March 19, 2026, a threat actor used compromised credentials to publish a malicious Trivy v0.69.4 release, force-push 7… | Patch first | 8.8 high | 60.4% | 2026-03-23 |
| CVE-2025-62593 KEV | Ray is an AI compute engine. Prior to version 2.52.0, developers working with Ray as a development tool can be exploited via a critical RCE vulnerabil… | Patch first | 8.8 high | 60.2% | 2025-11-26 |
| CVE-2014-4148 KEV | win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Wind… | Patch first | 8.8 high | 59.9% | 2014-10-15 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt